Crypto Scams

If you are up to date on current events, you’ve most likely heard of Bitcoin or other types of cryptocurrency. Cryptocurrency has been in vogue for many years and has quickly spread worldwide like wildfire. This has presented new risks for potential investors. People eager to jump on the trend invest in different forms of crypto without taking basic precautions. As a result, they are more likely to be taken advantage of.

Due to the lack of regulation for cryptocurrencies like Bitcoin, scammers and hackers have found easy ways to make a quick buck. There have been reports in the media of people making millions from illegal crypto activities.

As people become increasingly interested in Bitcoin, so too do the fraudsters and scam artists. Most people are unfamiliar with their methods, so con artists and swindlers are having a field day in the crypto world. The scammers have developed sophisticated ways to deceive and profit off unsuspecting investors.

The best way to avoid being scammed outright is by researching and reading how these scams typically operate. In this article, we’ll explore some of the more popular crypto scams out there and see how exactly they manage to trick people. You can protect yourself from falling victim to one of these schemes with a better understanding of the risks involved and what red flags to look for.

The Evolution of Bitcoin and Cryptocurrency

A Bitcoin is a digital number created by a mathematical function called a “HASH.” It is accessed through a “public” and a “private” key and held in a blockchain, which is a digital ledger. The ledger is not kept in any one location but in many.

You can only add new transactions to the ledger; you cannot change or delete an existing transaction. Bitcoin and other cryptocurrencies work on a similar principle. So, anyone can see all the transactions that have ever occurred, but no one knows who owns which Bitcoins.

When you want to buy something with Bitcoin, you must find a seller willing to accept Bitcoin as payment. Transactions can be completed through a crypto exchange or directly between people.

Other firms have followed in Bitcoin’s footsteps by creating their own versions of digital currency. Now, there is a slew of alternative cryptocurrencies, many of which are small copies that change the overall coin supply or hashing algorithms. Ripple and Litecoin are two notable examples. Ethereum, on the other hand, was created to be much more than a digital currency. It is a decentralized platform that can run smart contracts or computer programs that automatically execute when certain conditions are met. This allows for a whole new world of possibilities, such as developing decentralized apps (dapps).

Cryptocurrencies have captured the imagination of many people, and their popularity has seen a meteoric rise in recent years. However, this interest has incentivized a good amount of crypto scams. Below, we will outline some of the most common types of crypto scams to watch out for.

Phishing Scams

Phishing is the illegal act of obtaining sensitive and confidential details, such as usernames, passwords, private keys or payment information, through fake websites and misleading links.

Users are fooled into thinking they are entering their information on a trusted website or following a legitimate link that has been shared with them through emails, messages or Google ads.

What usually happens is that users receive an email giving them the false idea that something has happened to their account or wallet and that they need to fix it by following a link.

The link directs them to a fake website, usually designed to resemble the original website. It may use the same design, color scheme, logo and font style, forcing visitors to believe they are in the right place.

Once the user enters the information, it is passed on to the scammers, who can then use it however they want. They may use the information straight away or store it for later, depending on how much they believe they can gain from the account.

In plain terms: how a phishing attack actually reaches you

Think of it as a fake shopfront. The attacker copies a website you already trust, then needs one thing only: for you to walk through the wrong door.

The usual chain has four links. First, contact — an email, an SMS, a Telegram or Discord message, or a paid ad sitting above the real result in Google. Second, a reason to hurry — a “suspicious login”, a “wallet migration”, a refund waiting for you. Third, the fake page — visually identical to the real one, sitting on a domain that is one character off. Fourth, the harvest — whatever you type is sent straight to the attacker, often while the page shows a spinning loader so you do not realise anything went wrong.

The important part: no software on your computer has been broken. Nothing was hacked. You were persuaded. That is why antivirus rarely stops phishing and why the defence has to be a habit rather than a tool.

MyEtherWallet is a prime example of this style of scam. Fake websites and applications were designed with the same look as the official platform, making users feel safe enough to provide the same information they would normally enter on the real website.

This resulted in huge losses for users. To think that a fake MyEtherWallet app reportedly became one of the top apps in its category is scary. How easily it spread and affected so many users shows how vulnerable the cryptocurrency industry can be and how exposed users are to these attacks.

