Crypto Scams to Avoid: 10 Common Scams and How to Spot Them

1. Rug Pulls

How it works: Developers create a promising new cryptocurrency project, hype it up on social media and Telegram groups, attract investor money, then suddenly withdraw all liquidity from the trading pool and disappear.

Real example: The Squid Game token (2021) rocketed from $0.01 to $2,856 in days after riding the Netflix show's popularity. Investors who bought could not sell because the developers had disabled the sell function. When the price peaked, the developers drained the liquidity pool — worth over $3 million — and vanished.

Red flags: Anonymous team members, no audited smart contract, hype-driven marketing with no real product, promises of guaranteed returns, sell functions that seem broken or restricted.

How to avoid: Only invest in projects with doxxed (public identity) teams, audited smart contracts, and legitimate use cases. Check if the liquidity pool is locked using tools like RugDoc or Token Sniffer. If a project sounds too good to be true, it is a rug pull.

2. Phishing Emails

How it works: Scammers send emails that appear to come from legitimate exchanges like Coinbase, Kraken, or Binance. The email claims your account is compromised, needs verification, or has a pending withdrawal. It contains a link to a fake login page that steals your credentials and 2FA codes.

Real example: In 2023, a sophisticated phishing campaign targeted Coinbase users with emails spoofing Coinbase's actual address. The fake site used an SSL certificate and looked identical to Coinbase. Over $1 million was stolen before the domain was taken down.

Red flags: Urgent language ("your account will be suspended"), generic greetings ("Dear valued customer"), slightly misspelled domains (coinbase-secure.com instead of coinbase.com), unsolicited attachments.

How to avoid: Never click links in emails about your exchange account. Bookmark the real exchange URL and always navigate there directly. Enable 2FA using an authenticator app (not SMS). Use a hardware wallet for long-term storage so even a compromised exchange account cannot drain your funds.

3. Fake Exchanges

How it works: Scammers build websites that look identical to legitimate crypto exchanges. When you deposit funds, the site shows fake balances and fake trading activity. But when you try to withdraw, you are asked to pay "verification fees" or "taxes" — or the withdrawal simply never processes.

Real example: Fake-Kraken.com appeared in Google search results as a paid ad above the real Kraken link. It mimicked the Kraken interface perfectly. Victims deposited Bitcoin to addresses controlled by scammers. Total losses exceeded $500,000 before the domain was flagged.

Red flags: Domains with extra words or misspellings (kraken-login.com), no regulatory information, promises of free Bitcoin for signing up, poor website performance, withdrawal requests that require additional payments.

How to avoid: Always verify you are on the correct domain by checking your browser's address bar. Bookmark the real exchange during your first visit. Check the exchange's regulatory registration on the official regulator website. Use only exchanges from our verified list →

4. Pump and Dump Schemes

How it works: Organized groups on Telegram, Discord, or Signal coordinate to buy a low-cap cryptocurrency simultaneously, driving up the price artificially. New investors see the price surging and buy in fear of missing out. The organizers then sell their holdings at the peak, crashing the price and leaving late buyers with losses.

Real example: In 2024, a Telegram group with 50,000 members orchestrated a pump of a low-cap altcoin. The price rose 800% in 30 minutes. The organizers dumped their positions, and the price fell 90% in the next hour. Over $2 million was transferred from late buyers to the organizers.

Red flags: Sudden, unexplained price surges in low-volume coins, social media posts urging you to buy a specific coin at a specific time, promises of guaranteed profits, groups that publish "calls" with timing targets.

How to avoid: Never buy a coin based on a tip from a social media group. If a coin has surged 500% in a day, the profit opportunity has already passed for you — the dump is coming. Stick to established cryptocurrencies with real market depth.

5. Giveaway Scams

How it works: Scammers impersonate celebrities, influencers, or exchanges and promise to multiply any crypto you send them. The classic pitch: "Send 1 BTC to this address, and we will send 2 BTC back." The address belongs to the scammer, and you never receive anything back.

