How to Spot Crypto Scams: Phishing Sites, Fake Airdrops and Malicious Approvals

"Congratulations, you're eligible for an airdrop!" "Your wallet has been compromised. Verify it now." "I've made 40% this month with this trading platform. Want me to show you?"

If any of these sound familiar, you've already met a crypto scammer. And the stakes are real: the FBI's Internet Crime Complaint Center (IC3) reported roughly $9.3 billion in cryptocurrency-related fraud losses in 2024 alone. Because blockchain transactions are usually final, there's no bank to call and no chargeback. Prevention beats recovery every time.

Key takeaways

• Most losses come from people being tricked, not from blockchains being hacked.
• Anyone who asks for your seed phrase or private key is a scammer. No exceptions.
• If you don't understand what you're signing, don't sign it.
• Guaranteed high returns are a red flag, every single time.
• If you've been scammed, beware of "recovery experts." They're usually scam number two.

Scam cheat sheet

Let's go through each one.

1. Phishing sites and fake apps

Scammers clone the websites of popular exchanges, wallets and projects, then push them through search ads, social media, DMs and even text messages.

• Get the address from an official source, bookmark it, and only use the bookmark from then on.
• Read domains carefully: one extra letter, an "l" swapped for a "1," or a different ending is enough.
• Only download wallets and exchange apps from official app stores or official websites.
• The top search result is often a paid ad, and scammers buy ads too.

2. Fake support and "helpful" DMs

Post a question like "my withdrawal is stuck" in a Discord or Telegram group, and within minutes someone claiming to be "official support" will DM you. They'll ask for your seed phrase, have you scan a QR code to "verify your wallet" or send you to a "repair" site.

Real support teams don't DM you first, and they never ask for your seed phrase or private key. Ignore these messages and contact support only through the official website or app.

3. Fake airdrops and "free" tokens

A token you've never heard of suddenly shows up in your wallet, often with a website in its name. Or you get a link to "claim your airdrop." Either way, the goal is to lure you to a phishing site and get you to sign something.

There's no free lunch: don't interact with unknown tokens, and don't try to sell them. Just ignore them.

4. Malicious approvals and signature traps

Using DeFi on Ethereum and similar chains means regularly "approving" contracts to spend your tokens. That's normal, but scammers trick people into signing:

• Unlimited approvals: permission for someone to move a token from your wallet at any time, indefinitely.
• Off-chain signatures (such as Permit): they look like a harmless, gasless signature but can grant the same transfer rights.

What makes this so dangerous: nothing happens when you sign. Your funds disappear days later, and many victims can't even remember which signature did it.

How to protect yourself:

• Read the wallet pop-up before signing. If you don't understand it, don't sign.
• Approve only the amount you need, not an unlimited allowance.
• Regularly review and revoke old approvals with a tool like Revoke.cash or your block explorer's token approval page.
• Keep a separate "burner" wallet with a small balance for trying new apps. Keep your savings elsewhere.

5. Address poisoning

Scammers send you a $0 or tiny transaction from an address whose first and last characters match an address you use often. If you copy addresses from your transaction history, you might send funds straight to them.

Copy addresses from your address book and check every character.

6. Pig butchering and investment scams

This is one of the costliest scams out there. The name comes from "fattening the pig before the slaughter," and it plays out like this:

1. First contact: a "wrong number" text, a dating app match or a friendly stranger on social media.
2. Building trust: weeks of daily chats with no mention of money, until they casually mention how well they're doing trading crypto.
3. The hook: they guide you to a slick trading platform. Your first small deposits show big gains, and a test withdrawal even works.
4. The slaughter: after you deposit serious money, withdrawals require "taxes," "fees" or a "security deposit." Pay one and another appears, until the platform and your new friend vanish.

Red flags: an online acquaintance pushing an investment, guaranteed returns, a platform you can only access through their link, and fees required before you can withdraw. Any one of these is a reason to stop.

7. Giveaway scams and deepfakes

"Send 1 ETH to this address and get 2 ETH back!" These scams appear on hijacked social accounts and fake livestreams, increasingly with AI-generated deepfake videos of well-known founders. No legitimate person or company will ever double your crypto. If it sounds too good to be true, it is.

If you've already been scammed

1. Stop the bleeding: move any remaining funds to a brand-new wallet with a new seed phrase. Don't import the old one.
2. Revoke approvals: cancel any suspicious token approvals.
3. Save evidence: keep transaction hashes, wallet addresses, chat logs and screenshots.
4. Report it: in the US, file a report with the FBI at ic3.gov and with the FTC at ReportFraud.ftc.gov. Elsewhere, contact your local police. Also report the scammer's account to the exchange involved, if any.
5. Watch out for recovery scams: anyone promising to "hack back" your funds for an upfront fee is almost certainly running another scam.

FAQ

Can I get drained just by connecting my wallet?

Connecting usually only reveals your address and balance. The real danger is what you approve or sign afterward. Still, if you've connected to a sketchy site, review your approvals to be safe.

Can I sell the random tokens that showed up in my wallet?

Don't. They're usually bait, and trying to sell them may lead you to a phishing site or a malicious approval. Ignore them; most wallets let you hide them.

Can stolen crypto be recovered?

It's hard, but report it anyway. In some cases, law enforcement has worked with exchanges to freeze stolen funds. Fast reporting and thorough evidence improve the odds. Never pay an individual who promises to get your money back.

How do I tell if a trading platform is fake?

Fake platforms are usually only reachable through a link someone sent you, aren't in official app stores and have little independent discussion online. Legitimate platforms don't ask you to deposit into personal accounts and don't demand fees before you can withdraw.

Summary

Nearly every scam plays on three emotions: greed (huge returns, free tokens), fear (your account is compromised) and urgency (act now or lose out). The moment you feel you have to act right now, slow down.

Verify the source, read before you sign and walk away from anything that promises easy money. Share this guide with a friend who's new to crypto; it might save them a lot. To lock down your setup further, read our crypto wallet guide. This article is for education only and isn't investment advice.