Crypto Scams & Fraud: How to Stay Safe

Crypto fraud comes in many shapes, but the categories below cover most cases reported to consumer-protection agencies. Schemes often blend several of these techniques.

Investment and "pig butchering" scams

Currently the costliest category by far. A stranger contacts you through a dating app, social media, or a "wrong number" text and builds trust over days or weeks. Eventually they introduce a can't-lose crypto opportunity on a slick but fake platform that shows your balance growing. The fake gains are bait: when you try to withdraw, you are told to pay taxes or fees first, then the platform and the "friend" vanish. The slow grooming followed by the financial slaughter is known as "pig butchering."

Phishing and impersonation

Fraudsters pose as an exchange, wallet provider, government agency, or well-known company to trick you into revealing login details, two-factor codes, or your recovery phrase. This is covered in the next section.

Romance scams

A fake online partner steers conversations toward money, eventually asking you to send crypto for an emergency or a shared investment. These overlap heavily with pig-butchering fraud.

Giveaway and celebrity-impersonation scams

You are promised that if you send a small amount of crypto, you will get double back. Scammers spoof the names and faces of well-known founders using hacked or look-alike accounts, livestreams, and increasingly AI-generated deepfake videos. No legitimate giveaway ever requires you to send funds first.

Fake exchanges, wallets, and apps

Malicious apps and sites mimic real services to capture your credentials or seed phrase, or let you "deposit" funds you can never withdraw. Some malware silently swaps a copied wallet address for the attacker's when you paste it.

Ransomware, extortion, and blackmail

Criminals lock your files or threaten to release embarrassing material and demand crypto because it is hard to trace. Paying rarely makes the threat go away and may invite further demands.

Recovery and refund scams

After someone is defrauded, a second scammer poses as a "fund recovery" service, lawyer, or regulator, promising to retrieve lost crypto for an upfront fee. This re-victimizes people who have already lost money.

Phishing is the engine behind a large share of crypto theft. The goal is always the same: get you to type a secret (password, 2FA code, or recovery phrase) into something the attacker controls, or to approve a transaction or token permission you do not understand.

How phishing attacks reach you

• Email and SMS: Messages that look like they come from your exchange or wallet, warning of "suspicious activity," a "locked account," or "required verification," with a link to a fake login page.
• Fake or look-alike websites: Domains that differ from the real one by a single character, a different ending, or a hyphen. Search-engine ads are a common delivery method, so the top result is not always the official site.
• Fake support staff: Imposters in social media replies, Telegram, Discord, and forums offer to "help," then ask you to share your screen, enter your seed phrase into a "validation tool," or connect your wallet to a malicious site.
• Malicious wallet approvals: Rather than steal a password, some sites trick you into signing a transaction that grants permission to move your tokens or NFTs.

Red flags of a phishing attempt

• Pressure and urgency: "Act now or your account will be frozen."
• A sender address or URL that is almost, but not exactly, the real one.
• Spelling, grammar, or formatting that feels slightly off (though AI has made many messages look polished).
• Any request for your recovery phrase, private key, or full password. No legitimate company will ever ask for these.
• Unexpected attachments, QR codes, or links you did not request.

How to protect yourself

• Never enter your seed phrase or private key into any website, app, form, or support chat. The only time you should ever type a recovery phrase is when restoring a wallet in trusted, official software.
• Reach sites by typing the address yourself or using a saved bookmark, not by clicking links in messages or ads.
• Verify the full domain character by character before logging in, and check for a valid HTTPS connection (though HTTPS alone does not prove a site is legitimate).
• Treat unsolicited contact from "support" as hostile until proven otherwise, and reach out through the company's official channels instead.
• Before approving any wallet transaction, read what it actually authorizes, and periodically review and revoke token approvals you no longer use.

Some of the largest crypto losses come not from a single stolen password but from schemes that are fraudulent by design. Ponzi schemes and rug pulls dress fraud up as an investment opportunity.

Ponzi and high-yield schemes

A Ponzi scheme pays "returns" to earlier participants using money from newer participants rather than from any real profit. They advertise fixed, guaranteed daily or weekly returns and lean on referral bonuses to recruit a constant stream of new deposits. They look stable while money flows in and collapse the moment withdrawals outpace new deposits. Warning signs include guaranteed or suspiciously consistent returns, secretive "strategies" that are never clearly explained, and rewards for recruiting friends and family.

Rug pulls

A rug pull happens when the creators of a token hype it up, attract buyers, then disappear with the money, often after draining the liquidity that let the token be traded. The price crashes to near zero and holders cannot sell. Rug pulls are most common with brand-new tokens that have anonymous teams and little real product.

A note on smart contracts

Smart contracts can reduce certain fraud because they execute automatically and record every transaction on a public, tamper-resistant ledger. But they are not magic. A contract only does what it was written to do, and poorly written or malicious code can hide functions that let insiders mint unlimited tokens, block withdrawals, or seize funds. "On the blockchain" and "audited" are not guarantees of safety on their own.

Warning signs of a Ponzi or rug pull

• Promises of high returns with little or no risk; legitimate investments cannot guarantee profit.
• Anonymous or unverifiable founders, or a team that dodges questions about its background.
• Heavy reliance on recruitment, referral commissions, and hype rather than a working product.
• Difficulty withdrawing, sudden new "fees" before you can cash out, or rules that lock up funds.
• Vague answers about how the project is registered or regulated.
• Tokens with concentrated ownership, unlocked liquidity, or contracts that have not been independently reviewed.

This section is educational and is not investment advice. If you are evaluating any project, confirm details independently and consider seeking guidance from a qualified, licensed professional.

You do not need to memorize every scam to stay safe. A short list of universal red flags, combined with strong wallet habits, will stop most attacks before they start.

Universal red flags

Wallet and account security habits

• Protect your recovery phrase above all else. Store it offline in a secure place. Never type it into a website or save it in a screenshot, cloud note, or email, and never share it.
• Use a hardware wallet (cold storage) for meaningful amounts, keeping the bulk of your crypto offline while a smaller "hot" wallet handles day-to-day activity.
• Enable strong two-factor authentication. Prefer an authenticator app or hardware security key over SMS codes, which can be intercepted through SIM-swap attacks.
• Use long, unique passwords for every account, ideally via a reputable password manager. Never reuse passwords across platforms.
• Keep software updated for your wallet, browser, operating system, and antivirus so known vulnerabilities are patched.
• Avoid managing crypto over public Wi-Fi, and double-check any address before sending, since address-swapping malware can alter a pasted address.
• Slow down. Most scams fail if you pause, verify through official channels, and refuse to be rushed.

If you think you have been scammed

• Stop all contact and send no more money, including to anyone promising to recover your funds.
• Move any remaining assets to a new, secure wallet if you suspect your keys or device are compromised.
• Document everything: addresses, transaction IDs, usernames, screenshots, and messages.
• Report it to your exchange or wallet provider and to the authorities in your country. In the United States, that includes the FBI's Internet Crime Complaint Center (IC3.gov) and the Federal Trade Commission; elsewhere, contact your national cybercrime or consumer-protection agency.
• Be aware that recovering crypto is difficult and often impossible, which is why prevention matters most.

This guide is for general education only and is not financial, legal, or tax advice. For your specific situation, verify details with official regulators and consult a qualified professional.

Can stolen cryptocurrency be recovered?

Will a legitimate exchange or wallet ever ask for my seed phrase or private key?

What is a "pig butchering" scam?

How is AI changing crypto scams in 2026?

Are hardware wallets really safer than keeping crypto on an exchange?