Crypto Scams and Red Flags: How to Protect Your Money From the Traps
Cryptocurrency has a crime problem with a simple root: transactions cannot be reversed, and beginners arrive carrying money and optimism. Billions are lost to scams every year — not to brilliant hackers, mostly, but to ordinary persuasion wearing a crypto costume. The good news is that nearly every major scam pattern announces itself in advance. Learn the catalogue below and you will recognise the traps before your money is inside them.
The pig-butchering scam: the most expensive one. It begins as a friendly wrong-number text, a dating-app match, or a social media conversation that drifts, over days or weeks, into “investing”. The new friend shows screenshots of their profits on a trading app and helps you deposit — the app shows dazzling gains, small withdrawals may even work, and you are encouraged to add more. The app is fake. When you try to withdraw the real money, “taxes” or “fees” must be paid first — also fake — and then the friend and the platform vanish together. Rule: any investment relationship that began with someone contacting YOU is a scam until the heat death of the universe proves otherwise. No exceptions for how kind, patient or plausible they seemed; patience is the product.
Giveaway and impersonation scams. “Send 1 ETH, receive 2 back” — promoted by hacked celebrity accounts, fake livestreams with real conference footage pasted underneath, and comment sections full of bots thanking the scammer. No legitimate company, exchange or celebrity doubles money. Ever. Any offer structured as “send crypto to this address to receive more” is theft with a countdown timer. Related species: fake support accounts that answer your public question about an exchange within minutes, and ask for your recovery phrase or a “verification” deposit. Real support never asks for either.
Phishing and fake apps. Links in emails, texts and ads lead to pixel-perfect copies of exchange and wallet sites; entering your login or recovery phrase hands over everything. Fake wallet apps appear in real app stores; malicious browser extensions impersonate popular wallets. Defences are boring and total: type addresses yourself or use bookmarks, download only from official sites you navigated to independently, enable hardware-based or authenticator two-factor protection, and treat your recovery phrase like the master key it is — it is never typed into any website, for any reason, including reasons that sound extremely official.
Ponzi-flavoured “yield” platforms. A platform offers smooth, guaranteed high returns — 1% a day, 20% a month, “AI trading bots”, “arbitrage algorithms” — and pays early users with later users’ deposits, exactly like every Ponzi scheme since 1920. The crypto costume changes nothing: guaranteed returns in a volatile asset are mathematically impossible, and the exit is always the same — withdrawals freeze once new money slows. Apply the question from our DeFi guide: who pays the yield, and why? “Our algorithm” is not an answer. If returns are guaranteed, the guarantee is the lie.
Pump-and-dump and influencer coins. Small unknown tokens are quietly bought by insiders, loudly promoted to followers — sometimes by paid influencers who do not disclose the payment — and sold into the buying frenzy, leaving late buyers holding a coin designed to be worthless. Variations include “rug pulls”, where a token’s creators simply drain its trading pool and disappear, and rigged tokens whose code lets you buy but never sell. Defence: a coin you heard about from a promotional video is not an investment lead; it is an advertisement for someone else’s exit. If the pitch involves urgency, celebrity or secrecy, the answer is no at any price.
Approval and wallet-drainer attacks. Even seasoned users fall for these: a site prompts your wallet to “sign” or “approve” something that looks routine, and the signature actually grants access to drain your tokens. Malicious links arrive via hacked Discord servers, fake NFT mints and compromised project accounts. Defence: use a separate wallet with small amounts for experiments, read every signature request, prefer limited approvals, and revoke old approvals periodically with a reputable revocation tool. Speed is the scammer’s only real weapon; every one of these attacks fails if you pause for ten minutes.
The master checklist. One: nobody legitimate contacts you first with an opportunity. Two: guaranteed returns do not exist; the word “guaranteed” is a confession. Three: never share your recovery phrase, with anyone, ever. Four: send a small test transaction to any new address or platform. Five: verify websites character by character and ignore search ads for exchanges. Six: if you feel rushed, that feeling is the scam working — stop. Seven: keep most holdings in cold storage, where no website visit can reach them, and tell a trusted family member the general shape of your arrangements so a scam targeting them cannot borrow your name. Crypto’s honest risks — volatility, failed projects, your own mistakes — are quite enough. With this checklist, the dishonest ones mostly become stories other people tell.
