The decentralized and often anonymous nature of cryptocurrency makes it a prime target for scammers. In 2025 alone, an estimated $17 billion was lost to crypto scams and fraud. As the space evolves, so do the tactics of malicious actors. Whether you are a complete beginner or a seasoned investor, staying informed about the most common scams is your best defense against becoming a victim.
This guide breaks down the most prevalent crypto scams to watch out for in 2026 and provides actionable tips on how to spot and avoid them. Before diving in, make sure you have a secure Ethereum wallet set up — it is your first line of defense.
1. Phishing Scams: How to Recognize a Fake Crypto Website
Phishing remains one of the most effective and widespread types of scams. Scammers create fake websites, emails, or social media profiles that impersonate legitimate companies like MetaMask, Coinbase, or OpenSea. Their goal is to trick you into revealing your private key or seed phrase.
How it Works: You receive an email or a direct message with an urgent warning about your account, or an offer that seems too good to be true. The message contains a link that directs you to a fake website that looks identical to the real one. When you enter your credentials or seed phrase, the scammers capture it and drain your wallet instantly.
How to Avoid It:
- Never click on links in unsolicited emails or messages.
- Always double-check the URL of any website before connecting your wallet or entering your password. Scammers often use domains like “metamask-support.com” or “coinbase-wallet.net” — always verify the exact domain.
- Bookmark official sites and only access them through your bookmarks.
- Remember: No legitimate company will ever ask for your seed phrase. If you are unsure how to keep your credentials safe, read our guide on how to secure your Ethereum wallet.
2. Impersonation Scams and Fake Crypto Support Agents
A variation of phishing, impersonation scams have seen explosive growth, with a 1,400% increase in 2025. Scammers will impersonate a person or entity you trust — from a well-known influencer to a customer support agent from your favorite exchange.
How it Works: This could be a fake “support agent” on Discord or Telegram offering to help you with a wallet issue, or a social media account impersonating a well-known influencer and promoting a fake airdrop or giveaway. These accounts often have verified-looking badges or thousands of followers, making them difficult to distinguish from the real thing at first glance.
How to Avoid It:
- Be extremely skeptical of anyone who contacts you directly offering help or a special deal.
- Verify the identity of the person or company through official channels — go directly to the company’s official website rather than clicking any links provided to you.
- Never share your screen with someone you don’t know and trust.
- Legitimate support teams never reach out first. If you need help, always initiate contact through official channels.
3. How Pig Butchering Crypto Romance Scams Work
This is a particularly cruel and long-term scam that combines romance and investment fraud. The name comes from the practice of “fattening up the pig before the slaughter.” According to the FBI, victims of these scams lose an average of $120,000 per case — and many lose their entire life savings.
How it Works: A scammer, often using an attractive fake profile, will contact you on a dating app or social media. They will spend weeks or even months building a relationship and gaining your trust. Eventually, they will introduce a “guaranteed” crypto investment opportunity and convince you to invest. They direct you to a fraudulent trading platform where it appears your investment is growing rapidly. They continue to encourage you to invest more and more — until you try to withdraw your funds, at which point they disappear with everything.
How to Avoid It:
- Be wary of anyone you meet online who quickly steers the conversation toward crypto investing, no matter how genuine the relationship feels.
- Never send money to someone you have never met in person.
- Research any trading platform independently before depositing funds. Check for reviews, regulatory registration, and a verifiable physical address.
- If an investment opportunity sounds too good to be true, it is.
4. How to Spot AI Deepfake and Celebrity Crypto Scams
With the rapid advancement of artificial intelligence, scammers are increasingly using deepfake technology to create hyper-realistic videos of celebrities or prominent business figures promoting fraudulent crypto projects. AI-powered scams surged 1,210% in 2025, far outpacing the growth of traditional fraud methods and making them one of the most dangerous emerging threats in the space.
How it Works: Scammers use AI to clone the voice and likeness of individuals like Elon Musk, Michael Saylor, or even Vitalik Buterin. These deepfake videos are broadcast on platforms like YouTube, TikTok, or X (formerly Twitter), claiming that if you send a certain amount of cryptocurrency, they will send double the amount back. The production quality can be extremely convincing — even experienced crypto users have been fooled.
How to Avoid It:
- Verify endorsements by checking the celebrity’s official verified social media accounts before acting on any claim.
- Look for visual glitches such as unnatural blinking, robotic voice tones, or lips that do not perfectly sync with the audio.