Real example: In 2020, Twitter's verified accounts of Elon Musk, Bill Gates, and Apple were hacked simultaneously to post a Bitcoin giveaway scam. "Send $1,000 BTC, get $2,000 back." The tweet was up for hours and generated over $120,000 in Bitcoin from victims before being removed.

Red flags: Any message promising to multiply your crypto. Verified social media accounts making giveaway posts (even real accounts can be hacked). URLs that look like giveaway landing pages. Requests to send crypto to receive more crypto.

How to avoid: No legitimate company, celebrity, or exchange will ever ask you to send crypto to receive more. If it sounds like a giveaway, it is a scam. Report and block the account immediately.

6. Romance Scams

How it works: Scammers build romantic relationships with victims on dating apps or social media over weeks or months. Once trust is established, they introduce cryptocurrency investing — guiding the victim to a fake exchange or wallet. The victim deposits money, sees fake profits, and deposits more. When they try to withdraw, the scammer disappears.

Real example: A woman in her 50s met "Michael" on a dating app. Over three months, they exchanged hundreds of messages. Michael claimed to be a successful crypto trader and convinced her to invest $40,000 on a platform he recommended. The platform showed her balance growing to $120,000. When she tried to withdraw, the site demanded a $15,000 "verification fee." Michael stopped responding. The FBI reports romance scam losses exceeded $600 million in 2024.

Red flags: Someone you have never met in person wants to teach you about crypto investing. They pressure you to use a specific platform. They share screenshots of "profits." They make excuses for never video calling. They ask for money or investments before meeting.

How to avoid: Never send money or crypto to someone you have not met in person. Be extremely skeptical of anyone who offers to "teach you crypto investing" in a romantic context. Stick to well-known, regulated exchanges for any real crypto purchase.

7. SIM Swap Attacks

How it works: A scammer calls your mobile carrier, impersonates you, and claims to have lost their SIM card. They get a new SIM activated with your phone number. Now all your SMS-based 2FA codes arrive on their phone. They use these codes to reset passwords on your exchange accounts and drain your funds.

Real example: In 2023, the founder of a crypto startup lost $100,000 in Bitcoin through a SIM swap. The attacker called T-Mobile, convinced the support agent that they were the founder, activated a new SIM at a retail store, and used SMS 2FA codes to access his Coinbase account within 30 minutes.

Red flags: Your phone suddenly loses signal (the SIM has been deactivated). You receive texts from your carrier about a SIM change you did not request. Your accounts start sending password reset emails you did not initiate.

How to avoid: Never use SMS-based 2FA for any financial account. Use an authenticator app like Google Authenticator or Authy, or better yet, a hardware security key like YubiKey. Add a PIN or password to your mobile carrier account that must be provided before any SIM changes.

8. Fake Wallet Apps

How it works: Scammers publish fake cryptocurrency wallet apps on official app stores. These apps look like real wallets (MetaMask, Trust Wallet, Ledger Live) but are designed to steal your seed phrase or private keys when you create or import a wallet. The app may work normally for small amounts to avoid suspicion before stealing your entire balance.

Real example: In 2024, a fake Ledger Live app was available on the Apple App Store for two weeks before being removed. It had positive reviews from fake accounts and looked identical to the real app. Users who entered their seed phrase to "restore" their wallet had all funds drained. Estimated losses: $200,000.

Red flags: Slightly different developer name (e.g., "MetaMassk" instead of "MetaMask"), fewer downloads than the real app, recent release date for a well-known wallet, requests for seed phrases or private keys. Legitimate wallet apps never ask for your seed phrase except during initial setup or recovery.

How to avoid: Download wallet apps only from the official website (linked from the project's official Twitter/X account). Check the developer name, download count, and release date before installing. Never enter your seed phrase into any app — legitimate wallets generate it offline.

