How to Spot a Crypto Scam: The Six Patterns Behind Almost All of Them

In This Article

1. Introduction
2. Why crypto is unusually good ground for scams
3. The six patterns
4. The checks that actually take two minutes
5. The two rules that would prevent most losses
6. If it already happened
7. Frequently Asked Questions
8. The Bottom Line

Introduction

Almost every crypto scam that works is a variation on about six ideas. That is the useful thing to know, and it is more useful than any individual warning, because scammers rotate the surface details constantly while the underlying mechanics almost never change. The token name is new. The Telegram group is new. The structure underneath is decades old and, in some cases, predates the internet entirely.

This is not a fear piece. Most people who lose money to crypto scams are not careless and are not stupid. They are hurried, or flattered, or caught at a moment when the thing being offered lines up with something they already wanted to believe. The defense is not paranoia. It is pattern recognition, plus a small number of habits that cost you nothing when you are wrong about a scam and save everything when you are right.

Why crypto is unusually good ground for scams

Four features of crypto make it attractive to people running these plays. Understanding them tells you where to be careful rather than making you afraid of everything.

Transactions are irreversible. There is no chargeback. A bank can claw back a fraudulent wire in a way that no blockchain can, and once a transaction confirms, the money is gone in a fairly literal sense. This single property changes the risk calculus of every decision you make.

Anyone can create a token. Deploying a token to most chains costs a few dollars and takes minutes. There is no vetting, no listing committee, nobody checking whether the project exists. A token being tradeable means nothing at all about whether it is real.

The technical surface is unfamiliar. Most people cannot read a smart contract. That gap between what you can verify and what you have to take on faith is exactly where scams live, in every field, not just this one.

Legitimate returns really are volatile. In a market where a real asset can genuinely go up 10x, "this could go up 10x" stops functioning as a warning sign. Crypto's real history of outsized gains is what makes implausible promises sound merely optimistic.

The six patterns

1. The rug pull

Developers launch a token, generate excitement, accumulate buyer money in the liquidity pool, then withdraw the liquidity and disappear. The token's price collapses to approximately zero within minutes, and holders discover there is nothing on the other side of the trade.

The tells are structural, and they are visible before you buy:

• Liquidity is not locked. Legitimate projects lock liquidity in a time-release contract, so developers cannot withdraw it. This is publicly checkable and is the single most predictive signal.
• The team is anonymous with nothing at stake. Anonymity is not automatically damning, and some respected projects have pseudonymous founders. But anonymous plus unlocked liquidity plus a brand new contract is a specific and bad combination.
• A tiny number of wallets hold most of the supply. If the top ten wallets hold 80% of tokens, ten people can end the project whenever they choose.
• Urgency is engineered. Countdown timers, a "presale closing in two hours," limited allocations. Every one of these exists to stop you from doing the checks in this list.

2. The pig butchering scam

The most financially destructive pattern currently running, and the one that catches the most careful people, because it does not begin with an investment pitch at all.

It begins with a wrong number text, a dating app match, or a friendly professional connection on LinkedIn. Weeks pass. Sometimes months. A genuine relationship forms, and there is no mention of crypto. Eventually the other person mentions, casually, an investment they have been doing well with. You are not pushed. Often you are gently discouraged at first, which is the most effective move in the entire script.

You are eventually directed to a platform that looks completely professional. Your deposit shows a gain. You withdraw a small amount successfully, which is the moment the trap closes, because now you have personally verified that withdrawals work. You deposit more. When you try to withdraw a meaningful amount, there is a tax, or a fee, or a compliance hold that requires another deposit to release.

The defining tells:

• The platform was introduced by a person, not found by you. This is the core structural signature.
• A small withdrawal succeeded early on. This is not reassurance, it is the mechanism.
• Any withdrawal requires a payment first. No legitimate exchange requires a deposit to release your own funds. None. This one rule ends the scam every time it is applied.
• Returns are steady and good. Real markets are erratic. A dashboard that goes up smoothly is a dashboard, not a market.

3. The fake support impersonator

You post about a problem, or you search for a support number. Within minutes someone messages you privately offering help, using the exact avatar and near-exact handle of the real project.

Real support will never message you first, and will never ask for your seed phrase or private key. There is no exception to this, no verification process that requires it, no wallet migration that needs it. A seed phrase is not a password. It is the wallet. Anyone who has it owns everything in it forever.

Also worth internalizing: legitimate support will not ask you to connect your wallet to a "validation" site, will not ask you to screen share while you access your wallet, and will not ask for a remote desktop session.

4. The wallet drainer signature

This one is technically interesting and catches experienced users, because it does not involve giving anyone your keys.

You connect your wallet to a site to claim an airdrop or mint an NFT. You approve a transaction. The transaction was not a mint, it was a token approval granting a contract permission to move your assets, sometimes an unlimited amount of them, indefinitely. Nothing happens immediately. Days later the wallet is emptied.