- Remember that no legitimate public figure will ever host a “send me crypto and I will double it” giveaway. This is always a scam, without exception.
- Reverse image search any profile photos from unsolicited contacts to check if they are stolen from elsewhere online.
5. How to Identify a DeFi Rug Pull Before Investing
Rug pulls and pump-and-dump schemes are particularly common in the Decentralized Finance (DeFi) space and the meme coin market, where anyone can create and list a new token with minimal oversight. Understanding how these scams work is essential for anyone participating in DeFi on Ethereum.
How it Works: In a rug pull, developers heavily promote a new cryptocurrency project to attract investors. Once enough capital has been pooled, the developers abruptly drain the liquidity, taking all the funds and leaving investors with worthless tokens. A pump-and-dump scheme is similar: organizers coordinate to buy a cheap, obscure token, hype it up on social media to inflate the price (the “pump”), and then sell off their holdings at the peak (the “dump”), causing the price to crash and leaving other investors with near-worthless assets.
How to Avoid It:
- Research the development team. Anonymous founders with no verifiable track record are a significant red flag.
- Check the token’s liquidity lock. Legitimate projects usually lock their liquidity for a set period to prevent rug pulls. You can verify this on platforms like Unicrypt or Team Finance.
- Avoid investing based solely on social media hype or fear of missing out (FOMO). Always do your own research.
- Use tools like Token Sniffer or RugDoc to audit new DeFi projects before committing any funds.
- Check if the smart contract has been audited by a reputable third-party security firm. Learn more about how smart contracts work to better understand the risks.
6. Fake Airdrops and Giveaway Scams: How to Verify a Legitimate Crypto Airdrop
Scammers often take advantage of the hype around new projects and airdrops to lure in victims. With the rise of legitimate airdrop opportunities, it has become increasingly difficult to distinguish the real from the fraudulent. If you are interested in participating in genuine airdrops, our airdrop hunting guide covers how to find and safely qualify for them.
How it Works: You see a post on social media or receive a message promoting a fake airdrop for a popular token. The link takes you to a phishing site that asks you to connect your wallet and sign a transaction to “claim” your tokens. This transaction actually grants the scammer permission to drain your wallet — often within seconds of signing.
How to Avoid It:
- Always verify airdrops on the project’s official website and social media channels before interacting with any link.
- Never sign a transaction from a source you don’t 100% trust. Read the transaction details carefully.
- Be suspicious of any “giveaway” that requires you to send crypto first — this is always a scam.
- Use a dedicated “burner” wallet for claiming airdrops, keeping it separate from your main holdings.
7. Malicious dApps, NFT Scams, and Address Poisoning: What It Is and How to Avoid It
Interacting with the Web3 ecosystem requires constant vigilance. Scammers have developed sophisticated methods to drain wallets through malicious smart contracts and transaction manipulation. Before connecting your wallet to any new platform, make sure you understand the difference between hot and cold wallets and the risks associated with each.
How it Works: You might connect your wallet to a malicious decentralized application (dApp) or NFT marketplace. When you attempt to interact with it, you are prompted to sign a transaction that contains a hidden function granting the dApp unlimited approval to spend your tokens. Another rising threat is address poisoning: scammers send a tiny amount of crypto to your wallet from an address that looks almost identical to one you frequently use. They hope you will mistakenly copy this “poisoned” address from your transaction history for your next transfer, sending your funds directly to the scammer.
How to Avoid It:
- Only interact with well-known, reputable dApps with a proven track record and verifiable audit history.
- Read transaction details carefully before signing to understand what permissions you are granting.
- Always verify the full wallet address character by character when sending funds — never rely on just the first and last few digits.
- Use a “burner” wallet with a small amount of funds for interacting with new or untrusted dApps.
- Periodically revoke token approvals for dApps you no longer use, using tools like Revoke.cash.
8. Warning Signs of a Cryptocurrency Scam Before You Invest
Regardless of the specific method used, most cryptocurrency scams share common warning signs. Being able to identify these red flags early is crucial for protecting your digital assets before it is too late.
The most reliable red flags to watch for include:
- Promises of guaranteed returns. No investment — crypto or otherwise — can guarantee profits. Anyone making this claim is either lying or running a scam.
- Requests for your seed phrase or private key. This is the single clearest sign of a scam. No legitimate service ever needs this information.
- Urgency and pressure tactics. Phrases like “Act NOW or miss out forever” are designed to prevent you from thinking critically.
- Unsolicited investment advice via DMs. Legitimate investment opportunities do not arrive in your inbox uninvited.
