How to Spot Crypto Scams in 2026: Types, Red Flags, Defense

How to spot crypto scams is no longer a nice-to-have skill — it is basic financial literacy. Crypto remains one of the fastest-growing asset classes in the world, and scammers have followed the money: according to Chainalysis, illicit funds flowing into crypto networks totaled $23.3 billion in 2024, an 83% jump year over year. The FBI’s Internet Crime Complaint Center separately reported that investment fraud — the category that includes the infamous “pig butchering” schemes — cost American victims roughly $1.1 billion in a single year. Most of those losses did not come from sophisticated hacking. They came from people who clicked, connected, or deposited one time too many.

In this guide, we break down the nine most common crypto scams in 2026 — from phishing sites and rug pulls to address poisoning and pig butchering operations — and show you exactly how each one works. You will get a red-flag checklist you can run in under two minutes before sending any funds, a side-by-side comparison table, and a 10-step defense checklist we recommend for every wallet you own. Whether you hold $500 or $500,000, these are the attacks that are actually costing people real money right now.

Disclosure: As an Amazon Associate, we earn from qualifying purchases on this page.

Published: November 2026

Why Crypto Scams Keep Growing in 2026

Scams are not an accident of crypto’s growth — they are a direct economic consequence of it. Three structural features of crypto make it a better hunting ground for fraudsters than almost any other asset class. First, transactions are irreversible: once funds leave your wallet, no customer-service line exists to call. Second, custody is self-managed: a single signature, entered on a fake website, can empty an account in seconds. Third, the market runs 24/7 in every timezone, so attacks scale globally without any single regulator standing guard.

After reviewing incident reports and on-chain data from 2024 through 2026, what stands out to us is not the novelty of the attacks but their industrialization. The same phishing kit templates, the same pig-butchering scripts, and the same fake airdrop domains are reused across thousands of campaigns. Major infrastructure events amplify the problem: after the $1.5 billion Bybit hack in February 2025, fake “compensation airdrop” sites appeared within hours, and they were still running months later. Scammers do not need to invent new tricks; they need victims, and the retail inflow into crypto has never been larger.

That is the good news and the bad news. The good news: because these attacks are templated, they follow predictable patterns that can be identified in seconds. The bad news: the patterns only protect you if you already know them. The rest of this guide is that pattern library.

The 9 Most Common Crypto Scams in 2026

1. Fake Exchanges and Phishing Websites

Phishing remains the single largest entry point for crypto theft. Scammers register lookalike domains — one letter off from the real exchange, a different TLD, a hyphen where there should not be one — then clone the login page pixel for pixel. You enter your credentials, and the session is captured. In 2025–2026, the tactic evolved: fake sites now offer deposit bonuses (a “3% bonus on your first deposit”) to pull victims in voluntarily, and some even let you trade on real market data for a few days so the site feels legitimate.

Red flag: if you ever reach the site by typing or clicking rather than from a bookmark you created yourself, verify the domain character by character before logging in. The official domain for every major exchange is listed on its verified social accounts — check there, not on search results, which scammers pay to manipulate.

2. Rug Pulls and Fake Token Launches

A rug pull is a project that raises money and then disappears. In 2026 the most common variants are liquidity rug (the team pulls the trading pool’s liquidity and the token goes to zero), honeypot (you can buy the token but the contract blocks selling), and the slow bleed (the team sells 5–10% of supply daily through hidden wallets). A 2026 review of token launches found that the overwhelming majority of new tokens with anonymous teams and unlocked insider supply collapse within 90 days.

Red flag: before buying any small-cap token, check who holds the supply. If the top 10 wallets hold more than 30–50% of the token, if liquidity is locked for only a few weeks, or if the contract lets the owner mint unlimited tokens, you are not an investor — you are the exit liquidity.

3. Wallet Drainers and Malicious Token Approvals

Wallet drainers do not need your password or seed phrase. They need one thing: your signature. A drainer presents itself as a claim page, an NFT marketplace, or a game. You connect your wallet, it asks you to “approve the token” or “verify your wallet,” and the signed transaction is actually a malicious allowance that lets the attacker sweep your assets at will. Because the signature is technically valid, there is no way to reverse it — the funds are gone in the same block.

