How to Spot a Crypto Scam: 8 Steps to Avoid Losing Funds

Crypto investment fraud generated $5.8 billion in reported losses in 2024, with nearly 150,000 digital-asset complaints filed and a 66% year-over-year rise in losses, according to the FBI’s IC3. Pig butchering revenue grew nearly 40% year over year in 2024, and high-yield investment schemes plus pig butchering accounted for over 80% of all funds lost by scam victims, per Chainalysis. The eight detection steps below cover the scam types behind those numbers, the universal red flags they share, and the free verification tools that confirm a project, contract, or counterparty before any wallet approval moves through.

Key Takeaways

• The FBI received nearly 150,000 complaints involving digital assets in 2024, totaling $9.3 billion in reported losses.
• Pig butchering scam revenue grew nearly 40% year over year in 2024, with deposits to scam wallets up nearly 210%, according to Chainalysis.
• The FTC logged $5.7 billion in investment-scam losses in 2024 (a 24% increase over 2023), the top loss category, with cryptocurrency named in $1.4 billion of payments.
• Operation Level Up notified 8,103 crypto-fraud victims as of the FBI’s 2024 update; 77% had no idea they were being scammed.
• “Recovery services” that contact prior victims are themselves a documented FBI fraud pattern, often impersonating law firms or government agencies.
• Five free on-chain checks (Etherscan verification, holder distribution, liquidity lock, Revoke.cash, Scam Sniffer) catch the majority of token and dApp scams before signing.
• Reporting channels are ic3.gov for FBI cyber crime and reportfraud.ftc.gov for FTC consumer fraud; both are free and accept anonymous detail.

Step 1: Recognize the Six Most Common Crypto Scam Types

Six scam categories drive most reported losses: rug pulls, phishing and wallet drainers, Ponzi/high-yield investment programs, pig butchering, fake exchanges, and impersonation. The FBI’s IC3 unit logged $5.8 billion in crypto investment fraud in 2024, alongside nearly 150,000 digital-asset complaints. Pig butchering and high-yield schemes accounted for over 80% of victim losses, with deposits up nearly 210% year over year, per Chainalysis. Knowing the playbook for each makes the warning signs far easier to read.

• Rug pulls and exit scams: Token developers raise liquidity, hype the project, then drain the pool and disappear. Often paired with anonymous teams and unverified contracts. See the latest rug pull statistics for incident counts and average losses.
• Phishing and wallet drainers: Fake mint pages, airdrop sites, and dApp clones harvest signatures that authorise asset transfers. Detailed numbers sit in CoinLaw’s phishing and wallet drainer data.
• Ponzi and high-yield investment programs (HYIP): Promised returns of 1% per day, 20% per month, or “guaranteed” yields. New deposits pay old withdrawals until the scheme collapses.
• Pig butchering (sha zhu pan): Long-form social engineering combining romance, friendship, or career pretence with a fake investment platform. Now the largest single scam category by revenue with nearly 40% year-over-year revenue growth in 2024, per Chainalysis.
• Fake exchanges and apps: Cloned interfaces of Coinbase, Binance, or Kraken that accept deposits but block withdrawals, or app-store listings that mimic real wallets.
• Impersonation scams: Fake support staff, fake Elon Musk and MrBeast endorsements, deepfake video calls, and fake “lawyers” promising recovery of previously stolen funds.

Cloud mining contracts and address-poisoning attacks form a second tier worth knowing too. CoinLaw’s cloud mining scam data document patterns in detail.

Step 2: Spot the Universal Red Flags Before You Send Funds

Six red flags appear across nearly every scam category, and the FBI’s IC3 cryptocurrency-fraud resource lists them as the most reliable warning signals. Any single flag is enough to pause; two or more should end the conversation. The list is worth memorising before any unsolicited approach turns into a wallet transaction.

Source: FBI IC3 2024 Internet Crime Report, FTC Consumer Sentinel Network 2024 Data Book

The FTC noted that consumers reported losing over $12.5 billion to fraud in 2024, and bank transfers and cryptocurrency together accounted for more fraud-loss dollars than every other payment method combined. That single statistic explains why scammers steer victims toward crypto rails: the transactions are fast, irreversible, and easy to route through mixers. Treat any unsolicited request to pay in crypto as a default red flag, regardless of how legitimate the surrounding pitch sounds.

Step 3: Detect Pig Butchering Scripts in Real Time

Pig butchering follows a predictable script across platforms, and recognising the opening lines is the fastest way to disengage before any money moves. Chainalysis tracked nearly 40% year-over-year revenue growth in 2024 and a 210% jump in deposits, making it the highest-revenue scam category in crypto. The patterns below come from FBI advisories, Operation Level Up case files, and CoinLaw’s pig butchering scam statistics coverage.

