Types of crypto scams: 12 common ones and how to spot them
Updated October 31, 2026
A crypto scam is any scheme that tricks you into sending crypto, signing a transaction or sharing a secret, so that someone else ends up with your money. Some scams live in the token itself, some target your wallet, and some work on trust built over weeks. This guide explains the twelve types you are most likely to meet, the signs they have in common and what to do if it has already happened.
On this page
- Quick answer: the three signs every scam shares
- Token scams: when the coin itself is the trap
- Wallet scams: attacks on your keys and signatures
- Social and investment scams: trust as the weapon
- After the scam: recovery-room scams
- Warning signs common to every scam
- What to do if you have been scammed
- Crypto scams in numbers
Token scams: when the coin itself is the trap
Token scams are built into the token you buy. The website and the community can look normal, but the contract, the supply or the liquidity is set up so that the creators win and buyers lose. The good news is that most of these traps leave traces on-chain that you can check before you buy.
Rug pull
In a rug pull, the creators remove the liquidity from the pool or sell their large share of the supply all at once. The price collapses in minutes and holders are left with a token that nobody can buy from them at any meaningful price.
The usual warning signs are a mint authority that is still active, liquidity that is not burned or locked, and a few wallets holding most of the supply. Rug pulls are the most common risk among new memecoins.
Honeypot
A honeypot is a token you can buy but cannot sell, or can only sell with a huge tax. The chart only goes up because nobody is able to sell. On Solana, the trap is usually an active freeze authority or a Token-2022 extension; on EVM chains, it is hidden in the contract code.
Watch the pool history: many buys and almost no sells is not a sign of strong holders, it is a sign that selling does not work. A small test sale helps, but some traps only block larger or later sales.
Pump and dump
A group buys a cheap token quietly, then promotes it hard in chats, posts and paid mentions with “limited time” messages. When new buyers push the price up, the group sells into them. The price falls back, often below where it started.
The pattern to watch is sudden promotion from many accounts at once, combined with holders who bought very early and hold a large share. Promotion without any product is a warning on its own.
Fake and clone tokens
Anyone can create a token with the same name, ticker and logo as a famous project. Scammers launch these copies when a real token is in the news, or when a project announces a token that does not exist yet.
Names and logos can be copied; the contract address cannot. Take the address only from the project’s official website or verified account, and compare it character by character with the one you are about to trade.
How to spot a rug pull →Honeypot tokens explained →Scan a token →
Wallet scams: attacks on your keys and signatures
Wallet scams do not care which token you hold. They aim at the wallet itself: your seed phrase, your signature or your habits when you copy an address. Crypto transfers are usually irreversible, so one mistake here can empty a wallet in a single transaction.
Phishing and drainer sites
Phishing uses fake messages, pop-ups, ads and websites that imitate a wallet, an exchange or a popular app. Some ask you to type your seed phrase. Others are drainers: the page asks you to connect your wallet and sign a transaction that looks harmless but transfers your tokens to the attacker.
Reach apps through your own bookmarks, never through links in messages or sponsored search results. No real service ever needs your seed phrase.
Malicious approvals
When you trade on a decentralised app, you often give a contract permission to move a token for you. On EVM chains this is an approval, on Solana a delegate. A malicious site asks for an unlimited permission and uses it later, sometimes weeks after you signed.
Permissions do not expire on their own. Check them from time to time in your wallet or a block explorer, and revoke the ones you do not use.
Address poisoning
The attacker sends you a tiny transfer from an address that starts and ends like one you use often. It sits in your transaction history, waiting. The next time you copy an address from that history, you copy theirs and send your funds to the scammer.
Copy addresses from your own address book or the original source, never from your history. Check more than the first and last few characters, and send a small test amount before a large transfer.
Fake support and impersonation
After you post about a wallet problem, “support agents” reply or write to you in private. They may pose as an exchange, a wallet team, a moderator or even a friend whose account was hacked. Sooner or later they ask for your seed phrase, a password or a signature to “verify” the wallet.
Real support never contacts you first in private and never asks for your keys. If in doubt, open a ticket only through the official website.
Wallet safety basics →Phishing in the glossary →Drainer in the glossary →
After the scam: recovery-room scams
Being scammed once does not protect you from being scammed again. Victims are often contacted by “recovery experts”, fake lawyers, hackers or people posing as police or a regulator, who say they can trace and return the stolen crypto.
They always ask for something first: a fee, a deposit to “unlock” the funds, remote access to your computer or your seed phrase. Some even show fake documents or a fake blockchain trace. The FBI received more than ten thousand reports of recovery scams in 2025 alone.
Real authorities do not charge you to investigate, and nobody can reverse a blockchain transaction for a fee. Treat any offer to recover your crypto for money as the next scam.
Warning signs common to every scam
The European supervisory authorities (EBA, ESMA and EIOPA) published a consumer factsheet on crypto fraud in December 2025. Its list of warning signs works for every type in this guide, from a new memecoin to a romance contact.
- An offer you did not ask for, from someone you do not know.
- Returns that are guaranteed, high and fast.
- Pressure to decide or pay immediately.
- Payment requested only in crypto, gift cards, prepaid cards or wire transfers.
- Links, QR codes or apps you are asked to open or install.
- Any request for your private keys or seed phrase.
- A web address that is slightly wrong, or a copied logo and site with no verifiable contact details or registration.
- An exchange or platform you have never heard of.
- Attachments that run code, such as .exe, .scr, .zip or macro-enabled office files.
