Crypto Scams Explained: Types, Warning Signs and Recovery
Learn the main crypto scams in 2026, including rug pulls, phishing, fake airdrops and wallet drainers, plus the warning signs and steps to take after a loss.
Published
Updated
Cryptocurrency investment fraud generated approximately $5.8 billion in reported losses across 41,557 complaints in 2024, according to the Congressional Research Service. That reframes crypto scams: the danger isn't just a hacker breaking into a wallet. It's also someone persuading you to make a transfer that looks sensible at the time.
Protecting yourself means checking both the request and the investment. Non-malicious code doesn't guarantee a tradable market, and a professional-looking platform doesn't prove that your money is where its dashboard says it is.
Table of Contents
- Crypto Scam Types at a Glance
- How Rug Pulls and Wallet Drainers Empty Accounts
- How Pig-Butchering Scams Build Trust Before They Take Funds
- How Fake Airdrops and Phishing Trap Victims
- Warning Signs On-Chain and Off-Chain
- Why a Passing Safety Check Is Not Enough
- Prevention Habits That Stop Most Losses
- What to Do in the First Hour After a Loss
Crypto Scam Types at a Glance
The FBI's annual Internet Crime Report announcement recorded 149,686 cryptocurrency-fraud complaints and approximately $9.3 billion in reported losses in 2024. These are complaints submitted to a U.S. reporting system, not a complete worldwide total, and people who never report aren't counted.
A crypto scam uses deception to obtain your assets, credentials, or permission to move funds. Some scammers control a token's supply or liquidity; others never launch a token at all.
The most useful distinction is what the scammer needs you to do.
| Scam type | How it works | Main warning sign | Typical loss pattern |
|---|---|---|---|
| Rug pull | Creator removes liquidity or sells supply after buyers arrive | Liquidity control is unverified; a wallet holds a large share | Price collapses and selling becomes difficult |
| Phishing | Fake wallet, exchange, or support pages capture secrets or request signatures | Lookalike domain or unsolicited support message | Stolen credentials or permissions enable theft |
| Fake airdrop | A supposed free-token claim requests wallet access or approval | Unsolicited claim link and urgent deadline | Assets covered by the authorization are swept |
| Wallet drainer | Malicious transactions or permissions authorize asset transfers | Unlimited spending or unclear signature requests | Multiple assets may be taken |
| Fake investment platform, including pig-butchering | Relationship-led contact directs victims to fabricated trading gains | Promised returns and extra payments demanded before withdrawal | Successive deposits become inaccessible |
| Address poisoning | An attacker places a lookalike address in transaction history | An unfamiliar tiny transfer with a similar-looking address | A later payment goes to the attacker |
| Recovery scam | A supposed specialist promises to recover stolen crypto | Unsolicited help with an upfront payment demand | The victim loses additional money |
Match the request, not just the story
A giveaway, investment invitation, and security alert can lead to the same dangerous action. Ask whether you're being told to connect, sign, disclose, transfer, or pay.
Practical rule: Identify what the other person wants you to authorize before deciding whether their explanation sounds believable.
The categories can overlap. A fake airdrop can be the lure, phishing the delivery method, and a wallet drainer the theft mechanism. You don't need to identify the exact label before refusing a request you can't independently verify.
How Rug Pulls and Wallet Drainers Empty Accounts
A rug pull resembles a shopkeeper selling customers vouchers, then removing the cash needed to redeem them. A wallet drainer is closer to someone obtaining a key that opens specific cupboards in your house. Both cause losses, but they exploit different kinds of control.
The distinction is between losing a token's market and losing assets from your wallet.
When the creator controls the exit
Say a token trades through a liquidity pool containing that token and a paired asset such as SOL. Buyers exchange SOL for tokens; sellers exchange tokens for SOL.
If the creator controls withdrawable liquidity, they can remove the reserves supporting those exchanges. Buyers may still see tokens in their wallets, but find little usable value available when they try to sell. A creator can also sell a large allocation into buyers' demand without withdrawing the pool itself.