Our complete breakdown of how wallet drainers work, the signing prompts that are actually safe, and how to revoke a bad approval is in our Wallet Drainers 2026: How to Protect Your Crypto Wallet guide.

Red flag: any prompt that asks for an unlimited token approval to a contract you do not recognize. A legitimate claim flow should only move the tokens you are owed, in one transaction.

4. Address Poisoning Attacks

Address poisoning is the scam that punishes your own trust in your transaction history. The attacker runs a bot that sends you tiny amounts of a coin from a wallet whose address differs from one you have transacted with before by only a few characters — often the first character, which is exactly the one you stop checking. Later, when you send funds, you copy the address from your history, and a fraction of it goes to the attacker. In 2022, on-chain analysis identified more than 2,400 victims who lost roughly $58 million to this attack, and the bot infrastructure is still active today.

Red flag: a small, unexplained deposit from a “familiar” address. The correct habit: never paste an address from transaction history. Keep a separate, verified address book, and for any non-trivial transfer, check the first and last four characters against your saved entry.

5. Pig Butchering Scams

Pig butchering (known in Chinese as “raising a pig to slaughter”) is the costliest crypto scam in existence, and it works on patience, not technology. A stranger contacts you on social media, builds a real relationship over weeks or months, and then gradually steers the conversation into “investment.” You are given access to a polished trading platform where your early deposits produce credible, visible profits that you can even withdraw in small amounts. Once your balance — and your trust — is large, the platform freezes withdrawals, and fees or taxes are demanded to release them.

The FBI’s IC3 reported approximately $1.1 billion in investment-fraud losses in 2023, with pig butchering schemes dominating the category, and the pattern continued into 2024 and 2025. What we noticed while studying the case files: nearly every victim told investigators the platform “looked completely professional,” because it was — it was a front-end built by the scammers themselves, showing whatever numbers they chose.

Red flag: the only place you can see your profit is inside the app the scammer gave you. If an “investment” has no verifiable external footprint — no audited statements, no exchange you can independently log into — the profits are a number on a screen.

6. Celebrity Giveaway Scams

The format has not changed in a decade, which tells you why it keeps working: someone famous is giving away free tokens, and you must deposit a small amount first to “unlock” or “verify” your share. In 2026 the celebrities are the same names as always, and the “verification” fee has grown from a few dollars to several hundred. The giveaway sites are often built with professional front-ends and even fake countdown timers.

Red flag: this one is binary. No legitimate giveaway ever requires you to deposit funds first. If a claim requires a deposit, a “gas payment,” or a “KYC fee,” it is a scam by definition. End of analysis.

7. Fake “Support” DMs and Impersonation

Scammers monitor social media for people who post about crypto problems — a stuck withdrawal, a confusing swap, a lost login — and within minutes a “customer support” account slides into the DMs. The agent is helpful, patient, and technically fluent. Over days, the “fix” involves downloading a remote-access tool, connecting a wallet to a “debug page,” or moving funds to a “safe holding account” pending investigation.

Red flag: real companies never initiate DMs, and they never need your seed phrase, your password, or your funds to fix anything. If you need support, open the official support channel yourself — from the official site, from the bookmark, not from a link in the DM.

8. Fake Airdrops and Dusting Attacks

Two related scams live in the airdrop space. The fake airdrop promises free tokens for a new project (often one that does not exist) and asks you to connect your wallet or sign a message to claim — the signature is a wallet drainer in disguise, per the mechanism above. Dusting is subtler: the attacker sends you 0.0001 BTC or a few dollars of an obscure token. It looks like an airdrop, but the real purpose is to link your addresses together on-chain or to seed your transaction history with a lookalike address for a future poisoning attack.

Red flag: any unsolicited “claim” link. Legitimate airdrops do not require you to sign a transaction you cannot read, and you can ignore dust entirely — it is not worth gas to sweep, and sweeping it can reveal your address relationships.

9. Malware, Fake Hardware Wallets, and Infected Downloads

Not every scam happens in your browser. Keyloggers and clipboard hijackers — sometimes bundled into fake crypto apps, fake wallet extensions, or “free airdrop claimer” executables — watch for address strings on your clipboard and swap them for the attacker’s. And a physical layer has emerged: counterfeit hardware wallets sold on marketplaces, pre-flashed with firmware that quietly copies your seed phrase to the attacker. We have seen listings for “Ledger” devices at 40% off from third-party resellers that were, in every verifiable way, clones.

