Learn about the most widespread crypto scams in the real world — how they work, what they target, and how to stay safe.
Warning: This information is for educational purposes only. Never attempt to replicate these types of scams or engage in fraudulent activities.
This page is designed to help you recognize and understand the cryptocurrency scam schemes. Whether you're new to crypto or have been involved for years, understanding the cryptocurrency scam schemes is essential for protecting your assets and staying safe online. By understanding the patterns and tactics used by scammers, you’ll be better prepared to identify red flags and avoid becoming a victim.
Phishing, Privacy Attack
To trick the victim into entering their private credentials (seed phrase, passwords, private keys) or signing a malicious transaction, by disguising a fake website as a legitimate crypto service.
The attacker creates a clone of a well-known crypto platform — an exchange, wallet, marketplace, or DeFi app — and distributes links through emails, social media, paid ads, or chat messages. A common trick is typosquatting: using domains that look almost identical to the real one (e.g., swapping one or two letters). The victim clicks the link, sees a familiar interface, and logs in — unknowingly sending their credentials to the attacker. Sometimes the fake page displays a prompt to “connect your wallet”, “claim rewards”, or “verify your seed phrase”. These forms are designed to capture sensitive data. In other cases, a pop-up window may request wallet access or a transaction approval. Believing it’s official, the user approves the action. Once credentials or signatures are collected, the attacker instantly drains the victim’s funds from accounts or connected wallets.
Phishing, Social Engineering, Privacy Attack
To impersonate an official support agent and trick the victim into revealing sensitive access data — such as 2FA codes, seed phrases, private keys — or to convince them to approve a transaction in favor of the attacker.
The attacker creates a fake profile on platforms like Telegram, Twitter/X, or Discord, mimicking the name, avatar, and tone of the project’s official support team. They contact the victim under the pretext of a “technical issue”,“account verification”, or “urgent notification”. The conversation typically leads to a phishing link where the victim is asked to log in, share a 2FA code, or provide their seed phrase for “security verification” or “account recovery.” In some cases, attackers even call the victim, posing as official support staff and urging them to connect to remote assistance tools or transfer funds to a “safe wallet.” Another common trick is the creation of fake support tickets or invitations to private chats, where the attacker increases psychological pressure and creates urgency. These scams often target users who have publicly asked for help — for example, those posting about issues on forums or social media. Once the victim discloses private data or grants access, the attacker immediately takes control of their accounts and drains funds.
Investment Fraud, Social Engineering
Steal goods or other assets from a seller accepting crypto payments.
Anyone can deploy an ERC-20 smart contract and give it any name and ticker. A scammer deploys a token named “Tether USD” or “USDT”, mints tokens, and sends them to the seller’s address. The attacker then provides a TxID or a screenshot that appears to show a successful transfer of tokens. A rushed or distracted seller checks the transaction ID in a block explorer, sees a transfer labeled “USDT” and assumes payment is received — but the transfer is of a different token contract, not the official Tether contract. Because the explorer shows the token symbol and an amount, it’s easy to be fooled unless the seller inspects the token contract and full balance. After the seller hands over the goods, the attacker is gone.
Investment Fraud, Social Engineering
Trick the victim into sending fiat money while creating the illusion that USDT has been deposited to their exchange account.
A variation of the “Payment with Counterfeit Coins” scheme. The user wants to purchase USDT and encounters a scammer offering exchange services. The scammer insists they will send the payment only to the exchange deposit address, framing it as the proper or safer method. The attacker sends fake USDT tokens to the exchange address, then provides the victim with a TxID or block explorer screenshot showing a transfer labeled as USDT. They claim the deposit hasn’t appeared yet, blaming the exchange, and insist that they have fulfilled their part of the deal. Using the exchange as a “third party,” the scammer convinces the victim to release fiat money, creating the impression that any issues are the exchange’s responsibility. Once the victim sends the money, the scammer disappears. The tokens are worthless or never credited, and the victim loses their funds.
Network Exploit, Social Engineering, Wallet Manipulation
Trick a user into sending funds to an attacker’s address (which closely resembles the intended address) by “poisoning” the user’s transaction history so the victim copies or selects the malicious address by mistake.
An attacker identifies a victim who repeatedly transacts with the same counterparty (their own wallet, an exchange deposit address, a vendor, etc.). Using address-generation tools, the attacker creates an address that matches several leading and/or trailing characters of the legitimate address so it looks visually similar.
Then, the attacker sends a micro-transaction (tiny amount of token) from the look-alike address to the victim’s address. That transfer appears in the victim’s wallet transaction history or block explorer and shows the attacker’s address in the same position as familiar entries. A more advanced scheme: the attacker deploys a scam-token smart contract that copies the name and logo of the token the victim frequently sends, and injects special events into that contract which are then broadcast to the blockchain. Block explorers and some wallet UIs parse those events and display a plausible but misleading transfer history. This creates a false sense of trust for the victim — because the history appears to show that they themselves made the transfer.