The four most common opening scripts:

1. The “wrong number” text: An unsolicited message reads “Hi James, are we still on for dinner Friday?” or “Sarah, the meeting moved to 3 pm.” When the recipient corrects them, the sender apologises, expresses interest in friendship, and pivots to messaging within days.
2. The dating-app match: A profile with one or two professional photos, vague job description (“crypto investor”, “import-export”), and a quick offer to move to WhatsApp or Telegram. Within a week, the conversation turns to investment platforms or “my uncle’s trading signal”.
3. The LinkedIn career pivot: A connection request from a recruiter or executive at a believable firm, followed by a casual conversation about side income, mentorship, or a “private investment club”.
4. The Telegram or Discord group invite: Unsolicited add to a “VIP signals” channel showing fake screenshots of trading wins, with a moderator who privately offers help getting started.

The platform pivot pattern: Almost every variant begins on a public platform and moves to encrypted messaging within a week. The FBI’s 2024 IC3 advisory on exchange impersonation describes the same pattern when scammers pose as exchange support: initial contact often shifts to WhatsApp or Telegram from a different phone number than the one used originally.

Pro tip, the screenshot test: If a contact sends you a screenshot of a “trading platform” balance, search the platform name plus the words “scam” or “review” on a separate device. Scam platforms rarely have older than six months of search history, and the few results that exist are often complaints. Real platforms have years of independent review coverage.

The behavioural arc is also predictable. Weeks of low-pressure conversation, then a small “investment” with a fake withdrawal that does work (to build trust), then a much larger deposit that cannot be withdrawn until “tax” or “verification fees” are paid. Each fee request is the exit point: at no point are the funds recoverable. Operation Level Up data shows 77% of contacted victims did not realise they were being scammed at the time the FBI reached out.

Don't chase the news. Let us curate it.

You get one weekly briefing with only the stories that matter. If the market is quiet, we skip it.

Email address

Get the Weekly Briefing - it's free!

✅ Join readers from Visa, Vanguard, and the FDIC.

Step 4: Verify a Smart Contract Before Approving It

Five free on-chain checks catch the majority of token and dApp scams before any wallet signature is given. None requires coding skills. Each takes under two minutes, and running all five before a swap, mint, or token approval is the single most effective habit a self-custody user can build. The walkthrough below uses Ethereum as the example; the same checks work on Solana (Solscan), BNB Chain (BscScan), and other major chains.

1. Verify the contract source code on Etherscan

Open Etherscan, paste the token or dApp contract address, and click the Contract tab. A green checkmark next to “Contract Source Code Verified” means the deployed bytecode matches the published Solidity source. An unverified contract is not automatically a scam, but for any token with active marketing, verification is standard. Skip unverified contracts unless the team is doxxed and the project is widely covered.

2. Check holder distribution

Inside Etherscan’s Holders tab, look at the top 10 wallet percentages. A healthy token typically shows liquidity-pool addresses, exchange wallets, and dispersed holders. If a single non-LP, non-exchange wallet holds 30% or more of the supply, the project carries concentration risk: that wallet can dump the token at any moment.

3. Confirm liquidity is locked or burned

For DEX-traded tokens, locked or burned liquidity is the structural defence against rug pulls. Tools like Token Sniffer (tokensniffer.com) and De.Fi Shield (de.fi/scanner) parses this automatically and displays it as “LP locked” or “LP burned” with the lock duration. If liquidity is unlocked and the deployer wallet still holds the LP tokens, the project has no technical barrier to a rug.

4. Review existing approvals on Revoke.cash

Revoke.cash (revoke.cash) connects to a wallet read-only and lists every active token approval. Old, unlimited approvals to forgotten dApps are the most common drainer vector: scam sites often replay them weeks or months after a phishing victim signs. Revoking unused approvals costs gas but eliminates the most common wallet-drainer attack surface.

5. Cross-check the URL on Scam Sniffer

Scam Sniffer (scamsniffer.io) maintains a database of confirmed phishing and drainer sites. Pasting a URL or contract address before connecting a wallet adds a final filter. The same site offers a free browser extension that flashes warnings on known malicious domains in real time.

By the numbers: Phishing and wallet-drainer incidents account for a substantial share of preventable crypto losses each year, with confirmed-malicious URL databases like Scam Sniffer cataloguing thousands of unique scam domains. Most reported losses trace back to a wallet approval given on a spoofed dApp page that an on-chain check would have flagged in under a minute.

A sixth check worth running on any unfamiliar token: GoPlus Security (gopluslabs.io). The free token-risk dashboard flags honeypot patterns, hidden mint functions, transfer-tax traps, and blacklist mechanics. None of these tools is infallible, and combining them helps reduce risk rather than guaranteeing safety.