Red flag: any hardware wallet that is not purchased directly from the manufacturer or an authorized reseller, and any wallet software downloaded from anywhere other than the official site. The discount is the bait; the device is the leak.

Red Flags: How to Spot a Crypto Scam Before You Send Money

The scams above look different, but they share a DNA. Before you send funds, connect a wallet, or sign anything, run this checklist. If even one item is true, stop and verify independently — you have sixty seconds, and the scam dies in those sixty seconds.

• The domain is one character different from the official one — or you got there by clicking, not bookmarking.
• Fixed or guaranteed returns are promised: “2% daily,” “no downside,” “risk-free.”
• Your profit is visible only inside the platform the other party gave you.
• You must deposit before you can withdraw, pay a “tax,” or pay a “verification fee.”
• A “support agent” or “friend” contacted you first, out of the blue.
• Anyone is asking for your seed phrase or private key. No one legitimate ever does.
• The token’s contract is unverified, or the top wallets hold the majority of supply.
• The “giveaway” requires a deposit, a gas payment, or KYC money up front.
• The address you are pasting does not exactly match your saved, verified entry.
• The offer expires in minutes or hours. Urgency is the scammer’s primary tool.
• The team is anonymous, has no track record, and the website was registered weeks ago.
• You cannot find a single independent review from a source the project does not pay.

Crypto Scam Types: Comparison Table

Scam Type	Typical Victim Loss	Key Warning Sign	Best Defense
Phishing / fake exchange	Everything in the account	Domain one character off	Bookmarks only, verify domain
Rug pull	100% of position	Top wallets hold 50%+ of supply	Check supply + liquidity locks
Wallet drainer	Approved tokens, often everything	Unlimited approval to unknown contract	Read every signature, revoke approvals
Address poisoning	Partial (the poisoned share)	Small deposit from lookalike address	Verified address book, check first/last 4 chars
Pig butchering	Full investment, often 6 figures	Profits visible only in their app	Never trade on a platform a stranger controls
Celebrity giveaway	The “verification” deposit	Deposit required to claim	Deposit-required claims = scam, always
Fake support DM	Full wallet via “fix”	They contacted you first	Support only via official channels
Fake airdrop / dusting	Varies, via drainer or poisoning	Unsolicited claim link	Ignore unsolicited claims, never sign blind
Malware / fake hardware wallet	Full wallet, repeatedly	Off-channel download or discounted device	Official sources only, manufacturer-direct hardware

Sources: Chainalysis Crypto Crime Report 2025, FBI IC3 Internet Crime Complaint Center, FTC consumer scam data, and on-chain incident analysis.

How to Protect Your Crypto: 10-Step Defense Checklist

Defense against all nine scam types above collapses into a short list of habits. We recommend applying every step, in this order, to every wallet you control:

1. Bookmark every site before you need it. Visit each exchange and protocol directly, verify the domain against its official social accounts, and save a bookmark. Use only bookmarks from that day forward — never search results, never links in DMs or comments.
2. Turn on app-based 2FA everywhere. Authenticator apps beat SMS codes, which can be intercepted. Enable it on every exchange account and every protocol that offers it.
3. Keep a verified address book. Save the address of anyone you pay or receive from, and re-verify the first and last four characters before every transfer. Never paste from transaction history — that is where poisoning strikes.
4. Move serious holdings to cold storage. If a wallet holds more than you can comfortably afford to lose, it should be on a hardware wallet. Our Best Hardware Wallets 2026 guide compares the current field; the two we buy for most people are the Ledger Nano X and the Trezor Safe 5 — both purchased only from the manufacturers’ own stores.
5. Revoke token approvals on a schedule. Once a month, review the approvals in your wallet and revoke anything you do not recognize. It takes five minutes and is the single best drainer countermeasure available.
6. Back up your seed phrase properly. Offline, physical, in two locations — and never in a screenshot, a notes app, or a photo. See our How to Back Up Your Crypto Seed Phrase in 2026 guide for the exact method.
7. Read every transaction before you sign. Use a transaction decoder so you can see, in plain language, what a signature actually does. If a “claim” is secretly granting an unlimited allowance, the decoder shows it in one line.
8. Download software from official sources only. Wallet extensions from browser official stores linked from the project’s own site; apps from official app stores; and no “airdrop claimer” executables, ever.
9. Treat all inbound contact as hostile. No support DMs, no “friend” investment tips from new contacts, no phone calls about your account. Verify through channels you control.
10. Institute a 24-hour cooling-off rule for size. Any transfer above a threshold you set in advance sleeps for a day. Every pig-butchering victim we studied lost the money in a window of high emotion and low sleep. The rule is boring, and it works.