When the victim needs to copy their own or a counterparty address quickly, they open recent transactions, see a “familiar” entry (the poisoned one), copy it, and paste it into the recipient field. The transfer goes to the attacker’s address.
Network Exploit, Privacy Attack, Wallet Manipulation
Collect transaction linkage data to de-anonymize an owner’s wallet(s) and build a profile for targeted follow-up attacks (phishing, SIM-swap, doxxing, or sale of user data).
An attacker sends tiny outputs — dust (very small amounts of coin) — to thousands of addresses. On UTXO chains (Bitcoin, Litecoin, etc.) these tiny outputs become spendable UTXOs in the recipient’s wallet.
When a recipient later spends, consolidates, or forwards those UTXOs (for example by sweeping small outputs into a larger transaction or using CoinJoin incorrectly), the attacker can follow the on-chain trails and link multiple addresses to a single cluster or user. Over time, combining on-chain links with off-chain signals (exchange deposits, public posts) allows the attacker to map an identity to addresses and assemble a profile of balances, counterparties, and activity windows.
The attacker then uses that profile for further attacks: targeted phishing attacks, SIM swaps, or offers to "delete" dust tokens through fake services that require a seed phrase. Sometimes, the metadata of dusted tokens contains links to phishing sites or trivial advertisements.
Network Exploit, Social Engineering
Convince a counterparty (merchant, seller, or person) to accept an unconfirmed transaction as payment, then replace that unconfirmed transaction with a conflicting one that returns the coins to the attacker.
A typical race attack exploits the window when a transaction is visible but not yet confirmed.
Preparation: The attacker first sends the required amount to their own address, setting the lowest possible transaction fee, ensuring that the transaction remains unconfirmed for The attacker times the attempt during higher network load and chooses a fee slightly below the level that would guarantee immediate confirmation. The goal is for the payment to remain unconfirmed long enough for the seller to act.
Broadcast the “payment”: The attacker broadcasts a transaction that spends coins to the merchant’s address. The merchant sees the incoming, unconfirmed transaction in their wallet or explorer and may interpret that as sufficient evidence of payment.
Psychological pressure: The attacker applies social pressure or urgency — asking the merchant to ship goods, release digital content, or transfer fiat immediately on the assumption that the unconfirmed payment will be confirmed.
Double-spend: After the merchant has acted, the attacker broadcasts a second transaction spending the same inputs but sending the funds back to themselves (or to another address) with a higher fee. Miners include the higher-fee transaction in a block; the original unconfirmed transaction becomes invalid and is dropped. The attacker ends up with the goods/fiat and retains the coins.
*Bonus: If you are certain that this type of attack is being carried out against you, it is theoretically possible to intercept the attacker’s coins. As soon as you notice an unconfirmed transaction, you may immediately create your own transaction that spends the same coins from the unconfirmed transaction but sets an exceptionally high transaction fee. In this case, either your transaction with the higher fee will be confirmed first — sending the coins to your address — or the attacker will raise their fee even higher and lose almost the entire amount in fees.
Investment Fraud, Rug Pull
Collect funds from project participants and then remove liquidity or assets, leaving token holders with worthless, illiquid tokens or crashing the token price.
A team (or attacker) creates a token and a liquidity pool on a DEX so people can buy the token. To attract buyers they run an aggressive promo campaign — social media, private chats, bots, promises of high returns and “exclusive listings.” They often build a polished website, a fake roadmap, and forged endorsements.
After a substantial inflow of funds the attackers either remove liquidity from the pool (liquidity-draining rug pulls, the most common) or dump large token holdings, causing the price to collapse and trapping holders with tokens that cannot be sold (exit-scam dumps).
Phishing
Trick a user into granting a token allowance (approve) so the attacker can withdraw any amount at will.
An attacker sets up a phishing website or app and lures the victim. When the user interacts with the fake interface, they are prompted to “approve” a token for swapping, claiming rewards, or participating in a program. The interface often suggests approving the maximum or unlimited amount for convenience. Users confirm the transaction without realizing they’ve given the attacker permission to withdraw any amount of that token. Once approved, the attacker can drain the tokens — sometimes gradually to avoid suspicion.
Common tactics include: fake buttons or misleading text hiding the actual approve request; messages like “Claim your tokens — just approve” to trick users into unlimited allowances.
Even legitimate DApps sometimes request unlimited approvals; the key difference is whether the DApp is trustworthy and audited.
Malware, Phishing, Privacy Attack
Steal a user’s private keys or seed phrases, or automatically sign transactions in favor of the attacker via fake wallets or malicious browser extensions.