Step 5: Confirm an Exchange or App Is Legitimate

Verifying an exchange before depositing takes four checks: domain age, SSL/spoofing, regulatory registration, and app-store provenance. The FBI’s 2024 PSA on impersonation (PSA 240801) describes how scammers spin up convincing exchange clones in days, accept deposits, then refuse withdrawals once balances cross a threshold. Treating every new platform as suspect until each check clears is the cheapest insurance available.

• Domain age and history: Use a free WHOIS lookup. Real exchanges have multi-year histories; scam clones often show registration within the past 90 days.
• URL spelling and homoglyphs: binance.com vs binаnce.com (Cyrillic ‘а’), coinbase.com vs coinbose.com. Scam Sniffer and the browser address bar should be cross-checked. Bookmark the real URL and use the bookmark every time.
• Regulatory registration: US exchanges should be FinCEN-registered as money services businesses; UK exchanges should be on the FCA register; EU exchanges should be MiCA-licensed by mid-2025. A platform that cannot produce a registration number on request is a red flag in itself.
• App-store provenance: Apple App Store and Google Play allow developer impersonation slip-throughs. Check the developer name, review count, and review history. New apps with high ratings and few reviews are common scam patterns. Confirm the app via the exchange’s official website link rather than searching the store directly.

Pro tip: Treat any DM, email, or call claiming to be exchange “support” as fraudulent by default. The FBI’s 2024 advisory documented that scammers impersonating exchanges typically ask victims to move funds to “secure wallets” they control. Real exchange support never asks for a seed phrase, never directs withdrawals, and never moves communication to WhatsApp or Telegram.

Step 6: Spot Phishing Sites and Wallet Drainers

Phishing sites mimic real dApps; wallet drainers harvest the signatures those sites request. Three habits cut most of the risk: scrutinise URLs before connecting, read every wallet prompt before signing, and confirm transactions on a hardware-wallet display where possible. Phishing-and-drainer activity continues to grow each year, with confirmed-malicious URL databases cataloguing thousands of unique scam domains.

URL-level checks:

1. The official URL is the only safe URL. Bookmark it. Do not click ads at the top of search results: sponsored phishing of crypto domains is a documented Google Ads abuse vector.
2. Look for “https://” and the exact domain spelling. Drainers commonly register typo-squat variants (uniswap-v3.org vs app.uniswap.org).
3. Hover over links in Discord, Twitter, and Telegram before clicking. Most clients show the underlying URL.

Signature-level checks:

1. Read the function name and parameters in every wallet prompt. setApprovalForAll to an unknown contract is the single most dangerous signature in crypto.
2. For any transaction signing more than the gas amount, treat it as a withdrawal authorisation. If unsure, reject it.
3. Hardware wallets (Ledger, Trezor, GridPlus) display the receiving address on the device screen. Always verify the on-screen address matches the intended recipient before approving: clipboard-hijacker malware swaps addresses silently on host computers.

A specific pattern worth knowing: address-poisoning attacks send tiny dust transactions from a wallet whose first and last characters match a frequently used recipient. The next time the user copies the recipient address from transaction history, they may grab the attacker’s address instead. The defence is simple but unforgiving: always copy from a contact book, never from history.

Step 7: Identify Impersonation Scams

Impersonation scams now cover three high-loss patterns: fake exchange support, deepfake celebrity endorsements, and fake recovery services targeting prior victims. The FBI’s PSA 240624 describes the recovery-scam pattern in detail and lists the specific tells that distinguish these operators from legitimate communications. None of these patterns requires sophisticated security knowledge to detect; they require a default posture of “verify before trusting”.

Source: FBI IC3 2024 Public Service Announcements

Fake support staff: Real support never DMs first, never asks for a seed phrase, and never instructs fund movement. The FBI’s PSA 240801 documents scammers using spoofed phone numbers and pivoting communication to WhatsApp once contact is established. If a “support agent” reaches out unprompted, close the channel and contact the exchange through its official website only.

Deepfake celebrity endorsements: AI-generated videos of Elon Musk, Vitalik Buterin, MrBeast, and others promote fake “giveaways” or “doubling” schemes. The pattern is identical across years: send 1 ETH, receive 2 back. No verified figure has ever run such a scheme. Real announcements appear on verified accounts and official press channels, not in YouTube live-stream chat or Twitter Spaces ad slots.

Recovery scams (the second-stage trap): The FBI’s PSA 240624 specifically warns about fictitious law firms targeting prior scam victims. These operators claim affiliation with the FBI, CFPB, or other government agencies, request bank credentials or upfront fees, and promise to recover lost crypto. Law enforcement explicitly never charges fees to investigate crimes. Any “recovery service” that asks for payment, banking details, or wallet seed information is itself a scam, full stop. CoinLaw’s crypto scam recovery success rates page documents the low realistic recovery numbers.

