Eight crypto scams I keep seeing — with a US/EU reader lens

Fake exchange support · remote takeover of your account

Typical script

It starts with something that looks like a small problem on your account. A text message saying a withdrawal "could not be processed," or an email warning of "unusual login activity from a new device." 2024 industrialized this playbook — in a single week on Telegram I count five to eight DMs from "Binance support" or "Coinbase risk team," and none of them are real. A few minutes later someone "from support" reaches out by Telegram, WhatsApp or phone. They use your real name. The voice is calm and professional. They ask you to install a "remote assistance tool" so they can "check the issue" — AnyDesk, TeamViewer, or sometimes Quick Assist on Windows. You install it.

You watch the mouse move on your own screen. They open your exchange, change API permissions, rotate your withdrawal whitelist, push funds out. You hesitate to interrupt, because the "agent" is narrating each step as routine procedure. By the time you realize what is happening, the balance is gone.

What is actually happening technically

• The attacker already has your real name, partial phone number, and recent activity, scraped from past data leaks — the 2022 Binance KYC leak, the 2023 Coinbase third-party support breach via OctaPlus, and the standing ledger of compromised email lists on the dark-web markets. They sound legitimate because they know enough about you to sound legitimate.
• The "official" text and email are SMS spoofing and phishing — the From-address can be set to almost anything by an attacker with the right relay. The branding looks authentic because the attacker copies it pixel-for-pixel.
• The real attack is the screen-share moment. Once you have given control, the attacker is operating as you. 2FA, Google Authenticator, hardware-key prompts — they all flow through your own session, which the attacker is now driving. Your second factor is no longer a second factor.

Defense

• Legitimate exchange support never DMs you first. Not on Telegram, not on WhatsApp, not by phone. If you need support, you initiate it from inside the app — settings → help → live chat. Any unsolicited "agent" reaching out is 100% a scammer.
• Never install AnyDesk, TeamViewer, Quick Assist, or any remote-control tool at the request of someone you have not met. Real exchange employees do not ask for remote access. Ever.
• If a message tells you "your account is in trouble," ignore the link in the message and open the exchange app directly from your phone home screen. Real account-status notifications are visible inside the app and on the verified support pages — not buried in an email link.
• When in doubt, post a redacted screenshot on the exchange's official X / Twitter account and ask publicly. Real support responds. Scammers do not.

Real case — a Coinbase-targeted attack in 2024

Ric Edelman's case is the public one, but the more typical version goes like this. In late 2024 a US user in Texas got a call at 10 PM from someone identifying as "Coinbase Fraud Prevention," reading back the user's name, last four digits of his phone number, and the dollar amount of his most recent ACH deposit. The caller said the account had been "accessed from a Kyiv IP" and that they needed to "verify identity through assistance software." The user installed AnyDesk. What the attacker actually did during the so-called verification was enable API write permission and disable SMS-based withdrawal verification. Eighteen minutes later $300,000 of USDC had been split across six destination addresses, all converging into Tornado Cash. Law enforcement opened a case six months later; cross-border recovery rates on this category sit well under five percent. The money is gone.

"Trading guru" signal groups · using you as exit liquidity

Typical script

On X, TikTok or YouTube Shorts a "seven-figure trader" shows you portfolio screenshots, photos of luxury cars, screenshots of grateful followers wiring tribute payments. They funnel you into a Telegram or Discord group, where you get the first three signals "for free." Coincidence of coincidences, the first three are all winners. You make some small wins. The guru seems remarkable. Then the guru announces "the trade of the cycle," 10x leverage, in a signal that drops a few seconds before you have time to think. You go in heavy. You blow up. You return to the group and find that you have been silently removed.

The arithmetic of the con is survivor selection. The guru starts with a thousand DM targets. He tells half of them BUY and the other half SELL. Whichever side won is the half he keeps. He splits that half again. By round four or five he has a small group of "lucky students" who have seen him be right four to five times in a row, and they think he is a genius. That is the group he sells the final losing signal to.

What is actually happening technically

• The "PnL screenshots" inside the group are almost always Photoshop or demo-account screenshots. On-chain verifiable accounts — which are trivial to produce by linking a TradingView portfolio to a public wallet — are essentially never offered.
• Most of the "happy followers" in chat are sockpuppet accounts and bots running on a posting cadence: "Guru got me +50% on that call," "thank you sir," all within the first five minutes after a signal drops. Statistical timing fingerprints these instantly.
• The most aggressive version is the "house" variant: the platform the guru sends you to is a fake exchange where the guru is paid a cut of your losses. You are not just being mis-signaled — your counterparty is the guru.