Another method is the use of fake airdrops. This is when scammers pretend to represent legitimate companies and offer free tokens to large numbers of people.

Along with the offer comes the need to download an application, connect a wallet or visit a portal created by the same individuals looking to make easy money at your expense.

Users may be asked to enter their usernames, passwords, seed phrases or private keys. Once this information is provided, the scammers may gain access to the wallet and drain the account.

In plain terms: why a “free token” airdrop is such an effective hook

An airdrop is a real thing. Genuine projects do hand out free tokens to early users, and that is exactly what makes the fake version work — the offer is not obviously absurd.

The trick is what the offer asks for in return. A real airdrop never needs your seed phrase, your private key or your exchange password, because a seed phrase is not a login: it is the wallet itself. Anyone holding it owns every coin in that wallet, permanently, with no support line to call.

The second version is quieter. Instead of asking you to type anything, the site asks you to “connect wallet” and approve a transaction to claim your tokens. The approval you sign is not a claim — it is permission for the attacker’s contract to move your tokens whenever it likes. The wallet may look untouched for days before it is emptied. Read what you are signing, and treat unlimited spending approvals as a decision, not a formality.

How to Avoid Being Scammed

Now the question is, what needs to be done to avoid these activities?

The answer is simple. Be informed.

Keep yourself up to date. The more you know about what is happening around the world, the better. Subscribe to trusted news websites and read as much as possible.

Discuss these subjects with people who understand them and talk about the latest scams. It requires some effort on your part. Be curious. Know more.

A few things to keep in mind are as follows.

Check the Website Address

Make sure the website address you are visiting is the same one you normally use.

Usually, there are a few small differences that are ignored or difficult to notice. A scammer may change one letter, add an extra word or use a slightly different domain.

But this is your hard-earned money we are talking about here, so you have to be careful every single time you are asked to enter your details.

Double-check the address.

It should start with “https” and not just “http,” but remember that HTTPS alone does not prove that the website is legitimate. Scam websites can also use HTTPS.

The best option is to bookmark the official website or type the address manually into your browser.

In plain terms: what a lookalike address actually looks like

Read a domain from right to left, not left to right. The part that decides where you really are is the last two pieces before the first single slash — everything to the left of that can be invented freely by whoever owns the domain.

So login.yourexchange.com.secure-verify.io is not your exchange. It is secure-verify.io, wearing your exchange’s name as a costume. The same goes for a hyphen where there should be nothing (your-exchange.com), an extra word (yourexchange-wallet.com), a swapped letter (yourexchagne.com), a different ending (.co, .net, .app instead of .com), and characters from another alphabet that render identically to Latin ones.

This is also why HTTPS proves so little. The padlock only means the connection is encrypted between you and whoever owns that address — and a scammer can get a certificate for their own fake domain in minutes, for free. Encrypted does not mean honest. A bookmark, or typing the address yourself, removes the guesswork entirely.

Go With Your Gut Feeling

If the website does not feel right, something looks off or something feels different from your normal routine, stop.

Do not proceed without verifying it.

Call a friend who knows a thing or two. Contact the company through its official website. Do something. Just do not go with the flow.

Watch Out for Urgency

Another very common tactic these fishy websites use is creating a sense of urgency.

They give warnings. They use deadlines. They force the user to take action as quickly as possible, sometimes using big, bold red titles with words such as “HURRY,” “URGENT” or “ACCOUNT SUSPENDED.”

The aim is to create panic and make users act without thinking rationally. Most of the time, the result is terrible.

If a message is rushing you, stop and check the account directly through the official website. Do not use the link in the message.

In plain terms: why urgency is the giveaway, not the emergency

Urgency is not decoration on the scam. It is the scam. Careful checking takes a couple of calm minutes, so the attacker’s whole job is to make sure you never get those minutes.

It works because fear narrows attention. Told that your account is being drained right now, you stop reading the address bar and start looking for the button that makes the problem go away. That is the moment the fake page is built for.

The defence needs no expertise at all: any message that pressures you is, by that fact alone, a message you should not act on from inside the message. Close it. Open the site the way you normally do — your own bookmark, your own typing, your own app. If the emergency is real, it will still be there on the official dashboard. It almost never is.