A SIM-swap variant also targets exchange accounts: attackers port a victim’s mobile number to a controlled SIM, then use SMS-based two-factor codes to gain access. Hardware-key 2FA (YubiKey, Google Titan) is materially more secure than SMS for any account holding meaningful crypto. Background detail sits in CoinLaw’s SIM swapping attack data.

Step 8: What to Do If You Think You’ve Been Scammed

Five immediate actions matter when a scam is suspected: stop sending, document, freeze where possible, report to authorities, and ignore “recovery” outreach. The FBI’s Operation Level Up reduced losses by over $500 million by reaching victims mid-scam. Most outcomes after that point are damage control rather than recovery.

1. Stop sending funds immediately. Every fee, tax, or “verification” request after a withdrawal is denied is part of the same scam. Paying does not unlock the original deposit.
2. Document everything. Wallet addresses, transaction hashes, screenshots of conversations, fake-platform URLs, phone numbers, usernames. Save the data on a separate device. This evidence is what investigators need.
3. Freeze where possible. If funds were sent from a CEX, contact the exchange’s compliance or security team within hours. Some incoming addresses on receiving exchanges can be frozen if reported quickly enough.
4. Report to law enforcement. US victims should file with the FBI’s Internet Crime Complaint Center at ic3.gov and the FTC at reportfraud.ftc.gov. Both are free. Non-US victims should file with the local cybercrime unit and Interpol’s Cybercrime Directorate where applicable.
5. Ignore unsolicited “recovery” offers. Per FBI PSA 240624, fictitious law firms, fake government agents, and “blockchain investigators” target prior victims for second-stage fraud. No legitimate operator asks for upfront fees to recover crypto. Block the contact.

Key finding: Operation Level Up notified over 8,000 active crypto-fraud victims in 2024, and 77% had no idea they were being scammed at the time of contact, according to the FBI. The initiative reduced ongoing losses by more than $500 million. Mid-scam recognition is the most valuable defensive moment a victim has.

Recovery realism matters here. Across our coverage of crypto fraud, the pattern we’ve documented is consistent: enforcement and asset seizures recover a small fraction of stolen funds, often years after the original event, and only when scammers route through traceable on-ramps. Self-custody losses sent to mixer addresses are rarely recovered at all. Treat the deposit as gone the moment it leaves the wallet, and budget accordingly when reporting.

Verification Tool Reference

Source: Project documentation pages, audited by CoinLaw editorial as of April 2026

No single tool catches every scam pattern. Running two or three checks across different vendors helps reduce risk further than relying on one. None of these tools is a substitute for the basic posture below: never approve a transaction without reading the function call, never share a seed phrase, and never trust unsolicited contact.

Common Pitfalls to Avoid

• Trusting screenshots: A fake-platform balance screenshot is a marketing asset, not proof of funds. Look up the platform name independently.
• Reusing seed phrases: One compromised dApp can drain every wallet derived from a single seed. Use a separate wallet for high-risk experimentation.
• Approving unlimited spend: Many dApps default to unlimited token approvals. Set a finite cap or revoke after each session.
• Skipping the hardware wallet: Software wallets are vulnerable to clipboard hijackers and browser-extension malware. Hardware wallets verify recipient addresses on a screen that the host computer cannot tamper with.
• Believing recovery promises: Per FBI advisories, every “fund recovery” service that demands upfront payment is itself fraudulent.

Frequently Asked Questions (FAQs)

Conclusion

The $5.8 billion crypto-fraud loss figure from the FBI’s 2024 IC3 report (alongside nearly 150,000 digital-asset complaints) sets a clear baseline: crypto scams are large, growing, and concentrated in a handful of repeatable patterns. The eight steps above (recognising scam types, reading universal red flags, detecting pig butchering scripts, running on-chain verification, confirming exchange legitimacy, spotting phishing and drainers, identifying impersonation, and knowing the response playbook) cover the categories behind those losses. The free verification tools listed (Etherscan, Token Sniffer, De.Fi Shield, GoPlus, Revoke.cash, Scam Sniffer) are the same ones professional analysts use, and they each take under two minutes to run.

Across our coverage of crypto fraud at CoinLaw, the pattern is consistent: detection beats recovery by an order of magnitude. Operation Level Up’s data showing 77% of contacted victims unaware of the scam tells us mid-scam recognition is where most of the savings actually happen. Readers who internalise the red flags, build the habit of cross-checking before signing, and treat every unsolicited contact as suspect catch the bulk of the patterns documented across CoinLaw’s crypto security and fraud statistics coverage. The scam playbook will keep evolving (deepfakes, AI-generated personas, automated drainer kits), but the core posture (verify before sending, read before signing, ignore unsolicited offers) remains the most reliable protection self-custody users have.