- Too-good-to-be-true giveaways. “Send 1 ETH, get 2 ETH back” is always a scam, no matter who appears to be offering it.
- Requests to pay fees to “unlock” funds. This is a classic advance-fee fraud tactic adapted for the crypto world.
- Anonymous or unverifiable team. If you cannot find any information about the people behind a project, treat it as a red flag.
9. What to Do If You Get Scammed in Crypto: A Step-by-Step Guide
If you realize you have fallen victim to a cryptocurrency scam, it is essential to act quickly and methodically to mitigate further losses and protect your remaining assets.
- Stop all communication with the suspected scammer immediately. Do not send any more funds under any circumstances, even if they promise to return what was already taken.
- Secure your remaining assets. If your wallet was compromised, create a new wallet and transfer your remaining funds immediately. Revoke any suspicious smart contract approvals using a tool like Revoke.cash. For best practices on keeping your remaining funds safe, see our guide on how to safely back up your seed phrase.
- Document everything. Take screenshots of all conversations, website URLs, transaction hashes, and the scammer’s wallet addresses. This information is critical for any law enforcement report.
- Report the scam. File a report with your local law enforcement agency. In the United States, you can report crypto fraud to the FBI’s Internet Crime Complaint Center (IC3) and the Federal Trade Commission (FTC). In the EU, contact your national financial regulator.
- Beware of recovery scams. Scammers often target recent victims, claiming they can recover the stolen funds for an upfront fee. No one can guarantee the recovery of stolen cryptocurrency. This is almost always a secondary scam.
10. Staying Safe in the Crypto World
While the threat of scams is real, you can significantly mitigate your risk by adopting a healthy dose of skepticism and following basic security hygiene. The single most effective thing you can do is invest time in education — the more you understand about how crypto works, the harder you are to fool.
- Use a hardware wallet for long-term storage of significant amounts. Read our Ledger vs. Trezor comparison to find the right option for you.
- Slow Down: Scammers always create a sense of urgency to pressure you into making mistakes. Take your time and think before you click.
- Trust Your Gut: If something feels off, it probably is. The crypto space moves fast, but a legitimate opportunity will still be there tomorrow.
- Stay updated on the latest scam tactics by following reputable security researchers and official exchange communications.
By staying vigilant and informed, you can navigate the exciting world of Ethereum safely and confidently. For a complete security checklist, read our guide on 10 essential tips to secure your Ethereum wallet.
Further Reading
Frequently Asked Questions
Can stolen cryptocurrency be recovered?
In most cases, cryptocurrency transactions are irreversible, making it extremely difficult to recover stolen funds. While law enforcement agencies and blockchain analysis firms occasionally track down and seize stolen assets, it is rare for individual victims to get their money back. Always be extremely cautious of “recovery services” that ask for an upfront fee, as these are almost always secondary scams targeting victims.
Will a legitimate company ever ask for my seed phrase?
No. Legitimate companies, customer support teams, or developers will never ask for your seed phrase or private keys. Your seed phrase is the master key to your wallet. If you share it with anyone, they will have full control over your funds and can drain your account instantly. Learn how to store it safely in our guide on backing up your seed phrase.
How do I know if a new crypto project is a rug pull?
Warning signs of a potential rug pull include anonymous or unverifiable development teams, promises of guaranteed high returns, aggressive marketing tactics focused solely on price appreciation rather than utility, and unlocked liquidity pools. Always research the project thoroughly, read the whitepaper, and verify the team’s credentials before investing. Tools like Token Sniffer and RugDoc can help you audit a project’s smart contract for known vulnerabilities.
What is address poisoning and how do I protect myself?
Address poisoning is a scam where a fraudster sends a tiny amount of crypto to your wallet from an address that closely resembles one you frequently use. The goal is for you to accidentally copy this “poisoned” address from your transaction history when making a future transfer. Always verify the full wallet address character by character before sending funds, and never rely solely on the first and last few digits. Using an ENS name (Ethereum Name Service) instead of a raw address can also help reduce this risk.
Are hardware wallets safe from crypto scams?
A hardware wallet significantly reduces your exposure to online threats like phishing and malware, since your private keys never leave the device. However, hardware wallets do not protect you from social engineering scams — if a scammer tricks you into signing a malicious transaction on your hardware wallet, your funds can still be stolen. Always verify what you are signing on the device’s own screen, and never approve a transaction you did not initiate yourself. See our Ledger vs. Trezor guide for a full security comparison.
References