ESAs factsheet: crypto fraud and scams (2025) ↗The checklist for a new token →
What to do if you have been scammed
Act quickly and in this order. The goal is to stop further losses first, then leave a clear record for the people who can investigate.
- Stop all payments and contact. Do not send any “tax”, “fee” or deposit to withdraw your balance, and block the scammer.
- If you shared your seed phrase or signed something suspicious, create a new wallet on a clean device and move what is left there.
- Revoke permissions: remove token approvals on EVM chains and delegates on Solana, from your wallet or a block explorer.
- Change passwords and turn on two-factor authentication on exchanges, email and any account linked to the wallet.
- Document everything: transaction hashes, wallet addresses, website addresses, screenshots of chats, dates and amounts.
- Contact the exchange or wallet provider through its official channels. If the funds reached a regulated exchange, it may be able to freeze them, but reversal is usually not possible.
- Report to the police and to your country’s financial regulator. In the United States, file a report with the FBI’s IC3; in the EU, go to your national police and the national financial supervisor.
- Warn friends and family, and ignore anyone who offers to recover your money for a fee.
Report to the FBI IC3 ↗How to revoke approvals and delegates →
Crypto scams in numbers
Official figures only include the cases people report, so the real totals are higher. In the FBI’s 2025 Internet Crime Report, cryptocurrency was involved in more than half of all reported losses, which reached $20.9 billion in total.
Chainalysis, which estimates scam revenue from blockchain data, found that scams received at least $14 billion on-chain in 2025 and projects a final figure above $17 billion. The same report notes that the average scam payment grew from $782 to $2,764 in one year.
| Figure | Value | Source |
|---|---|---|
| Crypto-related losses reported to the FBI | $11.37 billion, 181,565 complaints | FBI IC3, 2025 |
| Crypto investment fraud losses | $7.23 billion, 61,559 complaints | FBI IC3, 2025 |
| Crypto losses reported by people over 60 | $4.35 billion | FBI IC3, 2025 |
| Recovery scam losses | $1.4 billion, 10,516 complaints | FBI IC3, 2025 |
| Crypto ATM and kiosk losses | $389 million, 13,460 complaints | FBI IC3, 2025 |
| Scam revenue received on-chain | At least $14 billion, projected above $17 billion | Chainalysis, 2025 data |
| Growth of impersonation scams | 1,400% year on year | Chainalysis, 2025 data |
| Personal wallet compromises | 20% of all value stolen, at least 80,000 victims | Chainalysis, 2025 data |
FBI IC3 Internet Crime Report 2025 (PDF) ↗Chainalysis 2026 Crypto Crime Report: scams ↗Chainalysis: crypto theft in 2025 ↗
Questions
- What is the most common crypto scam?
- By money lost, investment fraud: fake platforms, pig butchering and guaranteed-return schemes cost victims $7.2 billion in the FBI’s 2025 figures. By sheer number, phishing, impersonation and fake tokens are the ones you will meet most often.
- Can I get my crypto back after a scam?
- Usually not. Blockchain transfers cannot be reversed, but an exchange can sometimes freeze funds that reach it if you report quickly. Report to the police and your provider, and be wary of anyone who promises recovery for a fee: that is often the next scam.
- How do I report a crypto scam?
- Report it to the police and to your national financial regulator, with transaction hashes, addresses and screenshots. In the United States, use the FBI’s IC3 website. Also report it to the exchange, wallet or platform involved.
- Are airdrops scams?
- Not all of them, but fake airdrops are a common trap. Tokens you did not expect, or sites that ask you to connect your wallet, sign a transaction or pay a fee to claim, are typical signs. A real airdrop never needs your seed phrase or a payment.
- How do I check a token before buying?
- Take the contract address from an official source and run it through a scanner. Check whether mint and freeze authority are revoked, how concentrated the holders are, whether liquidity is locked, and whether selling works.
- Is a scam token illegal?
- Creating a token is not illegal in itself. Using it to deceive buyers, for example with a rug pull or a fake project, can be fraud, and offering investment or crypto services without authorisation is prohibited in many countries. The details depend on where you live.
Every scam in this guide needs a payment, a signature or a secret from you. Slow down whenever you are asked for one of them. For token scams, the facts are on-chain: scan the contract address before you buy and check mint and freeze authority, holders, liquidity and the sell route.
Scan a token
Social and investment scams: trust as the weapon
These scams need no smart contract at all. They work on people: trust, hope, loneliness or the fear of missing out. They are also the most expensive ones in official statistics, because victims often send money many times before they realise.
Fake giveaways and fake airdrops
A post or a livestream, often using a famous name or brand without permission, promises to double any crypto you send. Nothing ever comes back. The modern version is the fake airdrop: free tokens appear in your wallet, or a site says you are eligible for a reward, and claiming it means connecting to a drainer or paying a “fee” first.
Romance and “pig butchering”
Someone you met online, on a dating app, social network or a wrong-number message, builds a friendly or romantic relationship over weeks. Then they show you how much they earn on a crypto platform and help you open an account.
The platform is fake. Your balance grows on screen, small withdrawals may even work at first, and you are encouraged to deposit more. When you try to take out a large amount, you are asked for taxes or fees, and then the contact disappears.
Ponzi and guaranteed-return schemes
The scheme promises a fixed, high return, often daily or weekly, and pays early members with the money of new ones. Many add referral bonuses, so victims recruit friends and family. When new deposits slow down, withdrawals stop and the scheme collapses.
No real investment guarantees a high return. A guaranteed yield with no clear source of income is the defining sign.