The defense is habit rather than knowledge:

• Read what you are approving. Wallets show the permission being granted. "Approve unlimited" on a token you were told you would receive for free is backwards.
• Use a separate wallet for anything experimental. A small, ring-fenced wallet for minting and airdrops means a drainer gets a rounding error rather than your position.
• Revoke old approvals periodically. Approvals persist forever until you revoke them. A permission you granted two years ago to a site that no longer exists is still live.

5. The giveaway and doubling scam

"Send 1 ETH to this address and receive 2 ETH back." It is transparently absurd written down, and it still works, because it is delivered inside a hijacked verified account, a hacked YouTube channel streaming an old conference talk on loop, or a deepfaked video of a recognizable figure.

The rule is absolute and requires no judgment: nobody sends you more money than you send them. No exchange, no foundation, no billionaire. There is no legitimate mechanism this describes.

6. The fake exchange or wallet app

A convincing app in a real app store, or a site one character off from a real domain. You deposit, and the balance shows. You cannot withdraw, or the seed phrase the app generated for you was generated by the attacker and is already in their possession.

Get exchange and wallet apps only via the link on the project's official website, typed by you. Bookmark the real domains. Search results and app store rankings are both purchasable.

The checks that actually take two minutes

You do not need to become an on-chain analyst. This short list catches the overwhelming majority:

• Look up the token contract on a block explorer. Check holder distribution and how old the contract is. Concentration and newness are both risk.
• Check whether liquidity is locked, and for how long.
• Search the project name with the word "scam" and read what comes back. This is unsophisticated and it works.
• Verify the domain character by character. Homoglyph domains are the norm, not the exception.
• Ask what the money actually does. If a project cannot explain where returns come from in one plain sentence, that is the answer.
• Check whether you were approached. Practically every large loss begins with someone contacting you.

The two rules that would prevent most losses

If everything above is too much to keep in your head, these two carry most of the weight.

Never share a seed phrase with anyone, for any reason, ever. No legitimate process requires it. Writing this down is not condescending, because the scams that harvest seed phrases are specifically built to construct a scenario where sharing it feels not just reasonable but urgent.

Never pay a fee to withdraw your own money. This single rule terminates pig butchering, fake exchanges, and most recovery scams. If accessing your funds requires you to first send funds, you are not looking at a fee. You are looking at the scam.

If it already happened

First: this happens to intelligent, careful people, in large numbers. Shame is the reason most of it goes unreported, and it is also what makes people vulnerable to the follow-up.

Practical steps:

• Move any remaining assets to a new wallet immediately if a seed phrase or private key may be compromised. Assume the old wallet is monitored.
• Revoke token approvals on the compromised wallet, though moving funds out matters more and matters first.
• Report it. In the US, that is the FBI's IC3 and the FTC. Recovery is genuinely uncommon, but reports feed investigations that do sometimes result in seizures.
• Be extremely skeptical of anyone offering to recover your funds. Recovery scams specifically target people who have already been scammed, often using victim lists from the original scam. A second loss on top of the first is depressingly common.

Frequently Asked Questions

Q: What is the most common crypto scam?
A: By number of incidents, phishing and fake support impersonation are the most common. By money lost, pig butchering causes the largest losses, because it builds a personal relationship over weeks or months before any investment is discussed.

Q: Can stolen cryptocurrency be recovered?
A: Rarely. Blockchain transactions are irreversible by design, and there is no chargeback mechanism. Funds are sometimes recovered when they move to a centralized exchange that freezes them under law enforcement request, but you should treat recovery as unlikely and be very suspicious of anyone who promises it.

Q: How do I check if a crypto token is a scam?
A: Look up the contract on a block explorer and check three things: how concentrated the holdings are, whether liquidity is locked, and how new the contract is. Then search the project name alongside the word scam. Those checks take about two minutes and catch most of them.

Q: Will a crypto exchange ever ask for my seed phrase?
A: No. Never, under any circumstances, for any reason. A seed phrase controls the wallet itself, so no legitimate support process, verification step, or migration requires it. Any request for one is a scam without exception.

Q: Why do I have to pay a fee to withdraw from this platform?
A: You do not, and that request is the scam. Legitimate exchanges deduct network fees from the amount you withdraw. Requiring a separate deposit before releasing your funds is the defining move of pig butchering and fake exchange scams.

Q: Is it safe to connect my wallet to a website?
A: Connecting to view is low risk. Approving transactions is where the risk sits, because an approval can grant a contract ongoing permission to move your tokens. Read what each approval actually authorizes, and keep a separate low-value wallet for anything experimental.

The Bottom Line

Scams in crypto are not clever. They are patient, well-produced, and repetitive. Almost all of them need one of two things from you: a secret you should never share, or a payment to unlock money that is already yours. Refuse those two things reflexively and you have closed the majority of the attack surface.

The rest is a two-minute habit. Check the contract, check who approached whom, check that you can explain where returns come from. Being briefly slow costs you nothing on a real opportunity, because real opportunities survive a two-minute delay. The ones that do not survive it were telling you something.

This content was created with AI assistance and may contain errors. Always verify before acting. Not financial advice. Always do your own research before making any investment decisions.

Frequently Asked Questions

Get daily intelligence on the coins you track

Personalized AI briefings built from the sources you choose. Starting at $5.99/month.