An attacker publishes a fake wallet extension in a browser store or spreads an installer through websites and social media. When a user installs the wallet: the wallet can intercept the seed phrase during setup or capture manually entered private keys. The extension may automatically sign transactions without the user’s approval, or alter destination addresses in the UI, redirecting funds to the attacker, or manipulate displayed addresses on websites to trick users into sending funds to the wrong place.
Social Engineering, Privacy Attack
Gain control of a victim’s phone number to intercept SMS-based 2FA codes and recover access to email, exchange, and social media accounts, ultimately stealing crypto assets.
An attacker collects the victim’s personal data via phishing, data leaks, or social media. They then contact the mobile operator, requesting the number to be “transferred” to a new SIM card. If the operator performs insufficient verification, the attacker receives SMS messages, recovery codes, and access to accounts. With control of the victim’s email and 2FA, the attacker can reset passwords and drain crypto holdings. Sometimes attackers bribe operator employees or use social engineering to bypass checks. SIM swap attacks are often combined with phishing campaigns and leaked data to increase success rates.
Phishing
Trick users into buying fake NFTs, or gain control over NFTs through fraudulent approvals.
Attackers create replicas of popular NFT marketplaces or collection pages and advertise “discounts,” “sales,” or “airdrops.” When a user connects their wallet and signs a transaction, they might think they are purchasing an NFT, but in reality, they are: granting spending permissions (approve) to the attacker, or transferring ownership of their NFT.
Another common tactic is selling visually similar fake versions of rare NFTs using the same names and images. Scammers often set up fake Twitter or Discord accounts posing as curators and announce “exclusive sales” with secret links.
Social Engineering
Trick users into importing someone else’s seed phrase into their wallet so the scammer can steal the funds they send (usually for transaction fees) and generate a steady stream of small profits.
A scammer posts a message on forums, Telegram, Discord, Twitter, YouTube comments, Reddit, or any other platform — or sends a direct message — pretending to be a naive beginner and asking for help to transfer crypto. They share a wallet with tokens. A victim — usually a newcomer — either wants to help or is tempted to claim the 'free' tokens, and imports the seed phrase into their wallet, seeing real tokens inside. However, to transfer these tokens, the wallet requires paying network fees (gas) in the blockchain’s native currency — e.g., ETH, BNB, MATIC. The victim sends a small amount of ETH or another coin to pay the gas.
A scammer posts a message on forums, Telegram, Discord, Twitter, YouTube comments, Reddit, or any other platform, pretending to be a naive beginner. They share a wallet with tokens. A victim — usually a newcomer — imports the seed phrase into their wallet and sees real tokens inside. Excited by the opportunity, they rush to claim the “free” tokens. However, to transfer these tokens, the wallet requires paying network fees (gas) in the blockchain’s native currency — e.g., ETH, BNB, MATIC. The victim sends a small amount of ETH or another coin to pay the gas. Meanwhile, the scammer, constantly monitoring the wallet, immediately drains the deposited gas funds. Some scammers use multisig wallets to minimize their own risk, ensuring they act faster than any other potential “claimers.” The victim loses money, while the scammer earns a steady flow of small deposits from many unsuspecting users.
Malware
Intercept and steal cryptocurrency during a transaction by replacing the recipient address with the attacker’s address.
The victim is tricked into installing software: a fake wallet, game patch, “crypto tool,” PDF/archive with embedded malware, a malicious link, infected USB drive, or a compromised installer. The malware gains access to the system and monitors the clipboard. When it detects text resembling a crypto address (e.g., starting with 0x for Ethereum), it automatically replaces it with the attacker’s address. The victim pastes the address (Ctrl+V) into the recipient field, believing it’s correct, and sends funds — which go straight to the attacker.
Social Engineering
Build a romantic or “trusted” relationship with the victim to emotionally manipulate them into sending crypto or sharing access to funds.
The scammer creates an attractive profile (stolen photos are common) and contacts the victims on a dating sites, Telegram, or Instagram. They often seek out victims in specialized crypto chats, sending them a private message asking for more information about the chat, a review of an influencer, or a recommendation for crypto courses. The conversation quickly turns to personal topics, with frequent messages, compliments, and emotional support. Over days or weeks, the scammer builds trust, shares personal "stories", supposedly sharing similar values, sometimes showing "photos", and making phone calls. They demonstrate a willingness to engage in financial relationships (joint purchases, investments, assistance).
When trust is high the scammer manufactures an emergency or opportunity that requires money — e.g., sudden medical bills, visa fees, “taxes” to withdraw funds, or a time-limited “exclusive investment.” They pressure the victim (guilt, urgency, secrecy: “don’t tell anyone”), push complex instructions (use this wallet/bridge/exchange), or ask for a direct crypto transfer. After the transfer the scammer may invent further needs (“one more fee”) until the victim completely stops communicating.