What to Do If You Have Already Been Scammed

If the funds are already gone, the goal shifts from prevention to damage control and, where possible, recovery. Work these steps in order:

1. Stop all further transfers. Scammers almost always follow a first loss with a “pay a verification fee to unlock your funds” demand. That fee is a second, smaller scam. Do not pay it.
2. Document everything. Screenshots of the site, the address you sent to, timestamps, every message with the scammer, and your own wallet’s transaction hash. This is what makes a report actionable.
3. File reports with the authorities. In the US, file with the FBI’s IC3 and the FTC. If the funds landed on a centralized exchange, report to that exchange’s security team immediately — exchanges can and do freeze incoming scam funds, but only when they are told, and only quickly.
4. Trace the funds — but know the limits. Every crypto transaction is publicly traceable on-chain. If the money moved to a CEX, a report with the transaction hash is your best chance of a freeze. If it moved through mixers or was bridged off-chain, recovery chances drop sharply. Do not pay anyone who claims they can “track” it for a fee.
5. Contain the wallet. If a wallet was compromised (phishing, drainer, malware), move any remaining assets to a fresh wallet with a new seed phrase, then treat the old wallet as burned. Reset passwords and 2FA for every account that touched it.
6. Watch for the recovery-scam wave. Within days of your loss, “recovery services,” “hackers,” and fake lawyers will contact you, often on the very platforms where you were scammed. They are running the same scam against you a second time. No third party can recover crypto that has already moved to a stranger’s wallet — anyone promising guaranteed recovery is lying.

FAQ: Crypto Scams

Can I get my money back after a crypto scam?

Sometimes, and only in narrow circumstances. If the stolen funds landed on a centralized exchange and you (or a law-enforcement report) flag the deposit quickly, the exchange may freeze it and return it. If the funds were moved through mixers, bridges, or directly to another self-custody wallet, recovery is generally not possible for individuals. Filing with IC3, the FTC, and the receiving exchange is still worth doing — it is the only path that has worked in documented cases.

Is it ever safe to share my seed phrase with anyone?

No. There is no legitimate circumstance in which an exchange, a support agent, a “recovery service,” or a friend needs your seed phrase. It is the master key to your funds, full stop. Anyone who asks for it is either a scammer or, at best, catastrophically reckless.

How do I verify that an exchange or token site is legitimate?

Three checks, in order: (1) confirm the exact domain from the project’s verified social account — not from a search result; (2) check how long the domain has existed and whether it appears in any independent coverage; (3) look for a real company footprint — registered entity, named team, audited financials where applicable. If any of the three fails, treat the site as hostile.

How does address poisoning actually work?

The attacker’s bot sends you a tiny transfer from an address that mimics one in your history — usually changing the first character, which you stop scrutinizing. When you later send a payment and paste from your transaction history, part of it routes to the attacker. Prevention is mechanical: keep a separate verified address book, never paste from history, and confirm the first and last four characters of every destination.

Do hardware wallets protect me from phishing?

They protect you from a large class of attacks — your seed phrase never touches an internet-connected device, so keyloggers and fake login pages cannot steal it. But a hardware wallet cannot stop you from reviewing and approving a malicious transaction on the device itself. The signature is still yours to give. Pair the hardware wallet with a transaction decoder and the 60-second verification habit, and the combined defense covers almost every scam in this guide.

#CryptoScams #CryptoSecurity #ScamAlert #Phishing #RugPull #AddressPoisoning #WalletSecurity #CryptoSafety #DeFi #Blockchain #CryptoEducation #SelfCustody #SeedPhrase #HardwareWallet #CryptoTips