Common Crypto Scams and How to Avoid Them

Phishing: fake pop-ups, fake support, and fake login pages

Phishing is the broad name for any attempt to trick you into handing over sensitive information, and in crypto it shows up in a few specific shapes. One is the fake wallet connection pop-up: a shady site or a malicious ad shows a "connect wallet" prompt that, once approved, grants a scammer's contract permission to move your funds. Another is the fake "wallet support" agent who messages you first on X, Discord, or Telegram, usually right after you've posted about a problem, offering to "help" if you'll just verify your wallet.

A third version is the fake login page: a near-perfect copy of a real exchange or wallet interface, reached through a phishing link in an email, a search ad, or a comment under a legitimate post. All three versions end the same way, with a request for your seed phrase, private key, or login credentials. That request is the entire scam. No legitimate exchange, wallet, or support agent will ever ask for your seed phrase or private key, ever, under any circumstance. If you want the full picture of why that phrase is so absolute, see our guide to private keys and seed phrases.

Fake and cloned websites and apps

Scammers regularly clone the exact look of a real exchange, wallet, or DeFi protocol and host it at a lookalike domain, sometimes just one letter off from the real thing. The same happens with mobile apps: a fake wallet app gets listed in an app store, mimics the real branding, and either steals credentials on login or generates a seed phrase that the scammer already controls.

The defense here is mostly about habits rather than spotting fakes on sight. Always double-check the URL in your address bar before entering anything. Bookmark the real sites you use instead of searching for them or clicking links from social media, since paid search ads and shared links are common places for clones to hide. Only download apps from verified official sources, and check that the publisher matches what the project's own website links to. If you're still getting your footing on wallets in general, our crypto wallets guide is a good place to start.

Rug pulls

A rug pull happens when the developers of a new token or project hype it up, attract liquidity and buyers, and then pull the rug out from under everyone, either by draining the liquidity pool directly or by dumping their own oversized token allocation on the market. Either way, the price collapses fast and the team disappears, often within hours of the peak.

A few warning signs show up in most rug pulls before they happen: an anonymous team with no verifiable track record, a smart contract that hasn't been audited or independently verified, and liquidity that isn't locked, meaning the developers can withdraw it whenever they want. None of these guarantee a scam on their own, but stacked together they're a strong signal to stay away. Our guide to evaluating a new token or project walks through how to check for these before you buy in.

Pump-and-dump and fake influencer promotion

In a pump-and-dump, a coordinated group, or a paid influencer with a large following, hypes an obscure token to drive a fast price spike. Once new buyers rush in chasing the momentum, the original holders sell into that demand, and the price crashes just as quickly as it rose, leaving late buyers holding a bag that's worth a fraction of what they paid.

Influencer promotion is especially worth treating with skepticism, since the financial incentive behind a post isn't always disclosed. Someone hyping a token may have been paid to do it, or may already be planning to sell into the attention their post generates. Unsolicited hype for an obscure token, especially from an account you don't already trust, is a reason to slow down, not speed up.

Fake giveaways and impersonation

This one is old and still works: an account impersonating a well-known figure, exchange, or project posts (or messages you directly) claiming that any crypto sent to a given address will be sent back doubled. It keeps circulating because it keeps finding people who haven't seen it before, not because it's gotten more convincing.

The rule that makes this one easy to catch is simple: no legitimate giveaway ever requires you to send crypto first. Real promotions don't work that way, and any account asking you to send funds before receiving something back, regardless of who it claims to be, is running this scam.

Romance and "pig butchering" scams

This is a slower, more deliberate scam than the others on this list, and it deserves to be taken seriously rather than dismissed as something only a careless person would fall for. It starts with a scammer building a personal or romantic relationship with a victim over weeks or months, often through a dating app or an unexpected message that seems friendly rather than urgent.

Once trust is established, the scammer introduces a fake investment platform, frequently crypto-themed, and encourages the victim to put in increasing amounts of money, sometimes showing fabricated gains to keep them going. This category is well documented and has cost victims some of the largest individual losses in crypto, precisely because it works on trust built over time rather than a single moment of urgency.

The habits that catch nearly everything on this list

You don't need to memorize every scam variant to stay safe. A short list of habits covers most of it. Never share a seed phrase or private key with anyone, for any reason, no matter how official they sound. Verify URLs and official channels independently instead of trusting a link someone sent you, even if it looks like it came from a friend or a known account. Be suspicious of any unsolicited contact offering investment help or "support," since legitimate services almost never reach out to you first. And treat urgency or pressure, phrases like "act now" or "you'll miss out," as a red flag in itself, because creating panic is the one thing nearly every scam on this page has in common.