9. Cloud Mining Scams

How it works: Companies promise to mine cryptocurrency on your behalf using their hardware. You pay upfront for a mining contract, and they promise daily returns. Initially, you may see small payouts to build trust. Then you are encouraged to reinvest or buy larger contracts. Eventually, the company stops paying and disappears.

Real example: The Bitcoin Trader cloud mining platform collected $50 million from investors worldwide. It promised 1.5% daily returns from Bitcoin mining operations. For the first 30 days, investors received payments. Then the site went offline, the founders disappeared, and all communication ceased. Investigation revealed no actual mining hardware existed.

Red flags: Guaranteed daily returns, no information about mining locations or hardware, pressure to reinvest, referral bonuses for bringing in new investors, anonymous team members, no audited proof of reserves.

How to avoid: Legitimate cloud mining barely exists. The total hash power available from real cloud mining operations is a tiny fraction of what scammers claim. If cloud mining were profitable, the operators would mine themselves rather than selling contracts. Assume every cloud mining offer is a scam unless proven otherwise through independent verification.

10. Social Media Impersonation

How it works: Scammers create fake social media accounts impersonating crypto influencers, exchange support teams, or project founders. They reply to public posts offering "help" or announcing "giveaways." When you engage with them, they direct you to phishing sites or ask for crypto.

Real example: Fake accounts impersonating Elon Musk routinely post replies claiming "I'm giving away 10,000 ETH to my followers." In 2022, a fake Coinbase support account on Twitter/X replied to users reporting issues on the Coinbase subreddit. The account instructed users to send their funds to a "secure wallet" for protection — which was the scammer's wallet.

Red flags: Accounts with slight name variations (ElonMusk_Official vs Elon Musk), very new accounts with no posting history, accounts that reach out to you first offering help or giveaways, requests to send crypto to an address, links to non-official websites.

How to avoid: Check the account's join date and follower count. Look for blue verification badges on Twitter/X. Real support teams will never ask you to send crypto to an address. Always verify official accounts through the project's website, not through social media links.

General Safety Rules for Crypto Investors

• Use hardware wallets for any amount over $1,000. Ledger and Trezor devices store your private keys offline, making remote theft impossible.
• Never share your seed phrase with anyone, for any reason. No legitimate service, exchange, or wallet will ever ask for it.
• Use a dedicated email address for crypto accounts, with a strong unique password and 2FA via authenticator app.
• Verify every URL before entering credentials. Bookmark exchanges and wallets during your first visit.
• Start small — make a small test transaction before transferring large amounts to any new address or platform.
• Ignore DMs — scammers rely on direct messages to bypass public scrutiny. Treat every unsolicited crypto DM as a scam.

Learn how to buy cryptocurrency safely →

Is Coinbase safe from scams?

As a platform, Coinbase is one of the safest and most regulated exchanges. It holds licenses in the US, UK, and EU, maintains 98% of customer assets in cold storage, and carries crime insurance. However, your Coinbase account can still be compromised if you fall for a phishing scam or SIM swap attack. Using a hardware wallet and never clicking email links from Coinbase are the best ways to protect yourself. Read our full Coinbase review →

How do I know if a crypto exchange is legitimate?

Check three things: regulation, track record, and transparency. Legitimate exchanges are registered with financial regulators like the FCA (UK), CySEC (EU), or FinCEN (US). They have a long operational history with no major security breaches. They disclose their team members, registered address, and security practices. Avoid exchanges that cannot provide clear regulatory information, have anonymous teams, or pressure you to deposit quickly. See our verified list of crypto exchanges →

What should I do if I get scammed?

Act immediately: report the incident to your local law enforcement (FBI IC3 in the US, Action Fraud in the UK), contact the exchange where the funds were sent (they may freeze the account), and report the scam address to blockchain analytics platforms like Chainalysis or Etherscan. Be aware that crypto transactions are irreversible — no one can reverse a blockchain transaction. If someone contacts you claiming they can recover your funds for a fee, it is a recovery scam; ignore and report them.

Related Resources