The crypto industry lost over $5.6 billion to scams and fraud in 2023 alone. From sophisticated phishing operations to brazen Ponzi schemes, criminals have developed an extensive toolkit for separating people from their crypto assets. The good news: the vast majority of these scams follow recognizable patterns that, once you learn to spot them, become obvious.

This guide catalogs the most prevalent crypto scams, how to identify them, and how to protect yourself.

Social Engineering Scams

Social engineering is the most effective attack vector because it targets the weakest link in any security system: human psychology.

Impersonation Scams

A "support representative" from your favorite exchange DMs you on Discord or Telegram. They know you had a recent issue. They offer to help — all you need to do is connect your wallet to their "support portal" or share your screen.

How to spot it: Legitimate teams never initiate contact via DM. They never ask you to connect your wallet to unfamiliar sites. They never request screen sharing that reveals your wallet interface.

Rule: If someone messages you first about your crypto, it is a scam. No exceptions.

Fake Customer Support

You post a question on Twitter or Reddit about a DeFi protocol. Within minutes, you receive replies from accounts that look official, directing you to a "help desk" URL. The URL looks legitimate but is slightly different from the real domain.

How to spot it: Check the exact URL character by character. Look at the account's creation date and post history. Official support channels are listed on the protocol's verified website — nowhere else.

Romance and Trust Scams

Also known as "pig butchering," these scams involve building a personal relationship over weeks or months before introducing a "great investment opportunity." The scammer may pose as a romantic interest, a business contact, or a new friend. The investment platform they recommend is fake, designed to show artificial profits until you deposit a large amount.

How to spot it: Any online relationship that steers toward crypto investment is suspicious. If they send you to a platform you have never heard of, it is a scam. If they claim guaranteed returns, it is a scam.

Phishing Attacks

Fake Websites

Scammers create pixel-perfect replicas of popular DeFi applications. The only difference is the URL, which might substitute a character (uniswap vs unisw4p), use a different domain extension (.xyz instead of .org), or add a subdomain (app-uniswap.com).

When you connect your wallet and approve a transaction, you are actually approving a token drain that transfers your assets to the scammer.

Protection: Always access DeFi applications through bookmarks you have set from verified sources. Never click links from emails, social media, or search engine advertisements.

Malicious Token Approvals

Some phishing sites do not steal your assets immediately. Instead, they request an unlimited token approval for a malicious contract. This approval sits dormant until the scammer decides to execute the drain, which might be days or weeks later.

Protection: Review every approval request carefully. If a site asks for unlimited approval when you are doing a small transaction, reject it. Regularly audit and revoke unused approvals.

Clipboard Hijacking

Malware on your device monitors your clipboard for crypto addresses. When you copy an address, the malware replaces it with the attacker's address. You paste what you think is the correct address and send your funds to the scammer.

Protection: Always verify the first and last several characters of a pasted address against the original. Use QR codes when possible. Keep your device and antivirus software updated.

Investment Scams

Ponzi and Pyramid Schemes

Crypto Ponzi schemes promise unsustainably high returns — 1% daily, 50% monthly, "guaranteed." Early investors are paid with funds from later investors, creating the illusion of legitimacy. The scheme collapses when new deposits cannot cover withdrawal requests.

Red flags:

Returns that are "guaranteed" or "risk-free"
Yields that far exceed market rates (DeFi yields of 1000%+ APY are almost always unsustainable)
Referral bonuses that incentivize bringing in new money
Opaque investment strategy ("our proprietary algorithm")
Withdrawal restrictions or delays

Fake Token Sales

A new project announces a token sale with a compelling narrative, slick marketing, and fabricated partnerships. Investors send funds to participate. The tokens either never arrive, are worthless, or cannot be sold due to contract restrictions.

Red flags:

No verifiable team members
Partnerships announced but never confirmed by the supposed partner
Code that has not been audited or open-sourced
Unrealistic tokenomics or supply projections
Pressure to invest before a deadline

Pump and Dump Groups

Telegram and Discord groups that coordinate buying a low-liquidity token to inflate its price, then sell (dump) on followers who bought in late. The group leaders buy before the announcement and sell into the "pump" they created.