When a signature authorizes theft
In a typical drainer sequence, a claim page first requests a wallet connection. Connecting alone usually doesn't authorize spending. The dangerous step follows: a transaction or signature grants permissions or directly authorizes transfers.
On chains that support token allowances, an approval can let a spender move the specified token later. Other attacks package asset transfers into the transaction itself. Disconnecting the website doesn't necessarily cancel permissions already recorded on-chain.
The wider scam environment also reflects changing persuasion tactics. Chainalysis's crypto crime report estimated at least $9.9 billion in on-chain scam inflows in 2024, with high-yield investment scams accounting for 50.2% and pig-butchering for 33.2%; pig-butchering revenue rose almost 40%, while high-yield investment scam revenue fell 36.6% year over year.
Keep the authorization step in mind when assessing wallet-theft demonstrations.
A permission-based drainer needs your authorization; a rug pull may need only your purchase. Avoiding malicious signatures won't protect the money you voluntarily put into a creator-controlled market.
How Pig-Butchering Scams Build Trust Before They Take Funds
The term pig-butchering describes relationship-led investment fraud. The scammer builds trust before asking for money, so the victim experiences the invitation as advice from someone familiar rather than a cold sales pitch.
Say someone receives an apparently mistaken text. The sender apologizes, keeps chatting, and eventually mentions successful crypto trading. Nothing about the opening conversation requires a wallet.
From conversation to escalating deposits
The progression often follows this pattern:
- An ordinary introduction. A wrong-number message, dating match, hobby discussion, or investment group creates an opening.
- A private relationship. The conversation moves to a messaging app. Personal stories and regular attention make the contact feel dependable.
- A controlled demonstration. The person recommends a platform that displays gains after a small deposit.
- A larger commitment. Encouragement becomes pressure to deposit more, sometimes by borrowing or selling other assets.
- A blocked exit. Withdrawal triggers a demand for a tax, verification deposit, or release fee.
The supposed trader and platform support staff may reinforce each other's story. One reassures the victim that the investment is sound while the other explains why another payment is necessary.
A victim may defend the relationship because admitting the investment is false also means confronting a personal betrayal. Family members should ask to review the withdrawal process together, not begin by calling the person gullible.
What counts as independent evidence
A dashboard balance is an entry controlled by whoever operates the website. It isn't proof that the displayed assets exist or belong to you.
A successful small withdrawal is useful evidence, but it isn't proof of legitimacy: scammers can allow early withdrawals to encourage larger deposits. Verify the transaction independently, and remember that an on-chain deposit proves movement of funds, not the platform's honesty or solvency.
A request to send more money to release your existing balance is a reason to stop, not a reason to complete one final payment.
Don't take out a loan to solve a platform's withdrawal problem. Preserve the request and verify the business through channels the new contact didn't supply.
How Fake Airdrops and Phishing Trap Victims
Say Maya receives a message claiming that a token allocation is waiting for her wallet. The branding resembles a service she recognizes, and the message describes the claim as a reward for past activity.
The follow-up contains a claim link. It opens a page with familiar colors and a login or wallet-connect prompt. When Maya hesitates, another account posing as support says the claim failed and must be completed urgently.
The lure, request, and pressure
The story has three separate components:
- The lure gives Maya a reason to visit: free tokens or a reward she supposedly earned.
- The request seeks something valuable: credentials, a recovery phrase, a signature, or a transaction.
- The pressure discourages verification through a deadline, failure notice, or supposed processing fee.
This works because Maya thinks she's collecting something, not paying a stranger. A wallet pop-up can feel like routine administration even when it authorizes an asset transfer.
The financial stakes aren't limited to token launches. In investment-related fraud reports for 2023, consumers paid approximately $707 million using cryptocurrency, according to the Federal Trade Commission's fraud roundup.
Recognize what the page cannot legitimately need
A website doesn't need your seed phrase to send tokens to your public address. Entering it into a claim page gives someone the information needed to control the wallet.
Likewise, a familiar logo doesn't explain a transaction's permissions. Read what the wallet says will happen, not just what the website calls the button. Reject a request you can't interpret.
