Top 19 Crypto Scams – How to Avoid these and help others by spotting and reporting these cryptocurrency scams

Phishing Scams

1. Phishing on Social Media and Search Engines

   • Twitter: Highly skilled hackers use AI to create fake Twitter pages that mimic real ones, including posts and comments. These accounts often have verified badges and subtly altered names. There are several strategies, the ads approach, commenting under an official post or directly to a follower that asks a specific type of question. So double check their profile names against the real one. Because the last thing we want to do is click on links in these posts that will lead us to sites where connecting your wallet results in losing your crypto assets.
   • Telegram: Scammers are watching all the projects channels, looking for folks in need of help. They mimic project mods accounts, even the founders and DM followers in the hopes of learning something sensitive that they can exploit. We recommend creating folders and using them, so you miss random DMs.
   • Discord: Scammers disguise malicious links to look normal. Always verify links in the address bar and cross-check with official sources. Even from the team, as Discord servers get compromised all the time, in 2022 over 700 servers were hacked and sent fake links to the community as “team” members. So triple checking in multi channels is important.
   • Google Search: Scammers buy ads on Google, making their fake sites appear at the top of search results. These ads can lead to phishing sites that look like legitimate crypto services. We recommend never clicking on ads in Google search results, you want to look for the actual page.

   Countermeasures:

   • Never click on links from unsolicited messages or ads.
   • Double-check URLs and use official channels to verify information.
   • Use browser extensions that block malicious sites and provide phishing alerts.
   • Avoid clicking on Ads on Twitter/X and Google
   • In Telegram use Folders, organize who you follow into different folders

   Keys to Identifying Threats:

   • Look for subtle changes in URLs or usernames.
   • Double check the accounts name, its spelling matters
   • erify account authenticity by checking for inconsistencies.
   • Use official websites and sources for accessing services.

2. Email Scams

   • Scammers send fake emails to collect private data from users, often impersonating trusted entities to gain access to sensitive information like private keys.

   Countermeasures:

   • Verify the sender’s email address.
   • Avoid clicking on links or downloading attachments from unknown senders.
   • Use email security features like spam filters and two-factor authentication.

   Keys to Identifying Threats:

   • Look for grammatical errors and unusual email addresses.
   • Verify suspicious emails through official channels.
   • Avoid providing personal information through email links.

3. Fake Support Teams

   • Scammers pretend to be support teams from companies like MetaMask on social media platforms, aiming to access private and sensitive information like crypto wallet keys.

   Countermeasures:

   • Contact support only through official channels.
   • Never share private keys or passwords with anyone.
   • Verify the identity of support personnel through multiple channels.

   Keys to Identifying Threats:

   • Be cautious of unsolicited support messages.
   • Verify support requests through the company’s official website.
   • Avoid engaging with support personnel on unofficial platforms.

Malware and Software Scams

4. Downloading Files or Software

   • Downloading a file, game, or software from untrusted sources can be disastrous. Modern viruses are sophisticated and can drain your crypto assets once installed.

   Countermeasures:

   • Use reputable antivirus software.
   • Avoid downloading files from unknown or suspicious sources.
   • Regularly update your software and security patches.

   Keys to Identifying Threats:

   • Be wary of too-good-to-be-true offers for free software.
   • Check reviews and ratings of the source website.
   • Use security tools to scan downloads before opening them.

5. Clipboard Hijacking

   • Malware that monitors your clipboard can replace copied crypto addresses with attackers’ addresses.

   Countermeasures:

   • Verify addresses before sending transactions.
   • Use anti-malware software.

   Keys to Identifying Threats:

   • Notice any unexpected changes in copied data.
   • Use security software to detect and prevent clipboard hijacking.

Social Engineering and Psychological Scams

6. Requests for Seed Phrases or Private Keys

   • Never share your seed phrase or private key. Scammers might request these through fake websites, software, or phishing attacks.

   Countermeasures:

   • Keep your seed phrase and private keys secure and offline.
   • Use hardware wallets for added security.
   • Educate yourself about safe crypto practices.

   Keys to Identifying Threats:

   • Recognize that no legitimate service will ask for your private keys.
   • Avoid entering sensitive information on suspicious sites.
   • Verify any requests through multiple official channels.

7. Social Engineering

   • Scammers use psychological tactics to trick you into believing in a fake site, program, or person.

   Countermeasures:

   • Always be skeptical and verify the legitimacy of any offer or request.
   • Don’t fall for emotional manipulation or urgency tactics.
   • Educate yourself on common social engineering techniques.

   Keys to Identifying Threats:

   • Recognize and resist pressure tactics.
   • Verify requests through multiple channels.
   • Be cautious of unsolicited messages and offers.

Token and Investment Scams

8. Scam Token Airdrops

   • Scam tokens can trigger smart contracts that drain your wallet or direct you to scam sites.

   Countermeasures:

   • Ignore unsolicited tokens and never engage with them.
   • Use wallet settings to hide unwanted tokens.
   • Verify any airdrop details through trusted sources.

   Keys to Identifying Threats:

   • Question the legitimacy of unsolicited airdrops.
   • Cross-check airdrop announcements with official project communications.
   • Avoid interacting with unknown tokens.

9. Fake Tokens

   • Always verify the smart contract address of any token you are dealing with. Fake tokens can appear identical to real ones but are worthless.