Social Engineering
Make the victim misread a numeric amount (due to dot/comma/space differences) and send a large “refund” or overpayment to the attacker.
The attacker and victim agree a payment — for example, $125. The attacker sends a small amount that looks ambiguous in certain locale formats (e.g. 1,125 USDT or 1.125 USDT) — which may mean one point one two five (1.125) in some locales and one thousand one hundred twenty five (1,125) in others.
Immediately the attacker contacts the victim claiming they accidentally sent 1,125 (one thousand one hundred twenty five) instead of 125, demanding an immediate refund of the “excess” $1,000 (one thousand). They rush and distract with calls/messages, pressure, or threats. The victim glances at a screenshot or a transaction listing and — reading the separator differently or misreading the display — thinks the attacker really overpaid, so returns the “extra” funds from their own wallet. In reality the on-chain amount was a tiny sum and there was nothing to refund.
Phishing, Malware
Trick victims into using counterfeit or tampered hardware wallets so attackers can steal private keys, intercept seed phrases, or cause the device to sign transactions that benefit the attacker.
An attacker produces fake hardware wallets that look very similar to real brands (or rebuilds a genuine-looking shell with malicious internals) and sells them via unofficial marketplaces, auction sites, social media, or even in person.
Phishing, Social Engineering
To trick users into believing they’ve found a profitable or exploitable smart contract — luring them to deposit funds that can’t actually be withdrawn.
In general, a Honeypot is the cheese in the mousetrap — something that looks irresistibly good, but exists only to lure the victim in. In the crypto world, it refers to any setup that promises easy profit, risk-free investment, or unrealistically favorable conditions — yet is designed so that only the scammer can win.
In first scenario, scammers mint a new token, add liquidity on a DEX, and aggressively market it (socials, influencers, Telegram, fake AMAs, “exclusive listing” claims). Price moves up as buyers enter, liquidity looks present, and charts look healthy — until holders try to sell. Due to hidden logic in the token contract, sell / transfer to a DEX router or transferFrom that would move tokens out of user wallets reverts, returns false, or is blocked by conditions (whitelists, huge sell tax, per-address flags, canSell checks, blacklists). The attacker can still transfer or swap tokens (often because they are exempted by a whitelist or isOwner condition), so they can withdraw liquidity or sell their allocation while others cannot.
In second scenario, attackers deploy a smart contract that looks vulnerable, such as one that appears to let anyone drain its balance or claim tokens. The code might contain a visible “bug” or permission flaw that tempts users to exploit it for quick profit. When a victim sends crypto to the contract in an attempt to trigger the “exploit,” they find that their withdrawal transaction fails — because the code includes hidden logic that blocks them, while still allowing the scammer’s own wallet to move funds freely.
Phishing, Social Engineering
Steal funds, credentials, API keys, or trick users into sending crypto by abusing trust in “automated trading” — either by selling worthless/rogue trading bots or by delivering malicious trading signals and instructions.
Scammers sell or promote “high-performance” trading bots, signal services, or automated strategies promising big, consistent returns — often backed by doctored performance screenshots, fake audits, or fabricated testimonials to build credibility and drive sales.
Victims may be experienced traders attracted by the promise of automation or newcomers chasing “easy alpha.” Losses range from subscription fees to full account drain.
Phishing, Social Engineering
Steal the victim’s cryptocurrency by gaining access to their wallet seed phrase.
The scammer arranges an in-person meeting under the pretext of a legitimate offline crypto exchange. They claim that the victim’s existing wallet might be “compromised” or “dirty” and insist that a new wallet must be created. While assisting or observing the wallet creation, the scammer covertly records or photographs the victim’s seed phrase using hidden cameras or a third party. Once the seed phrase is exposed, the scammer can empty the wallet remotely.
If you’ve been a victim of a scam or have uncovered a new type of fraud, tell us about it. Verified cases may be added (anonymously, if you wish) to our Scam Schemes Catalog to help others recognize and avoid similar traps.
Awareness and education are key tools to protect yourself from evolving scam tactics. But remember: it’s impossible to know or anticipate every scam out there — technology evolves, and scammers constantly invent new ways to steal your funds. What matters is staying alert and building smart security habits.
Always research new projects, wallets, and dApps before interacting or investing.
Prefer hardware wallets, verified extensions, and strong 2FA for all crypto operations.
Share your knowledge with friends and colleagues — awareness helps prevent future scams.
Scams and schemes are just one part of the story — but what happens when they succeed? Explore some of the most significant hacks and thefts in crypto history, how they happened, and what lessons they offer for protecting your assets today. Learn from the past to better secure your future in crypto.