Defense

• Real edge does not need followers. If a person can extract money from markets reliably, the income from trading dwarfs anything they could collect from VIP fees. The very fact that someone is collecting VIP fees is itself a strong signal that the actual edge is the fee, not the trade.
• Any guru who routes you to a no-name exchange to "open an account first" is 100% scamming. The route is the entire business.
• When someone posts profit screenshots, ask them to prove it with an on-chain wallet address. Exchange screenshots can be fabricated; a chain-linked wallet history cannot. The response to that question is the entire test.
• Time-stamp the "congratulations" messages inside any group. If forty messages land within five minutes of a signal and then traffic dies for hours, you are looking at bots.

Variant · the legit-platform copy-trading trap

In the last two years a more sophisticated version has emerged on real platforms — Bitget Copy Trading, Bybit Copy Trading, eToro CopyTrader. Some "high-ROI" trader runs a giant leveraged position on his public profile to flex eye-popping monthly returns, attracts followers, then secretly opens an opposite-direction position on a second account. When the followers copy his showcase trade, he profits on the opposite side as their copy trades push the market against them. Even regulated platforms cannot fully prevent this, because they have no way to know whether a trader is being authentic or running a setup. The defense is to never copy traders whose track record is under twelve months, whose maximum drawdown exceeds 30%, or whose equity curve looks like a hockey stick. Look for boring, smooth curves over multiple cycles, not the flashiest monthly return.

Approve drains · one signature empties the whole wallet

Typical script

You see an NFT project advertising an airdrop, or a DeFi yield product with an obscenely high APR. You click the link in a tweet (the URL is one character off from the official domain — uniswap-claim.com instead of uniswap.org). You connect MetaMask. You click "Claim Airdrop" or "Stake Now." MetaMask pops up a signature prompt. You scan it quickly — it looks like a normal approval. You click confirm. Within seconds your USDC, ETH, WBTC, and any blue-chip NFTs are gone. The wallet is empty.

What is actually happening technically

• You think you signed "claim airdrop." What you actually signed is approve(attackerAddress, MAX_UINT256) — granting unlimited spending permission of one of your tokens to the attacker's contract. Once the approval is on chain, the attacker can drain that token at any time, without any further interaction from you.
• For NFTs the worst version is setApprovalForAll(attacker, true) — giving the attacker permission to transfer every NFT in your wallet from a given collection. One signature; entire CryptoPunks position gone.
• The newest variant uses EIP-2612 Permit2 signatures. Rather than producing an on-chain approve transaction, the attacker collects an off-chain signature that allows USDC to be moved directly. No on-chain footprint until the attacker decides to drain — which makes detection much harder.

Defense

• Before signing any wallet popup, read the "Function" field. Transfer = transfer (the amount is visible and bounded). Approve = approval (the amount, especially MAX_UINT256, is what enables drains). Sign Message = a typed signature — usually safe, but Permit2 hides drains here, so check the recipient address.
• Verify every URL at the character level before connecting. Cross-check the link against the project's verified X account and Discord. Bookmark the official URL the first time you visit and never type or click the link again.
• Run a separate "hot wallet" for risky interactions — a fresh MetaMask address that holds only the ETH you need for gas. Your main holdings live in a separate wallet that never touches new contracts. If the hot wallet is drained you lose lunch money, not your savings.
• Audit your active approvals at revoke.cash every month. Revoke anything you are not actively using. Each revoke costs a few dollars of gas; it is the cheapest insurance in DeFi.
• Use a hardware wallet for serious holdings. A Ledger or Trezor displays the full transaction payload on its own screen before you confirm — an approve drain is conspicuously visible at that point in a way that it is not in a MetaMask popup.

Real case · the Ledger Connect Kit supply-chain attack (Dec 2023)

The Connect Kit JavaScript library that Ledger publishes for DApp developers — used by SushiSwap, Zapper, Revoke.cash itself, and many other front-ends — was compromised by a former Ledger employee whose npm credentials had not been revoked. For roughly five hours, every site that imported the library was a phishing site: connecting a wallet and signing what looked like a normal interaction actually triggered an approve to attacker-controlled addresses. Total losses across the window were about $600,000. The most painful detail is that even Revoke.cash, the standard tool for protecting against approve attacks, was compromised. The takeaway is structural: even tools you trust can flip in a moment. The wallet you use for any DeFi interaction must be separate from your main wallet — no exceptions, no convenience cases.

Fake airdrops · tokens that appear in your wallet unannounced

Typical script

You open MetaMask one morning and notice a new token sitting in your wallet. It is called something like "Visit Site Claim Reward" or "$25000_USDT_Reward." The displayed balance suggests it is worth thousands of dollars. Curious, you click through. A popup tells you to "go to the official site to claim." You land on a slick, professional-looking page that asks you to connect your wallet and sign. You sign. Your USDC and ETH disappear.

What is actually happening technically

• Attackers use the airdrop function to spray "tokens" to tens of thousands of wallets at once. Issuing a token is essentially free — gas is the only cost, and on cheap chains like Polygon or BSC it is negligible.
• The tokens are honeypots. You can see the balance on the explorer but you cannot sell — the contract has a transfer restriction that allows only the deployer's addresses to move them. The "value" is a mirage.
• The token name itself contains the phishing URL. The point of the token is not the token; the point is to lure you to a website.
• Once you visit the site, the playbook collapses into CASE 03 — connect wallet, sign approve, get drained.