Use a Strong Password

Always set a strong password.

More importantly, remember that password or store it safely in a trusted password manager. It is very common for people to forget their passwords and lose access to their own wallets or accounts.

Use a different password for every account and enable two-factor authentication whenever possible.

Never give anyone your password, private key or seed phrase. A real wallet company or customer support agent should never ask for this information.

Later on, we will explain in more detail how to avoid scams and the main dos and don’ts.

In plain terms: password, private key and seed phrase are three different things

People use these words interchangeably, and scammers rely on that confusion.

A password unlocks an account on somebody else’s service — an exchange, for example. If it is stolen, the company can freeze the account and give it back to you.

A private key authorises spending from one specific address. Whoever holds it can move those funds. It cannot be changed or revoked.

A seed phrase — the 12 or 24 words written down when you created the wallet — regenerates every private key in that wallet. It is not a password for the wallet: it is the wallet. Type it into a website and the money is gone, usually within minutes, with nobody to appeal to.

So the rule has two halves. Passwords: unique per account, stored in a password manager, with two-factor authentication turned on — and prefer an authenticator app or a hardware key over SMS codes, which can be stolen through a SIM swap. Seed phrase: never typed into any website, any support chat, any “wallet validation” tool, ever. Legitimate support will never ask, because legitimate support cannot use it for anything except stealing from you.

Mining Scams

Mining scams are another interesting part of the cryptocurrency world. Many of them use cloud mining.

Now, not all cloud mining is illegitimate. Some companies use cloud mining for legitimate purposes. But, as always, there are a few that have used cloud mining negatively and carried out elaborate schemes to scam people.

Cloud mining is the process of mining cryptocurrencies through a remote service. There are companies that allow people to open an account with them and, in return, let users participate in the mining process.

The process is conducted through the company’s equipment, removing the need for users to purchase hardware or deal directly with equipment maintenance and energy costs.

There are legitimate operations out there, and there are people who participate in them. At the same time, there are companies that are completely on the wrong side of the law and every ethical boundary.

In plain terms: what you are actually buying with cloud mining

You are renting a share of someone else’s machines and paying for the electricity they burn. In exchange you receive whatever those machines earn, minus the operator’s fee.

That is the whole model, and it explains why the margins are thin even when everything is honest. The operator has already paid for the hardware and pays the power bill; they only sell you a contract if their cut makes it worth more to them than mining it themselves. You are, by design, on the less profitable side of that trade.

It also explains why the fraudulent version is so easy to run. Nothing about a cloud mining contract is visible to the buyer. There is no machine you can point at, no hash rate you can independently confirm, no way to tell rented capacity from a spreadsheet. A dashboard showing your “daily earnings” costs nothing to fake, and the payouts can be funded entirely by the next customer’s deposit — at which point it has stopped being mining and become a Ponzi scheme with mining-themed graphics.

The Returns

Returns are one way of looking at these operations and judging whether they may be trying to sting you.

But be careful. Very high or guaranteed returns are usually a bigger warning sign than low returns.

Cryptocurrency mining depends on electricity prices, hardware performance, mining difficulty, fees and the value of the cryptocurrency being mined. No legitimate company can guarantee massive profits without any risk.

If a company promises easy money, fixed daily profits or returns that sound too good to be true, there is a good chance something is wrong.

Steer clear of such setups. They are not for you. Or anyone, for that matter.

In plain terms: why a fixed daily return is impossible in mining

Mining income moves every single day, because five separate things underneath it move every single day.

Mining difficulty rises as more machines join the network, so the same hardware earns less over time — this is automatic and continuous. The coin price swings, and your earnings are paid in that coin. Electricity is the largest running cost and is priced by the hour in many markets. Hardware ages, fails and gets outpaced by newer models. Network fees and block rewards change too — Bitcoin’s reward halves roughly every four years, cutting the income from identical work in half overnight.

Any one of those makes a guaranteed number impossible. All five together make it a claim nobody could honour even if they wanted to. So when an operator quotes a flat “1.5% per day”, they are not describing mining output; they are describing a marketing figure they have chosen. The money to pay it has to come from somewhere, and if it is not coming from the machines, it is coming from the next depositor.

Transparency

Is the company allowing you to examine how it works, what tools it uses and how it plans to take the business forward?