Blockchain transfers generally can't be reversed by asking the wallet provider. The most dependable protection point is before you disclose a secret or authorize a transaction, not after a support chat promises to undo it.
Warning Signs On-Chain and Off-Chain
Separate your checks into on-chain evidence, which records wallet and contract activity, and off-chain evidence, which includes websites, messages, and promotional claims. Neither group is sufficient alone: an active token can have deceptive promoters, and a polished website can display invented balances.
Use the checklist to organize observations, not to turn isolated clues into accusations.
Where to check each signal
| Signal | Where to check | What it suggests |
|---|---|---|
| Liquidity unlocked or locked briefly | Token pair page and liquidity-lock records | The controller may be able to withdraw quickly |
| A few wallets hold most supply | Holder distribution on a block explorer | Concentrated selling could sharply affect price |
| New wallets funded from one source | Top holders' transaction histories | Possible coordinated or bot-driven buying |
| Large buys in the first launch block | Launch transaction history | Possible bundled activity or privileged timing |
| High volume but few distinct buyers | Trade history and unique-wallet activity | Possible wash trading |
| Guaranteed or unusually high returns | Website, chats, and pitch material | Investment-fraud warning sign |
| Lookalike domain or cloned interface | Full website address and independent business records | Possible phishing or impersonation |
| Pressure to deposit or change wallets | Direct messages and support conversations | An attempt to bypass verification |
| Balance unsupported by withdrawal evidence | Independently checked withdrawal transaction | The balance may be a display only |
For Solana tokens, Solscan can help you inspect transfers and holders, while a DEX pair page shows trades and pool conditions. Identify pool, burn, and exchange addresses before interpreting a large holder as a single investor. Wallet concentration requires context.
A sell restriction needs its own investigation. Follow our guide to checking whether a Solana token is a honeypot rather than assuming every failed sale proves deliberate trapping.
Why appearance is weak evidence
The FBI's Operation Level Up account describes infrastructure used to support fraudulent investment platforms that imitate legitimate services. A convincing interface isn't independent verification.
Check claimed licensing through the relevant regulator's own register. A certificate or encrypted connection doesn't establish that the operator is honest, and a screenshot of a trade doesn't establish that a trade occurred.
Anonymous developers combined with aggressive paid promotion deserve scrutiny, but anonymity alone doesn't prove fraud. At MemeAssist, suspicious activity and potentially linked wallets are items to examine, not evidence of wrongdoing. Missing data isn't proof of safety either.
Why a Passing Safety Check Is Not Enough
A safety score is not the same as a safe trade. A token can have no obvious malicious code and still leave buyers unable to exit at anything close to the displayed price.
Separate exploit risk, where code or permissions can take assets, from market-structure risk, where available buyers and liquidity can't support your sale. Only the first requires a technical exploit.
A clean contract can sit inside a fragile market
Say you buy a token whose transfer rules look ordinary. Its chart shows frequent trades, but the pool is shallow and much of the activity comes from coordinated wallets.
When you sell, your order consumes the available liquidity and changes the price against you. That's price impact; if conditions also change before execution, the final result can differ further from the quote. Increasing your slippage tolerance doesn't create more buyers.
Bot-driven volume can make participation look broader than it is. Coordinated promoters can attract public buyers just as insiders begin selling. Neither behavior requires a contract that steals directly from your wallet.
The Solana launchpad research described in the available findings found that Pump.fun accounted for up to 71.1% of Solana token mints in Q4 2024, while fewer than 2% of tokens reached major decentralized exchanges. High issuance shouldn't be confused with durable demand.
Ask whether the trade is executable
Before buying, inspect the sell quote for the position size you intend to hold. Compare pool depth, recent selling, wallet concentration, and creator transfers rather than relying on the latest price.
Decision test: Can you enter and exit at a reasonable price given the liquidity available and the wallets already selling?
Use our Solana token safety checks as a research framework, not an approval stamp. A token can pass our checks and still collapse because demand disappears, large holders sell, liquidity changes, or new information appears.