   Countermeasures:

   • Use trusted platforms like Etherscan or CoinGecko to verify token contracts.
   • Avoid trading tokens with unknown or suspicious origins.
   • Research token projects thoroughly before investing.

   Keys to Identifying Threats:

   • Look for inconsistencies in token contract addresses.
   • Use official project websites and trusted resources for information.
   • Avoid newly created tokens without a clear and legitimate history.

10. Cryptocurrency Scam Rug Pulls

    • Fraudulent projects amass investments before disappearing with all funds.

    Countermeasures:

    • Research projects thoroughly before investing.
    • Look for audits and community trust indicators.
    • Diversify investments to mitigate risks.

    Keys to Identifying Threats:

    • Be wary of projects with unrealistic promises.
    • Check for transparent development and community engagement.
    • Avoid investing in projects without clear use cases or roadmaps.

11. Ponzi, Pyramid, and MLM Schemes

    • These schemes focus on generating revenue by making new investors pay for compromised tokens with older investors, creating liquidity for them to exit.

    Countermeasures:

    • Research the project’s business model and revenue sources.
    • Avoid projects that emphasize recruitment over product or service value.
    • Look for regulatory warnings and legal issues associated with the project.

    Keys to Identifying Threats:

    • Be cautious of projects promising high returns with little risk.
    • Verify the legitimacy and transparency of the project’s operations.
    • Avoid schemes that require continuous recruitment to sustain.

Technical and Network Scams

12. Zero-Value Transactions

    • Scammers can send tiny transactions to your wallet with addresses that look similar to yours, hoping you’ll copy and send assets to their address by mistake.

    Countermeasures:

    • Always copy and paste addresses carefully.
    • Double-check every character before sending any transaction.
    • Use wallet address management tools to avoid errors.

    Keys to Identifying Threats:

    • Be vigilant about transaction details.
    • Use transaction tracking tools to monitor for suspicious activity.
    • Report and block suspicious addresses.

13. SIM Swapping Fraud

    • Attackers hijack phone numbers through SIM swaps, bypassing 2FA and accessing exchange accounts.

    Countermeasures:

    • Secure your phone number and consider using additional authentication methods.
    • Use apps and services that offer alternative 2FA methods like authentication apps or hardware tokens.

    Keys to Identifying Threats:

    • Monitor your phone account for unusual activity.
    • Use strong, unique passwords for online accounts.
    • Avoid sharing personal information that could aid in a SIM swap.

14. Man-in-the-Middle (MitM) Attacks

    • Public Wi-Fi networks can be exploited to redirect transactions to attackers’ wallets.

    Countermeasures:

    • Avoid using public Wi-Fi for sensitive transactions.
    • Use VPNs to secure your internet connection.
    • Verify transaction details carefully.

    Keys to Identifying Threats:

    • Be cautious of public Wi-Fi networks.
    • Monitor network connections for suspicious activity.
    • Use encryption to protect data transmissions.

15. Smart Contract Exploit Scammers

    • Vulnerabilities in smart contracts can lead to significant losses, as seen with the “ChainLock” DeFi platform exploit.

    Countermeasures:

    • Ensure smart contracts are audited before use.
    • Use trusted platforms and contracts with proven security records.
    • Stay updated on security practices and exploit reports.

    Keys to Identifying Threats:

    • Check for audit reports from reputable firms.
    • Monitor smart contract interactions for anomalies.
    • Stay informed about known vulnerabilities and exploits.

16. Replay Attacks

    • Attackers intercept and resend valid data transmissions, duplicating transactions.

    Countermeasures:

    • Implement replay protection and stay updated on network security patches.
    • Use secure communication channels.
    • Regularly update software and security protocols.

    Keys to Identifying Threats:

    • Be aware of network security alerts and updates.
    • Monitor transactions for unusual duplications.
    • Use security features provided by platforms and wallets.

Fake Platforms and Services

17. Cloned Websites

    • Scammers create cloned websites that look identical to legitimate ones, aiming to steal assets and private keys.

    Countermeasures:

    • Always type the URL directly into your browser.
    • Use bookmarks for frequently visited sites.
    • Look for security certificates and signs of legitimacy.

    Keys to Identifying Threats:

    • Verify site URLs and security indicators.
    • Avoid clicking on links from emails or messages.
    • Use browser extensions that detect cloned sites.

18. Cloud-Based Mining Scams

    • These scams ask people to sign contracts and invest in bitcoin or other major altcoin mining data centers, which are hard to verify.

    Countermeasures:

    • Research the company thoroughly before investing.
    • Look for reviews and independent analysis.
    • Verify the physical existence and legitimacy of the mining operation.

    Keys to Identifying Threats:

    • Be skeptical of high returns with minimal risk claims.
    • Check for regulatory registration and licenses.
    • Avoid companies that lack transparency about their operations.

19. Fake Exchanges

    • These appear out of nowhere and, after being active for a few months, mysteriously vanish with user funds.

    Countermeasures:

    • Use established and well-known exchanges.
    • Check for user reviews and regulatory compliance.
    • Verify the exchange’s track record and transparency.

    Keys to Identifying Threats:

    • Be cautious of new exchanges without a verifiable history.
    • Look for exchanges with strong security practices and user protections.
    • Avoid platforms that lack clear information about their team and location.