Crypto scams stole over $3 billion from users in 2024. Most losses weren't from protocol hacks — they were from people being deceived. Understanding the playbooks makes you significantly harder to scam.
Rug Pull Detection
A rug pull is when developers abandon a project and drain liquidity after building hype and attracting buyers.
On-chain warning signs:
Liquidity not locked: Check if the LP tokens (liquidity pool) are locked via Team Finance, Unicrypt, or similar. Unlocked LP means the team can remove liquidity at any time. Look for "liquidity lock" in the project docs or check the contract address on Team Finance.
No contract verification: If the smart contract isn't verified on Etherscan or Basescan, you can't read the code. Avoid buying tokens from unverified contracts.
Mint function present: If the contract has an active mint function accessible to the owner, the team can create unlimited tokens and dump them. Read the contract's write functions on Etherscan.
Proxy contracts with upgradeable logic: A proxy contract lets the team swap in new code after launch. Legitimate uses exist, but combined with other red flags, it's dangerous.
Team wallet holds large %: If deployer wallets hold 30%+ of supply, any sell is catastrophic for price. Check the token holder distribution.
Social warning signs:
- Anonymous team with no verifiable history
- No GitHub with actual code history (just a repository created last week)
- Pressure tactics: "only 48 hours left," "whitelist closing soon"
- Celebrity endorsements without clear evidence (often fake)
- Telegram group flooded with bots (check join dates — masses of accounts joining on the same day)
Honeypot Tokens
A honeypot is a token you can buy but not sell. The contract has hidden code preventing sells, or charging 100% tax on sells.
How to detect:
Use Token Sniffer (tokensniffer.com) or Honeypot.is (honeypot.is) before buying any unknown token. These tools simulate a buy and sell transaction against the contract and flag if the sell would fail or incur unusual fees.
Red flags on Honeypot.is:
- "This token appears to be a honeypot"
- Sell tax > 10% (legitimate tokens occasionally have high buy taxes, but sell taxes above 10-15% are a red flag)
- Simulated sell returns 0 tokens
Also check: GoPlusLabs security scanner — pastes the contract address and returns a full risk report.
Fake Token Scams
Real projects (USDC, ETH, Uniswap) are frequently imitated with tokens that have identical names and similar symbols.
Always verify the contract address from the official project website, not from search results or social media. The address of the real USDC is different from a fake "USDC" token someone deployed.
Bookmark official contract addresses. Never use contract addresses from Telegram, Discord, or unsolicited DMs.
Social Engineering Attacks
"I made $50k using this signal bot" DMs: Fraudsters hack Twitter/Telegram accounts and message followers with fake profit screenshots. The "bot" requires a deposit that is immediately stolen.
Fake tech support: If you post in a Telegram/Discord that you're having trouble with a wallet, scammers impersonate official support and ask for your seed phrase. No legitimate support ever asks for your seed phrase.
"Approval" phishing: You connect your wallet to a site and sign a transaction — but instead of a swap, you're signing an approval for the site to drain all your tokens. Always read what you're signing. A legitimate swap shows token amounts; a malicious signature says "approve unlimited spending."
Pig butchering: Long con where a fake romantic/business relationship is built over weeks before the "investment opportunity" is introduced. Billions lost annually. If someone you met online steers you toward a crypto investment platform you've never heard of — it's a scam.
Wallet Safety Checklist
- Never share your seed phrase — with anyone, ever, including "support"
- Use a hardware wallet for significant holdings — Ledger or Trezor
- Use a separate hot wallet for DeFi interactions — never connect your main holdings wallet to unknown sites
- Revoke approvals regularly — use revoke.cash to see and revoke token approvals given to contracts
- Verify contract addresses from official sources before buying
- Run Token Sniffer on any token not listed on major exchanges
- Read what you're signing — MetaMask shows the function being called; if it says "setApprovalForAll" on an NFT contract unexpectedly, reject it
If You've Been Scammed
Unfortunately, most crypto transactions are irreversible. Steps to take:
- Immediately revoke any active approvals the scam contract has
- Move remaining assets to a new wallet (assume the compromised wallet's approvals may still be exploitable)
- Report to the platform where you were contacted (Twitter, Telegram)
- File a report with the FBI IC3 (ic3.gov) — required for any insurance or legal action
- Report to Chainalysis or on-chain investigation firms if amounts are large enough to pursue
Prevention is the only reliable protection. The blockchain doesn't have a fraud department.