How to spot it: Any group that tells you when to buy a specific token is running a pump and dump. The leaders profit; the followers are the exit liquidity.

Technical Scams

Fake Airdrops

You receive tokens in your wallet that you did not request. The token name often includes a URL ("Visit-claim-site.com"). When you try to sell or interact with these tokens, the contract either steals your approved tokens or prompts a malicious transaction.

Protection: Never interact with tokens you did not deliberately acquire. Do not try to sell them, transfer them, or visit any URL in their name. Ignore them completely.

Dust Attacks

Small amounts of crypto are sent to your wallet from unknown addresses. The goal is to identify you by tracking where you send these funds, potentially linking your pseudonymous address to your real identity or other wallets.

Protection: Do not send dust-attack tokens anywhere. If your wallet consolidates them automatically, be aware that your transaction graph may be compromised.

Honeypot Tokens

A token contract is designed so that anyone can buy but only the creator can sell. Buyers see the price going up and their paper profits growing, but when they try to sell, the transaction fails. The creator eventually drains the liquidity pool, taking all buy-side funds.

Protection: Before buying any token, check if sell transactions exist on the blockchain explorer. If you see only buys and no sells (or only sells from one address), it is a honeypot.

Protecting Yourself: A Framework

The Five-Minute Rule

Before making any crypto transaction — a swap, an approval, a deposit, a token purchase — spend five minutes verifying:

Source: Where did you learn about this? Is the source trustworthy?
Contract: Is the contract address from the official website, verified through multiple sources?
Approval: What exactly are you approving? Is the amount reasonable?
Team: Can you verify who is behind this project?
Economics: Do the promised returns make mathematical sense?

If any of these checks fail, do not proceed.

The "Too Good to Be True" Test

If someone promises guaranteed returns, risk-free profits, or extraordinary yields, they are either lying or will be soon. In crypto:

Sustainable DeFi yields are typically 3-15% APY
Higher yields come with proportionally higher risks
No return is guaranteed
Anyone claiming otherwise is selling you a fantasy

The Non-Custodial Principle

The safest position is one where no one else controls your funds. Every layer of intermediation — every exchange, every yield farm, every custodial service — is a potential point of failure through hacks, fraud, or mismanagement.

This is why non-custodial platforms represent a meaningful security improvement. When your funds remain in your own on-chain subaccount — as they do with Otomate — you eliminate the single largest attack vector: trusting someone else with your money. You can verify your balance on-chain at any time. No one can move your funds without your authorization.

The Verification Habit

Make verification habitual, not occasional:

Bookmark every legitimate site you use
Verify contract addresses through multiple sources before interacting
Check token approvals monthly and revoke unused ones
Research any new protocol for at least one hour before depositing
Never act on urgency — scammers create urgency because careful analysis defeats their schemes

If You Have Been Scammed

The reality is harsh: most stolen crypto cannot be recovered. Blockchain transactions are irreversible by design. However, immediate steps can limit further damage:

Revoke all token approvals on the compromised wallet immediately
Move remaining assets to a new, clean wallet
Document everything: transaction hashes, URLs, screenshots, messages
Report to law enforcement: FBI IC3 for US victims, Action Fraud for UK, local equivalents elsewhere
Report to the platform: Exchanges can sometimes freeze stolen funds if notified quickly
Warn others: Post in community channels (with evidence) to prevent additional victims

Do not engage with "recovery services" that promise to retrieve your stolen crypto. These are secondary scams that target victims.

Vigilance Is the Price of Sovereignty

Crypto offers financial sovereignty — the ability to hold, transfer, and invest your assets without permission from intermediaries. That sovereignty comes with responsibility. There is no fraud department to call, no chargeback to file, no bank to reverse the transaction.

The same technology that makes crypto powerful makes it unforgiving. Every transaction you sign is final. Every approval you grant is a potential vulnerability. Every DM you respond to could be a scam.

Stay skeptical. Verify everything. Trust code, not promises.

Don't trade. Automate.