If not, you should be concerned that there is something it does not want you, or anyone outside its inner circle, to know.

Transparency is very important. Every user has the right to know about the company they are going to be involved with.

You should be able to find information about the owners, business address, equipment, fees, contracts, withdrawal rules and how returns are calculated.

There should be no question about it.

In plain terms: how to check transparency yourself, in ten minutes

Transparency is not a feeling about a website. It is a list of specific claims you can go and verify.

The people. Are named executives listed, and do those names exist outside this company’s own website — conference talks, an employment history, press coverage? Photographs that appear on stock-image sites, or a team page with no surnames, answers the question on its own.

The company. A registration number and address can be checked in the relevant national companies register in a couple of minutes. A serviced-office address shared with hundreds of other entities, or a registration two months old behind a decade of claimed operating history, is a contradiction worth taking seriously.

The machines. Which model, how many, in which facility, at what power cost? Honest operators publish this because it is their pitch. Photographs of a data centre prove nothing — reverse-image search them.

The exit. Withdrawal minimums, fees, processing times, and whether payouts stop during “maintenance”. This is where the complaints appear first, so search the company name together with the word withdrawal and read what people say when they try to leave.

If asking any of this directly gets you a support agent who changes the subject or offers a bonus for depositing more, that is your answer.

Malware Scams

A malware portal or infected application can be used to attack your computer and hit you exactly where it hurts.

Malicious software is created and placed inside downloads, wallet applications, browser extensions, email attachments or fake updates.

Once the computer is infected, the malware can take control of certain functions and steal private information or data in the way it was designed to do.

There are numerous ways through which the job can be done.

One example is malware that can compromise a Bitcoin wallet. When you attempt to send coins to a friend in need, the original wallet address may be replaced with a fake one belonging to the scammer.

Cryptocurrency Clipboard Hijackers

One type of malware scam that received attention was known as a cryptocurrency clipboard hijacker.

It used the Windows clipboard as its weapon.

Some of these scammers used the clipboard to monitor thousands of cryptocurrency addresses, but one reported version was much bigger. It was said to monitor around 2.3 million addresses.

The malware used the copy-and-paste mechanism of Windows systems.

Cryptocurrency addresses are usually long and difficult to remember. When users copied and pasted an address, the malware replaced it with a forged address belonging to the scammer.

The transaction would then land in the wrong hands.

Because cryptocurrency transactions are usually irreversible, the money may be impossible to recover once it has been sent.

Always compare the wallet address before confirming a transaction. Check the first and last several characters, and for a large payment, consider sending a small test transaction first.

In plain terms: how a clipboard hijacker steals a payment

Every time you copy something, your computer holds it in one shared pocket called the clipboard. Any program running on that machine can read that pocket, and any program can quietly change what is in it. That is not a flaw being exploited — it is how the clipboard has always worked.

So the malware does nothing dramatic. It sits idle, watching what you copy, and does nothing at all until the thing you copied looks like a crypto address. At that instant it swaps your copied address for one of its own, chosen from its stored list to match the same currency and the same general shape. Then it goes quiet again.

What makes it so effective is the psychology of the paste. You copied the correct address one second earlier, so you already know what should be in the box. Addresses are long, meaningless strings that the eye skims rather than reads, and the substitute often begins with similar characters. You glance, it looks right, you confirm — and the payment is final, on a public ledger, sitting in a stranger’s wallet.

Two habits defeat it completely. Compare characters at the start and at the end of the address after pasting, not just at the start. And for anything substantial, send a small test amount first, confirm it arrived, then send the rest.

How to Spot Possible Malware

Your computer shows signs of slowing down.
Pop-up ads begin appearing far too often and become difficult to ignore.
You notice unusual activity that you were not responsible for.
Programs open or close by themselves.
Your browser settings suddenly change.
Your security software becomes disabled.
You see login attempts or transactions that you did not authorize.

If you believe your computer is infected, disconnect it from the internet and stop entering passwords or accessing wallets until the device has been checked.

In plain terms: what to do first if you think you are infected

Order matters more than speed here, and the instinct most people follow — log in and check the accounts — is the one that does the damage.

Disconnect first. Pull the Wi-Fi or the cable. Anything still being sent to the attacker stops at that moment.

