Common Crypto Scams and How to Avoid Them

The short answer

Almost every crypto scam is one of two tricks in a costume. Trick one: get you to reveal your seed phrase. Trick two: get you to send coins somewhere they can't come back from. This guide covers seven common scam families, the tell that exposes each one, and the small set of habits that defeats all of them.

What is seed-phrase phishing?

This is the most direct theft in crypto. Scammers build convincing copies of wallet websites, browser extensions, or "wallet validation" pages. They get you there through search ads, fake security emails, or links in replies. The page asks you to "restore," "sync," or "verify" your wallet by typing in your 12 or 24 recovery words.

The moment you type them, the attacker has your wallet. Not access to your wallet, your wallet. Seed phrases are the master key, and anyone holding the words holds the funds.

• How it works: a fake site or form collects your recovery words under a security pretext.
• The tell: any website, form, email, or chat asking you to enter your seed phrase. There is no legitimate version of this request.
• The defense: your seed phrase gets typed into your own wallet app, and only when you restore it on a device you control.

How do fake support scams work?

Post a question about a stuck transaction in a public forum or reply thread, and helpful "support staff" often appear in your DMs within minutes. They use the company's logo, a plausible name, and a calm, professional tone. Then they route you to a phishing form, a screen-share session, or a "resolution portal" that asks for your recovery words.

The speed is the giveaway. Real support teams work through tickets on their official site. They don't patrol social media initiating private chats.

• How it works: scammers monitor public complaints, then impersonate support and reach out first.
• The tell: support that contacts you first, or moves the chat to DMs, Telegram, or WhatsApp.
• The defense: start support conversations yourself, through the help page on the site you bookmarked. Treat every inbound DM about your crypto as hostile.

In our experience, the DM that lands two minutes after you post is the one beginners trust most; it feels like fast service.

What are giveaway and doubling scams?

The pitch is as old as money: send us one coin and we'll send two back. It's usually framed as a celebrity giveaway, an exchange anniversary, or a livestream promotion. Hacked verified accounts and deepfaked video streams make these look shockingly official.

Nobody doubles money for strangers. The scam only needs a tiny hit rate to profit, because every send is irreversible.

• How it works: a hijacked account or fake stream promises to multiply whatever you send to an address.
• The tell: any scheme where you must send crypto first to receive crypto back. That structure is the entire scam.
• The defense: never send coins to qualify for a giveaway, an airdrop, or a prize. Real airdrops don't require deposits.

What are pig-butchering and romance-investment scams?

These are long cons, and they do the most financial damage of anything on this list. In 2023, the FBI's Internet Crime Complaint Center logged more than 69,000 crypto-fraud complaints and counted over $5.6 billion in reported losses, a 45% jump from 2022. Investment scams like these drove roughly $3.9 billion of it, almost 71% of all crypto-fraud losses that year. Victims over 60 alone reported more than $1.6 billion. The setup is patient. A stranger builds a relationship over weeks or months, through a dating app, a "wrong number" text, or a friendly social account. Only later does the talk drift to a private trading platform where they claim steady profits, and they offer to show you how.

The platform is fake. Your dashboard shows impressive gains. Small early withdrawals even work, and then you're pushed to go bigger. When you finally try to cash out, the site demands "taxes" or "release fees." Every payment unlocks a new fee instead of your money.

• How it works: months of trust-building funnel you into a fake investment platform. You can deposit, but you can never withdraw.
• The tell: "guaranteed returns" language, screenshots of smooth 2% daily gains, and pressure to act fast. Real prices swing hard in both directions; that's what crypto volatility means. Guaranteed profit from a volatile asset cannot exist.
• The defense: never invest through a platform introduced by someone you've only met online, no matter how long you've talked. If you're already in, stop sending money the first time a withdrawal requires a fee. Talk to someone you trust offline before doing anything else.

How do fake exchanges and fake casinos work?

Some scams skip the persuasion and just build a fake business. Cloned exchanges and gambling sites copy a real brand's design, invent a license number, and sometimes run for months. Deposits process instantly. Withdrawals hit endless "verification" delays, or the site simply vanishes with everyone's balance.

Gambling sites are a favorite disguise because players expect to deposit before playing. The checks that expose them also verify real operators; we walk through them in how to tell if a crypto casino is legit.

• How it works: a professional-looking site takes deposits and manufactures reasons never to pay out.
• The tell: a license you can't verify with the issuing regulator, bonus offers far beyond what established sites run, and domains one character off a real brand.
• The defense: verify the license against the regulator's own registry and read the URL character by character. Deposit a small test amount, then withdraw it before committing more.

What are rug pulls and pump-and-dumps?

Not every scam steals your wallet. Some sell you a token designed to die. In a rug pull, developers launch a coin and hype it hard. Then they drain the trading liquidity so holders can't sell. In a pump-and-dump, insiders quietly stack a cheap token and coordinate hype in Telegram and X groups. When buyers chase the spike, the insiders dump on them.

Both depend on you buying something you can't evaluate. A stranger sounded confident, and the chart only went up.

• How it works: hype inflates a worthless token until insiders exit, leaving buyers holding it.
• The tell: an anonymous team, a handful of wallets holding most of the supply, and urgency framing about getting in "before it moons."
• The defense: treat any coin you first heard about from a stranger, an influencer, or a group chat as a sales pitch, not a tip. If you can't explain what the token does, you're the exit liquidity.

What are address poisoning and clipboard-swap malware?

This family attacks the sending step itself. Clipboard malware watches for a copied wallet address and silently swaps it for the attacker's. Address poisoning is subtler. The scammer sends a tiny transaction to your wallet from an address built to match the first and last characters of one you actually use. The hope is that you'll copy the lookalike from your history later.

Both work because long addresses train us to check only the ends.

• How it works: the address you paste isn't the address you copied, or you copy a lookalike planted in your history.
• The tell: often nothing visible, which is what makes it dangerous. Matching first and last characters are not proof.
• The defense: compare a long chunk of the address after pasting. Never copy addresses from your transaction history. Send a small test transaction before any large transfer.

The seven families at a glance

What actually keeps you safe?

You don't need to memorize every variant, because the defenses overlap. Crypto payments are irreversible by design, a trade-off covered in our cryptocurrency basics guide. Prevention is the whole game. Four habits cover nearly everything above:

• Guard the seed phrase absolutely. No legitimate service asks for it, so the request itself identifies the scammer.
• Slow down when anyone speeds you up. Urgency, deadlines, and limited windows are pressure tools. Pressure is a tell, not a bonus.
• Verify URLs yourself. Bookmark the sites you use and type addresses directly. Never trust links from ads, DMs, or replies.
• Test before you trust. Small first transactions, small first deposits, small first withdrawals. Scale up only after the round trip works.

One more step if a scam does land: report it. The FTC's guide to cryptocurrency scams explains what to include, and US victims can also file with the FBI's Internet Crime Complaint Center. In 2023, crypto featured in about one in ten IC3 fraud complaints, yet drove almost half of all reported fraud losses. Reporting won't reverse a transaction, but it helps investigators connect cases and warn the next target.

Scammers keep changing costumes, not tricks. In our experience, the people who get burned rarely miss the red flag; they see it and talk themselves past it. Know the two tricks, keep the four habits, and you're a much harder target than the next person.

Sources

• FBI IC3 — 2023 Cryptocurrency Fraud Report (PDF) — retrieved July 2026.
• FTC — What to Know About Cryptocurrency and Scams — retrieved July 2026.
• FBI — Internet Crime Complaint Center (IC3) — retrieved July 2026.