Common Crypto Scams and How to Avoid Them

Crypto scams cost users an estimated $4-10 billion per year. Almost all of them use a small set of repeatable playbooks. Once you can recognize the patterns, most scams become obvious. This guide walks through every major scam category active in 2026 with real examples, exact playbooks, and a defensive checklist that stops most attacks before they start. If you internalize just three rules from this article, you will avoid 95% of losses.

The three rules that stop almost everything

1. Never enter your seed phrase into anything after initial wallet setup.

Not a website. Not a support chat. Not a "sync tool." Not an "airdrop verification page." Legitimate wallet software never asks for your seed phrase again after initial setup. Any prompt that does is a scam. Period.

2. Never trust a DM about crypto.

Whether on Telegram, Discord, Twitter, Instagram, or LinkedIn — if someone messages you first about a crypto opportunity, an urgent transfer, a customer support issue, or a "wallet compromise," it is a scam. Real support does not DM users. Real opportunities do not require you to move fast.

3. When in doubt, do nothing.

A legitimate opportunity will still exist tomorrow after you've researched it. The pressure to act now is itself a scam signal. The rare "you'll miss out if you don't buy in the next 10 minutes" opportunity you skip loses you nothing on average, because most such opportunities are frauds. The one you skip that would have made money is a rounding error.

Category 1: Phishing scams

The most common and successful scam category. Attackers create pixel-perfect clones of legitimate websites — wallets, exchanges, DEXs, NFT marketplaces — and get victims to visit them via Google ads, phishing emails, Telegram DMs, or fake social media accounts.

The workflow:

1. Victim clicks a link that looks legitimate (e.g., metamask-support[.]com or the top Google ad for "MetaMask login").
2. The fake site prompts them to "reconnect their wallet" or "verify ownership" by entering the seed phrase.
3. The moment the seed phrase is entered, the attacker imports it into their own wallet and drains all funds.

Defenses:

• Bookmark legitimate sites and only navigate via bookmarks.
• Never click sponsored search results for crypto services — the top ad is often a phishing clone.
• Never enter seed phrase into anything after initial setup.
• Use a hardware wallet — even if you get phished, they cannot extract keys from the device.
• For a deeper dive, see
• How to Secure Your Crypto Wallet
• .

Category 2: Fake customer support

Similar to phishing but conversational. Victims post a question on Twitter, Reddit, or a wallet's support forum. Attackers respond via DM pretending to be official support, then walk the victim through "recovery" steps that ultimately require the seed phrase.

The workflow:

1. Victim posts a question ("MetaMask is stuck showing zero balance").
2. Attacker responds via DM with an official-looking name and profile picture, offering to help.
3. Attacker directs victim to a fake support site or asks for a "wallet backup file" (the seed phrase).
4. Once provided, funds are drained.

Defenses:

• Legitimate support NEVER contacts you first.
• Legitimate support NEVER asks for your seed phrase.
• Legitimate support does not require you to install remote-access software.
• When you need support, initiate contact through the official site — never respond to inbound DMs.

Category 3: Rug pulls

A team launches a shiny new token or DeFi protocol. Users deposit funds. The team drains everything and disappears. Estimated total losses to rug pulls exceed $10 billion since 2020.

Rug pull warning signs:

• Anonymous team. No LinkedIn profiles, no verifiable identities, no track record.
• Token launched < 3 months ago.
• Massive advertised APYs (100%, 1,000%, 10,000%).
• No third-party audit, or an "audit" from a company nobody has heard of.
• Rapid marketing push on Telegram / Twitter with paid influencers.
• Concentrated token holdings — a few wallets own most of the supply.

Defenses:

• Do not touch tokens younger than 12 months for anything more than experimentation with money you'd spend on entertainment.
• For DeFi, use protocols with multi-year track records, professional audits, and public bug bounties. See
• DeFi Risks Explained
• .
• Check tokenomics on-chain: if 5 wallets hold 60% of supply, they can dump on you at any moment.

Category 4: Investment / trading platform scams

Fake trading platforms that show victims fake profits until they try to withdraw. Often paired with "romance scams" (pig butchering) — attackers cultivate a fake relationship with victims for weeks or months before introducing the "amazing" trading platform their fake identity supposedly uses.