Do not log in to anything from that machine. Not the exchange, not the email, not the wallet. If the device is compromised, every password you type is simply a new password being handed over.

Change passwords from a different device — a phone on mobile data, another computer — starting with the email account, because that is what resets everything else. Then the exchanges, then whatever shares those passwords.

Assume the seed phrase is gone if it was ever typed, photographed or stored on that machine. Move the funds to a wallet created on a clean device. Changing the password on the old wallet does nothing; the seed phrase still opens it.

Clean the machine properly. A scan that finds nothing is not proof of safety. For a device that held real money, a full wipe and reinstall is the only honest reset.

Fake Wallets

Fake wallets are also a favorite of scammers.

They create a fake wallet to trick people into revealing their passwords, private keys or seed phrases.

Bitcoin Gold was new to the market, and users who were looking to claim their coins were directed to a fake wallet that went by the name of mybtgwallet.com.

Thinking it was the real thing, users provided information relating to their private keys and were deprived of millions of dollars as a result.

The scam emptied wallets and reportedly cost users a combined amount close to $3.5 million.

Keeping in mind the number of fake Google ads and advertisements being thrown at you every day, you have to be very careful when visiting a website or downloading a wallet.

The ideal thing to do is to keep the original website bookmarked or type the address manually into your browser.

Only download wallets through the official project website or verified app-store page.

How to Spot a Fake Wallet

Information about the wallet or its business model is missing.
There is no presence on major cryptocurrency or security websites that usually cover important platforms.
The platform has only recently been created.
The developers or company owners cannot be identified.
The wallet asks for your private key or seed phrase without a valid reason.
The website uses “http” instead of “https,” meaning the connection is not secure.
The app appears mainly through paid advertisements rather than official channels.
The reviews seem copied, repetitive or far too positive.

Remember that HTTPS does not automatically mean a website is safe. Always verify the domain, the company and the official download link before entering any sensitive information.

In plain terms: how to verify a wallet before you install it

The dangerous moment is not using the wallet — it is choosing it. Almost every fake wallet is found the same way: through a search result, an ad, or an app store listing, rather than through the project itself.

Start from the project, never from the search box. Find the official website through a source you already trust, then follow its download link to the app store. That single reversal removes the most common trap, because a paid ad can sit above the real result and a store listing can carry the real logo.

Read the listing sceptically. Check the publisher name against the one on the official site, the install count against how well known the wallet is, and the release date — a wallet claiming years of history with a listing from last month is a copy. Reviews that are numerous, five-star, short and posted within the same few days are bought.

Watch the first screen. A genuine wallet either creates a new seed phrase for you or asks you to type an existing one to restore your own wallet — offline, on the device. If the first thing the app or site asks for is a seed phrase in order to “verify”, “sync”, “validate” or “unlock rewards”, close it.

Test small. Before moving anything meaningful, send a small amount in, send it back out, and confirm both transactions on a block explorer. A wallet that accepts deposits but stalls on withdrawals has told you what it is while it still costs almost nothing to find out.

ICO SCAMS

Since the advent of cryptocurrencies, institutional investors have shown great interest in digital assets. However, many ICOs have become frauds, with businesses vanishing once they acquire a large amount of money.

Since the money has already been raised and no regulatory body oversees the creators’ decisions regarding its application, the ICOs are free to do what they want with the money. They can easily walk away with the cash or work within the confines of the law.

The Giza Scam was an infamous example of fraudulent ICO activity when nearly $2 million was taken from unsuspecting investors. When the major provider announced they had severed ties with Giza due to reasons that would cause any supporter to flee, the warning flags began fluttering. Allegations of fraud soon followed, and no one could get their money back.

The developers of the Enigma Catalyst project also ran away with $45 million, despite having a working product.

How to Avoid ICO Scams

When considering investing in an ICO, do your own research, and never invest more than you can afford to lose. Read the whitepaper and understand the project before making any decisions.

To find a reputable ICO, look for positive online reviews and a strong community presence. Additionally, check whether the project has a working product and a clear roadmap for the future.

