Crypto Asset Scams: Fake Exchanges, Rug Pulls, and How to Stay Safe

Types of Crypto Scams

Fake Exchanges

Scammers build websites that look identical to legitimate crypto exchanges. When you deposit funds, the site shows fake balances and trading activity. But when you try to withdraw, you are asked to pay "verification fees" or the withdrawal never processes. Fake exchanges often appear as paid ads in search engine results, ranking above legitimate exchanges. Always verify the URL carefully — scammers use domains like coinbase-secure.com or binance-login.com. Bookmark the real exchange URL during your first visit and always navigate there directly.

Phishing for Wallet Keys

Phishing attacks target your private keys or seed phrase — the cryptographic keys that control access to your cryptocurrency. Scammers send emails, SMS messages, or social media DMs that appear to come from legitimate wallet providers or exchanges. The message claims your account has been compromised and requires you to "verify" your seed phrase by entering it on a fake website. Legitimate companies never ask for your seed phrase or private keys. Anyone who has your seed phrase can steal all your crypto, and transactions cannot be reversed. Learn about crypto wallets →

Rug Pulls in DeFi

A rug pull occurs when developers create a cryptocurrency project, attract investor money through hype and marketing, then suddenly drain the liquidity pool and disappear. Rug pulls are most common in decentralized finance (DeFi) and on decentralized exchanges where projects can launch without oversight. Red flags include anonymous developers, unaudited smart contracts, locked liquidity that is not actually locked, and projects that heavily emphasize marketing over product development. Use tools like RugDoc, Token Sniffer, and DexScreener to check smart contract audits and liquidity locks before investing in any new token.

Pump and Dump on Low-Cap Tokens

Organized groups on Telegram, Discord, and Signal coordinate to buy low-cap tokens simultaneously, driving up the price. New investors see the price surging and buy in. The organizers sell at the peak, crashing the price. Crypto pump and dump groups are brazenly public — some have 100,000+ members. The organizers always profit; the late buyers always lose. If you are invited to a "signals group" that issues coordinated buy alerts, assume you are being set up as the exit liquidity for the organizers. Learn about pump and dump schemes →

Cloud Mining Scams

Companies promise to mine cryptocurrency on your behalf using their hardware. You pay upfront for a mining contract, and they promise daily returns. Initially, you may see small payouts to build trust. Then you are encouraged to reinvest or buy larger contracts. In reality, the company has no mining hardware — they are simply paying you from new investor deposits (a Ponzi scheme). Legitimate cloud mining barely exists. If cloud mining were profitable, the operators would mine for themselves rather than selling contracts. Assume every cloud mining offer is a scam.

Fake Airdrops

Scammers advertise fake cryptocurrency airdrops — free token distributions designed to promote a new project. To claim the airdrop, you must connect your wallet to a fake website and often pay a "gas fee." When you connect your wallet and approve the transaction, the scammer drains your wallet of all assets. Only participate in airdrops from projects you have verified through official channels. Never connect your wallet to an unfamiliar website, especially one promoted through social media ads or unsolicited messages.

Cryptojacking

Cryptojacking is the unauthorized use of someone else's computer, smartphone, or tablet to mine cryptocurrency. Scammers inject malicious code into websites, downloads, or browser extensions that runs in the background and uses your device's processing power to mine crypto for the scammer. Unlike other crypto scams that directly steal your assets, cryptojacking steals your computing resources — slowing down your device, increasing your electricity bill, and potentially damaging your hardware. Cryptojacking can be embedded in seemingly legitimate websites, free software downloads, or even in online ads. Signs your device has been cryptojacked include: the device runs slower than usual, the fan runs constantly at high speed, battery drains faster than normal, and the device is hot to the touch even when idle. To protect against cryptojacking, use browser extensions that block cryptocurrency mining scripts (such as NoCoin or MinerBlock), keep your antivirus software updated, avoid downloading software from untrusted sources, and close browser tabs when not in use. Some websites disclose that they use your CPU for mining while you visit — always decline such requests. Enterprise networks should use web filtering and endpoint protection that blocks cryptomining domains. Learn about malware and phishing →

How to Safely Custody Crypto Assets

Self-Custody vs Exchange Custody

Self-custody means you control your private keys and your crypto cannot be accessed without your approval. Exchange custody means the exchange holds your private keys — you are trusting the exchange to safeguard your assets. Self-custody is more secure but requires technical knowledge and responsibility. Exchange custody is more convenient but exposes you to exchange hacks, insolvency, and withdrawal freezes (as FTX customers learned). For long-term storage, use self-custody. For active trading, only keep what you need on exchanges. Learn how to store crypto safely →

Hardware Wallets

A hardware wallet (Ledger, Trezor, KeepKey) stores your private keys on a physical device that never connects to the internet. Transactions must be physically confirmed on the device. Even if your computer is infected with malware, your keys remain safe. Hardware wallets are the gold standard for crypto security. For any crypto holdings above $1,000, use a hardware wallet. Never buy hardware wallets from third-party resellers — only purchase directly from the manufacturer to avoid tampered devices.

Seed Phrase Security

Your seed phrase (also called a recovery phrase) is the master key to your crypto wallet. Anyone with your seed phrase can access your funds from any device. Store your seed phrase offline — write it on paper and store it in a fireproof safe. Never type it into a computer, phone, or website. Never take a photo of it. Never share it with anyone, including people claiming to be wallet support. A legitimate wallet provider will never ask for your seed phrase. If you lose your seed phrase, you lose access to your crypto forever — there is no "forgot password" option in self-custody.

SEC Investor Alerts on Crypto

The SEC has issued numerous investor alerts about cryptocurrency scams, warning that crypto investments may not be registered securities and that investors may lack important protections. The SEC's Office of Investor Education and Advocacy specifically warns about: unregistered crypto offerings (which lack the disclosure and oversight of registered securities); crypto lending and staking programs that promise high yields; celebrity-endorsed crypto projects that may be paid promotions; and crypto assets marketed as "stablecoins" that may not maintain their peg. The SEC advises investors to verify that any crypto investment is registered or exempt from registration, to understand the risks before investing, and to be extremely cautious about any crypto investment that promises guaranteed returns. Learn about HYIPs →

Related Resources