How to Identify and Avoid Crypto Scams

Crypto scams cost victims over $14 billion in 2021 and $3.8 billion in 2022 (a decrease due to the bear market reducing targets, not reduced sophistication). The FBI's 2023 Internet Crime Report identified crypto fraud as the fastest-growing form of investment fraud, with losses over $5.6 billion — 45% more than 2022.

Why crypto scams are uniquely effective: - Irreversibility: Unlike credit card fraud, blockchain transactions cannot be reversed. Once funds are sent, they're gone permanently. - Pseudonymity: Attackers are difficult to identify and prosecute across international jurisdictions. - Complexity: Most victims don't fully understand crypto technology, making deception easier. - Greed amplification: Promises of extraordinary returns (10×, 100×) override skepticism in ways that traditional investment fraud cannot match. - FOMO: "You'll miss this opportunity" pressure tactics work especially well during bull markets when everyone sees real examples of life-changing gains.

Who gets scammed: Not just inexperienced users. Sophisticated individuals including engineers, lawyers, and finance professionals have been successfully scammed. Attackers are professional con artists with extensive psychological manipulation training.

Phishing attacks impersonate legitimate services to steal credentials, private keys, or seed phrases.

Website phishing: - Fake exchange/wallet sites with nearly identical domain names: "bìnance.com" (using a Unicode character), "ledger-support.net", "metamask-wallet.io" - Search ads: Scammers pay Google to show fake sites above the real ones. Search "MetaMask download" and the first result may be a scam. - Malicious bookmarks: Someone physically accesses your computer and replaces exchange bookmarks with phishing sites

Email/SMS phishing: - "Your account has been suspended — verify immediately" - "Unusual login detected from Nigeria — click to secure your account" - Fake customer support emails from "support@binance-help.com" (note: not binance.com) - These create urgency to make you act before thinking

How to protect yourself: 1. Bookmark official sites (binance.com, coinbase.com, ledger.com) and only use those bookmarks — never Google for exchange sites 2. Check the URL bar before entering any credentials — the domain must be exactly correct 3. Enable anti-phishing codes: Binance, OKX, and others let you set a personal phrase that appears in all real emails from them. If your phrase isn't there, it's a fake. 4. Use a hardware security key (YubiKey) for 2FA — immune to phishing because it verifies the domain 5. SMS 2FA is weak — SIM-swapping attacks defeat it. Use authenticator apps or hardware keys.

A rug pull is when project developers suddenly withdraw all liquidity from a token, crashing its price to zero while keeping investor funds.

How rug pulls work: 1. Developers launch a new token with attractive tokenomics and a professional-looking website 2. They add liquidity to a DEX (Uniswap, PancakeSwap) — small initial liquidity pool 3. Social media marketing creates FOMO: "100× moonshot," "exclusive early access" 4. Investors buy the token, pushing the price up (price discovery on low liquidity) 5. Developers remove all liquidity in a single transaction — the token price crashes to $0 6. They walk away with the ETH/BNB from the liquidity pool

Hard rug pull vs soft rug pull: - Hard rug: Developers actively steal — withdrawing LP, minting unlimited tokens, or using a hidden admin function - Soft rug pull: Developers gradually sell their tokens, abandon the project, and ghost the community — "slow bleed"

Red flags for rug pulls: - Anonymous team with no verifiable identities or LinkedIn profiles - Unaudited smart contract (or audit from unknown/paid-for audit firm) - Contract has admin functions like "pause," "blacklist," or "set max wallet" with no timelock - Large portion of supply held by a few wallets (check on Etherscan token holders) - No liquidity lock (use DexTools or Team.Finance to verify LP lock) - Unrealistic promises: "10,000% APY guaranteed," "100× in 30 days" - Pressure tactics: "Whitelist closes in 2 hours" - No clear, verifiable use case for the token

The most sophisticated and destructive scams operate through personal relationships — making them psychologically devastating in addition to financially ruinous.

Pig butchering scams (sha zhu pan): Originally developed in Southeast Asia (often operated by trafficked workers in scam compounds in Cambodia, Myanmar, Thailand). The name refers to "fattening a pig before slaughter."

1. Scammer contacts victim via dating app, WhatsApp, LinkedIn, or wrong number ("oh sorry, meant to text someone else!")
2. Builds a relationship over weeks or months — romantic interest, friendship, or investment mentoring
3. Introduces a "proven crypto investment platform" — often a fake exchange with professional UI
4. Victim makes small investments that show huge returns on the fake platform
5. Victim withdraws small amounts successfully (to build trust)
6. Victim is encouraged to invest larger amounts — life savings, retirement funds, borrowed money
7. When victim tries to withdraw large sums, they're asked to pay "taxes," "fees," or "insurance" first
8. Eventually, all communication stops — the victim loses everything

US losses from pig butchering in 2023: $4.4 billion (FBI estimate). Average victim loss: $120,000. Victims are often educated, financially sophisticated people — the manipulation is that effective.

Rule: Anyone who contacts you out of nowhere about crypto investment opportunities is a scammer. No exceptions. The legitimate investment opportunity doesn't need to find you via a dating app or wrong number.

Before investing in any crypto project, run through this checklist:

🔴 AUTOMATIC DISQUALIFIERS (walk away immediately): - Guaranteed returns or "risk-free" investment claims - "Send crypto to receive double back" (no legitimate entity does this) - Someone contacts you first with an investment opportunity - Asked to pay "taxes" or "fees" to withdraw your own money - Anonymous team, no LinkedIn profiles, no verifiable history - Contract not verified on Etherscan/BscScan

🟡 SERIOUS WARNING SIGNS (extensive due diligence required): - Team is semi-anonymous with only social media presence - Audit from an unknown firm (always verify the audit firm's reputation) - Less than 3 months of on-chain transaction history - Marketing-heavy with little technical substance - "Influencer" promotion (many are paid, undisclosed) - FDV/circulating market cap ratio > 10×

🟢 POSITIVE SIGNS (still not guarantees): - Doxxed team with verifiable professional histories - Multiple audits from reputable firms (OpenZeppelin, Trail of Bits, Certik, PeckShield) - Locked liquidity with timelock (minimum 12-24 months) - Active, transparent GitHub with genuine development activity - 1+ year of live protocol operation without hacks - Clear, limited utility for the token (not "governance + staking + payments + gaming + metaverse")

When in doubt: The Crypto Fear & Greed Index won't tell you if a project is a scam. Chainalysis, Nansen, or Token Sniffer can help analyze contract risks. Default to skepticism — no legitimate opportunity disappears if you take a week to research it.