Pump and Dump Scam

Pump-and-dump schemes are a form of investment fraud in which individuals invest in a company that is either overhyped or destined to fail. The fraudsters persuade these investors to put money into the scam before selling their shares at a high price point. Because victims may have difficulty determining whether or not there was genuine potential for development within the firm, such cons often target digital cryptocurrencies.

Some investors may be hesitant to invest in a project, but they are encouraged by the promise of a major player investing or partnering. This makes people believe in the project, even though it doesn’t seem very promising otherwise.

The scammers drive the price by making many people believe in it. When they’re done, and the price can’t go any higher, they sell all at once, causing the price to plummet quickly.

This can happen in a matter of a few minutes!

An example of a crypto pump-and-dump scam is the Bitconnect Scam.

Bitconnect was a cryptocurrency that was advertised as a high-yield investment program. It promised returns of up to 40% per month, which was far higher than anything else on the market.

Many people invested in Bitconnect, but the price soon crashed and they lost all their money.

Another example of a crypto pump-and-dump scam is the PlusToken Scam.

PlusToken was a cryptocurrency advertised as a way to earn interest on your investment. It promised returns of up to 9% per month, which was much higher than anything else on the market.

People invested in PlusToken, but the price soon crashed, and they lost all their money.

How to Avoid Pump and Dump Scams

Before you invest in any cryptocurrency, do your homework. Don’t invest in a new currency if there are a lot of news stories, blog entries, or essays about how popular it is. Look up the coin and read its white paper to learn more about who created it and why. This will help you determine if any pump-and-dump schemes are going on with this currency.

Ponzi Crypto Schemes

Ponzi schemes are a type of fraud that involve telling potential investors that they will make a profit by recruiting new members. The problem is that eventually, there aren’t enough new people investing money into the scheme, and it falls apart because there isn’t enough revenue coming in to support everyone who invested. When this happens, everyone who invested in the scheme is ripped off, regardless of how much money was originally brought in or where it was spent. Scammers make a quick profit and then leave their victims stranded. Ponzi schemes have infiltrated the cryptocurrency world and are scamming investors worldwide.

The financial damage caused by these types of scams is devastating.

Forsage-crypto, a crypto Ponzi scheme that spanned over two years, duped investors by letting them partake in transactions that used Ethereum, Tron, and Binance smart contracts. Forsage-crypto’s affiliate marketing business model drew investors in with the guarantee of profits. As stated on the SEC’s website, Forsage enticed millions of retail investors by offering a user-friendly platform for Ethereums’, Trons’, and Binances’ blockchains. Moreover, it dependably utilized newly invested money to repay earlier participants–a hallmark trait of pyramid schemes.

Another example of a crypto Ponzi scheme is the OneCoin scam. The OneCoin scheme was promoted as a way to earn money by investing in a new cryptocurrency. However, the company has been accused of being a Ponzi scheme. According to the company’s website, it was established in Vietnam, but the country later disputed this claim. Additionally, several disasters across several countries and territories worldwide have revealed that OneCoin is fraudulent.

How to recognize a Ponzi Scam

The revenue is exponentially high
Unlicensed brokers
Lack of transparency
Lack of information about the company
Unregistered investments

If you have already been scammed, there are a few things you can do:

Contact the SEC at https://www.sec.gov/tcr. The SEC is the US regulator for securities, and they will be able to give you more information on what to do next.
File a complaint with the FBI at https://www.ic3.gov/Home/ComplaintChoice. They will be able to investigate the scam and help you get your money back.
Contact the Federal Trade Commission at https://www.ftccomplaintassistant.gov/. They will be able to help you get your money back and also prevent the scammer from continuing to scam other people.
Contact FINRA at https://www.finra.org/. FINRA is the financial regulator in the United States. You can file a complaint and report any potential scams or suspicious activities by a brokerage.

Concluding Thoughts

The best way to avoid crypto scams is to do your homework. Research any cryptocurrency or project before you invest in it. Also, check the source of any news stories or blog posts about a cryptocurrency before you believe them. Finally, if something sounds too good to be true, it probably is!

César Daniel Barreto

César Daniel Barreto is an esteemed cybersecurity writer and expert, known for his in-depth knowledge and ability to simplify complex cyber security topics. With extensive experience in network security and data protection, he regularly contributes insightful articles and analysis on the latest cybersecurity trends, educating both professionals and the public.