The workflow:

1. Long-term social engineering (dating apps, LinkedIn, WhatsApp) builds a relationship.
2. The attacker mentions they've been making great returns on a "special" trading platform.
3. Victim deposits $500. Fake dashboard shows profits of $600.
4. Victim can withdraw a small amount to "test" — the withdrawal works.
5. Victim deposits $50,000. Fake dashboard shows $75,000.
6. When victim tries to withdraw, they're told to pay "taxes" or "verification fees" first. These fees are the final theft.

Defenses:

• Never invest based on advice from anyone you met online.
• If a trading platform is not one of the top 15-20 well-known regulated exchanges, do not deposit.
• Withdrawing without extra "verification fees" is a defining feature of legitimate platforms.
• If asked to pay to withdraw your own money, you're being scammed — cut contact immediately.

Category 5: Giveaway scams

"Send 1 ETH to this address and Elon Musk will send you 2 back." Absurd on its face, yet it still steals millions per year.

The workflow:

1. Fake Twitter accounts impersonating Musk, Vitalik, CZ, or other celebrities post about a "giveaway."
2. Victims are told to send a small amount to a specific address and will receive double back.
3. The address is controlled by the scammer. No funds are ever returned.

Defenses:

• No legitimate person or company runs a "send crypto to get more crypto back" campaign. Ever.
• Verify accounts through official website links, not through Twitter blue checks.
• If you're about to send crypto to earn crypto, stop. This is always a scam.

Category 6: Airdrop and NFT signing scams

Victims are informed they're eligible for a "surprise airdrop" or "free NFT." Claiming requires connecting the wallet and signing a transaction. That transaction is not a claim — it's a permission grant that lets the attacker drain the wallet.

The workflow:

1. Victim receives an NFT in their wallet from a random address (this can happen without their consent).
2. The NFT metadata says "Claim your airdrop at [phishing site].com."
3. Victim visits the site and connects wallet.
4. Victim is asked to sign a "claim" — but the signature is actually a token approval or ownership transfer.
5. The attacker executes it and drains the wallet.

Defenses:

• Ignore surprise NFTs. Do not interact with them.
• Use a wallet like Rabby that decodes transaction intent in plain language before you sign.
• For airdrops of legitimate projects, only claim through the project's official site (found via their official Twitter or documentation).
• Never sign a transaction you do not understand.

Category 7: Ice phishing (transaction approval attacks)

A newer, subtler category. Victim interacts with a legitimate-looking DeFi app or airdrop and is asked to "approve" token spend. The approval, once signed, gives the attacker permission to drain that specific token from the wallet forever.

The workflow:

1. Victim visits a fake or malicious DeFi app.
2. App requests token approval with a very large or unlimited amount.
3. Victim signs, expecting normal DeFi behavior.
4. Attacker uses the approval to drain the token at their leisure.

Defenses:

• When approving tokens, use exact amounts (not "unlimited") whenever possible.
• Regularly revoke stale approvals on tools like revoke.cash or etherscan.io/tokenapprovalchecker.
• Use a wallet like Rabby that flags suspicious approvals.
• Assume any DeFi app you found via a DM or Twitter reply is a fake.

The security checklist that stops most losses

Print this. Do it once. Save yourself years of anxiety.

1. Use a hardware wallet for any amount over $1,000. See
2. Hardware Wallets Buyers Guide
3. .
4. Write your seed phrase on paper (or metal). Store it in a location no online attacker can reach.
5. Bookmark legitimate crypto sites. Never navigate via Google ads or DMs.
6. Enable authenticator-app 2FA (not SMS) on every exchange account.
7. Assume DMs are scams. Assume "support" who contacts you first is a scam.
8. Use a separate email address for crypto accounts, not your main one.
9. Revoke stale token approvals every few months.
10. When you don't understand a transaction, do not sign it.
11. Keep the majority of holdings offline. Only move small amounts to hot wallets for active use.

You will never make money as fast as you can lose it in crypto. Scams remove years of savings in seconds. Building good security habits is the highest-return investment a crypto user can make — it costs almost nothing and prevents ruinous losses.

Continue learning

Related: How to Secure Your Crypto Wallet · Hot vs Cold Wallets · Hardware Wallets Buyers Guide · DeFi Risks Explained.