Common Crypto Scams and How to Spot Them

A message lands in your inbox: “Your wallet has a security problem. Click here to verify.” It looks official, it sounds urgent, and for a moment your stomach drops. That moment of doubt is exactly what a scammer is counting on.

Entering Web3 feels a bit like walking into an unfamiliar woodland. Most of it is healthy and worth tending. But a few things will hurt you if you don’t learn to recognise them. The good news: scams follow predictable patterns, the same way certain invasive plants always show up at the edge of a disturbed field. Once you know the patterns, you can move through this space with confidence and help protect the people around you.

The stakes are real. Globally, crypto scam losses ran into the billions in 2024 and reached a projected $17 billion in 2025, the highest year on record. In the United States alone, victims reported $9.3 billion in crypto-related losses to the FBI in 2024, a 66% jump from the year before. You don’t need to memorise those numbers. You just need to learn the handful of tricks behind them.

The scammer’s playbook

Crypto scammers rely on three old levers: urgency (act now or lose out), authority (I’m support, I’m a developer, I’m the government), and trust (we have a relationship, you can rely on me). The technology is new. The manipulation is ancient.

Picture this in your own community. If a stranger knocked on your door demanding immediate access to your savings, you’d be suspicious. Carry that same instinct online, where a polished website or a confident voice on a video call can hide an empty promise. A growing share of scams now lean on AI to write convincing messages and even fake faces and voices, so a professional appearance is no longer evidence of anything.

Phishing: fake signposts

Phishing is when someone impersonates a service you trust to steal your login details or your secret keys. Think of fake road signs redirecting traffic to the wrong place.

What it looks like:

An email claiming your exchange account has an “urgent security issue”
A website that copies Coinbase or MetaMask almost perfectly but lives at a slightly misspelled address (this is called typosquatting)
A direct message offering friendly “help” with a wallet problem
A browser extension that quietly reads your wallet details

Your shield: reach crypto services through your own bookmarks or by typing the address yourself, never through a link in a message. And remember the golden rule. No legitimate service will ever ask for your seed phrase (the list of words that restores your wallet) or your private keys. Anyone who asks is a thief.

Investment scams: promises that are too good

These echo the old “miracle fertiliser, triple your harvest” pitch. In crypto they show up as guaranteed returns with no risk.

Investment fraud was the single largest category of US crypto losses in 2024, at $5.8 billion. Scammers build slick websites, invent team bios and testimonials, and sometimes run for months to look credible before vanishing with the money.

Red flags:

Guaranteed returns and the words “zero risk”
Pressure to act fast (“this closes in 24 hours”)
A team you can’t verify anywhere else
Active fundraising but no working product

Your protection: research the team across several independent sources. Start small. And hold onto one truth: every real investment carries risk, so anyone guaranteeing crypto profits is lying.

Romance and “pig butchering” scams

The most devastating scams build a genuine-feeling relationship first, then introduce money. The grim industry nickname, pig butchering, refers to “fattening up” a victim with affection and small wins before the final cut.

Romance and pig-butchering scams remain among the most damaging types by money lost, according to Chainalysis. The pattern is consistent: first contact through a dating app or a “wrong number” text, weeks of warm conversation, a casual mention of a crypto opportunity, a fake trading app showing fake profits, pressure to put in more, then silence.

How to protect yourself:

Be wary when a new online connection steers toward investing
Ask for a live video call early; refusal is a signal
Trust your gut the moment money enters a romance
Real relationships don’t come with financial deadlines

💡 Going Deeper: Scammers increasingly use AI to spin up believable profiles and keep conversations going around the clock. Chainalysis found AI-assisted operations earn several times more than traditional ones, and impersonation scams (fraudsters posing as a company, a bank, or the government) grew more than 1,400% year-over-year in 2025. Reverse image searches and live video calls still help, but treat any unsolicited investment pitch as suspect no matter how real the person seems.

Rug pulls: builders who walk away

A rug pull happens when a project’s creators take everyone’s money and abandon the work, like a tenant farmer stripping the land and disappearing before harvest.

The clearest example is the SQUID token of 2021, named after the Netflix series. It rocketed from cents to over $2,800, then the developers drained the funds, the price crashed to near zero, and more than 40,000 buyers were left holding tokens they couldn’t sell, because the code had quietly blocked selling all along.

Warning signs:

A team with no verifiable identity or track record
No independent security audit of the code
Heavy hype and marketing, thin actual development
Token rules that make it hard or impossible to sell

Your due diligence: look into the team, check for a recent independent audit, and understand how the token works before you put money in. Anonymous teams aren’t automatically scams, but they earn trust through open code and audits, not vibes.

Building your security ecosystem

Healthy systems are resilient because they have many overlapping defences, not one fragile wall. Your safety online works the same way.

A few habits, low effort, high protection:

Use a hardware wallet for anything you can’t afford to lose. It’s a small physical device that keeps your keys offline, like a seed bank for your most valuable holdings.
Turn on two-factor authentication on every crypto account, so a stolen password alone isn’t enough to get in.
Check the address bar before typing anything sensitive. Scam sites hide tiny misspellings.
Slow down. Legitimate opportunities survive a pause; pressure is the tell.

And lean on each other. Sharing a scam alert in your group chat is the digital version of warning neighbours about a contaminated well. Before a significant decision, ask someone you trust to look with you.

🔧 For Practitioners: For shared community or organisational funds, use a multi-signature wallet, which requires several people to approve any transaction so no single compromised person can drain the treasury. Pair it with simple written rules for vetting new platforms and verifying any unusual payment request.

When prevention fails

Even careful people get caught, because the system is genuinely confusing and scammers design it that way. If it happens to you, it is not your fault.

What to do:

Stop all contact with the suspected scammer.
Document everything: screenshots, transaction records, messages.
Report it. In the US, file with the FBI’s Internet Crime Complaint Center at ic3.gov, and notify your local authorities.
Alert the platform where it happened to protect the next person.
Tell your community so they recognise the pattern.

Recovery is rare because crypto transactions can’t be reversed. But reporting still matters: it helps investigators track networks and warn others.

Moving forward with confidence

Learning about scams isn’t about becoming fearful. An experienced gardener spots blight at a glance and keeps planting. You’re building the same instinct: pattern recognition that protects you without holding you back.

The regenerative projects you care about need people like you taking part safely. Protect yourself, share what you learn, and you strengthen the whole ecosystem.

Try This

Start here: Bookmark the real websites of any crypto service you use, and from now on only reach them through those bookmarks. Never through a link in a message.

Go deeper: Pick a crypto project you’ve seen mentioned and run a five-minute background check: find the team’s real names, look for an independent security audit, and search “[project name] scam” to see what others say.

Stretch: Write a one-page scam-awareness checklist for your community or organisation, covering how to verify a platform, who approves shared funds, and what to do if someone gets caught. Share it in your group.

References

FBI 2024 Internet Crime Report (IC3): official US figures on crypto fraud, including the $9.3 billion in 2024 losses and the investment-scam breakdown.
Chainalysis 2026 Crypto Crime Report: Scams: research on the projected $17 billion in 2025 losses and the rise of AI-assisted and impersonation scams.
FBI IC3 complaint center: where to report crypto fraud and other internet crime in the US.
Washington Post: Squid Game crypto rug pull: coverage of the SQUID token collapse and how the sell-blocking trick worked.
FTC: What to Know About Cryptocurrency and Scams: plain-language consumer guidance on investment, impersonation, and payment scams, and the red flags to watch for.