Our analyses are informational, not financial advice. You can lose everything invested in a meme coin even when no rug pull occurs.
Prevention Habits That Stop Most Losses
Build a routine that works when you're distracted or excited. A saved bookmark, separate wallet, and deliberate signing process are more dependable than trying to judge every stranger's intentions.
Use these habits as operational safeguards, not as a promise that an investment will retain value.
Keep seed phrases and private keys offline and private. Sharing either can hand over control of the wallet; legitimate support staff don't need them. Restore a wallet only through authentic wallet software you've independently verified.
Use saved official addresses. Bookmark exchange and wallet websites after verifying them, instead of entering through message links. This prevents a convincing message from choosing your destination.
Read every authorization. Check the assets, recipient, spender, and permission scope before signing. Reject unexplained unlimited allowances and transactions whose consequences you can't understand, even if the site describes them as verification.
Review existing approvals. Use a reputable, chain-appropriate permission tool, such as Revoke.cash on supported networks, to remove allowances you no longer need. Verify the tool independently, because a fake revocation page can request a harmful signature too.
Separate storage from experimentation. Keep long-term holdings away from the wallet used for unfamiliar applications and token claims. A hardware wallet can protect key storage, but it won't make a harmful transaction safe if you approve it.
Verify new payment destinations before sending. Take the address from an independently confirmed source, compare the complete address, and send a small test before a larger transfer. Don't copy a destination from transaction history, and don't rely only on matching the beginning and end.
Make caution part of the buying process
Our guide to buying Solana meme coins safely can help you turn these habits into a consistent pre-purchase routine. Decide what evidence you need before opening a trading screen, where urgency can make shortcuts tempting.
Keep the following reminders visible when reviewing a request.
These precautions reduce exposure to avoidable operational mistakes. They can't restore liquidity a creator has removed or make an uneconomic position profitable.
What to Do in the First Hour After a Loss
Stop signing anything first. Don't follow instructions from the same website or account that handled the suspicious transaction, even if it now offers a refund.
Use a trusted device and independently verified services to contain further exposure. Preserve evidence while it's still available.
- Stop the harmful interaction. Close the suspicious application. Review and revoke relevant approvals through a trusted tool where appropriate; carefully verified containment transactions are different from continuing the scammer's signing requests.
- Protect what remains. If your seed phrase or private key may be exposed, move remaining assets to a wallet with a fresh seed created on a trusted device. Revoking allowances won't secure a stolen key.
- Preserve the evidence. Save transaction hashes, timestamps with time zones, wallet and contract addresses, website addresses, screenshots, chat exports, and promotional posts. Never include your seed phrase.
- Notify involved providers. Contact the exchange or payment provider through its official channel. Supply the transaction details and ask whether the destination can be flagged or funds frozen.
- File reports. Contact your national fraud or cybercrime authority, local police where appropriate, and relevant blockchain abuse-reporting channels.
- Maintain a contact log. Record case numbers, names, replies, and documents sent. Secure connected email and exchange accounts, and warn contacts if someone is impersonating you.
Keep the containment priorities accessible while you document the incident.
Avoid paying for a second loss
The FBI's 2025 Internet Crime Report recorded 10,516 recovery-scam complaints totaling $1.4 billion in losses. Treat unsolicited recovery offers as suspected follow-on fraud.
Recovery isn't guaranteed. An exchange may be able to freeze funds it controls, and authorities may recover assets through an investigation, but nobody can promise to reverse an ordinary blockchain transfer.
Never pay an upfront fee for guaranteed recovery. Refuse recovery requests for wallet connections, seed phrases, or remote device access. Filing an official fraud report shouldn't require paying a supposed recovery agent.
MemeAssist offers on-demand Solana token reports that combine liquidity, holder, creator, wallet, and trading evidence with a Rug Risk Rating and plain-English explanation. Visit MemeAssist to examine the evidence behind a token before buying, without connecting a wallet or signing a transaction, and use the report as a second opinion rather than a guarantee of safety.