Defense

• Unexpected tokens in your wallet are 99% scams. Hide them; do not interact. Etherscan, Arbiscan, OKLink, and BSCScan all flag the obvious ones as "Spam" or "Phishing" — when you see those labels, simply mute the contract.
• Real airdrops are announced weeks in advance by the project's verified X account and Discord. You typically have to actively claim them, and the signature is a simple message proof, not an approve.
• Apply a 24-hour cooldown to any "limited-time airdrop." Real airdrops never have 24-hour cliffs; the urgency is the tell.

Real-airdrop vs. fake-airdrop checklist

• Real: announced weeks in advance from a verified project account with a credible history. Snapshot date is published. Claim site uses the project's main domain. The signature you sign is a plain message proof, not an unlimited approve.
• Fake: token appears in your wallet out of nowhere. Token name contains a URL. The "claim site" is on a sketchy TLD (.xyz, .top, .live, .app). Connecting your wallet immediately prompts for an approve on a large-balance token.

Uniswap, Arbitrum, Optimism, ENS, Jupiter, Wormhole, EigenLayer — every legitimate large airdrop in history maps to the "real" checklist. If you ever have doubt about whether an airdrop is genuine, the simplest verification is to look up the project's official Discord announcement channel. Real ones say "claim is live" or "claim has ended"; fake ones never have any official mention at all.

Fake exchanges · lookalike domains and clone apps

Typical script

You search "Binance download" on Google. You click the first ad result. You install the app. The interface is pixel-identical to Binance. You complete KYC, deposit USDT, and trade for a few weeks — everything appears to work. A few months later you try to withdraw. The app responds with "withdrawal requires a 30% tax clearance deposit before release." You pay. The app says it still needs more. You pay again, with rising doubt — but by now your balance no longer displays.

What is actually happening technically

• The attacker registers a lookalike domain (binance-us.app, binance-pro.live) and pays for the top Google search ad. Most users do not check the URL after clicking a sponsored result.
• The "exchange" is a clone front-end with the attacker's own back-end database. Deposits to the app go directly to attacker-controlled addresses; the app simply pretends to credit your account.
• On iOS, these apps are distributed via enterprise certificates (App Store would flag them). On Android, via direct APK side-load. The certificate trick is the giveaway — real exchanges live in App Store and Play Store full stop.

Defense

• Never download an exchange app from a search-engine ad. Go directly to the App Store, the Play Store, or the exchange's bookmarked main domain.
• iOS users: if an app prompts you to "install enterprise certificate" or "trust developer profile," it is 99% fake. Real exchange apps never require this.
• Before any meaningful deposit, run a small withdrawal test — deposit fifty dollars, withdraw fifty dollars, confirm it lands in your real wallet. Only after this round-trip succeeds do you scale.
• "Withdrawal verification bond," "tax clearance fee," "regulatory release" — these are all 100% scam triggers. Real exchanges do not ask you to deposit additional funds to withdraw existing ones.

How lookalike domains usually fool people

• Character substitution: "binance" written with a lowercase L instead of an uppercase i, or with a Cyrillic "а" instead of a Latin "a." The rendered domain looks identical in most fonts.
• TLD substitution: binance.com vs. binance.app, binance.live, binance.io. The prefix is correct; the suffix is the trap.
• Subdomain dressing: binance-us.com, binance-official.com. The legitimate-sounding hyphenated suffix lowers suspicion.
• Punycode homoglyphs: Unicode characters that render identically in the browser's address bar but represent different code points. Modern browsers warn for the most egregious cases, but not all.

The fix is mechanical: bookmark every official exchange URL on the day you first sign up, and after that, always reach the exchange through the bookmark. Never type the URL again, never click a search result. This single habit eliminates the entire category of attack.

Where the money goes after a fake-exchange deposit

USDT deposited to a fake exchange typically moves out of the receiving wallet in ten to thirty minutes. The path is industrialized — first to a hot collector, then split across dozens of mid-tier intermediary wallets, then converged into either a mixer (Tornado Cash, eXch) or pushed across a bridge to Tron or Solana to swap out of stablecoins entirely. The whole sequence completes in under two hours. That is why the small-withdrawal test must be run before any real deposit. After the deposit is in, even if you recognize the platform is fake immediately, the funds are already in the laundering pipeline and recovery is essentially impossible.

Pig butchering · romance + "guaranteed-yield trading platform"

Typical script

A match on Tinder or Bumble, a connection request on LinkedIn, a chance encounter on WeChat or Telegram. The profile is a polished young professional — Singapore-based investment banker, San Francisco product manager, Hong Kong fund analyst. The photos look real and the conversations flow naturally. Over weeks, the relationship deepens. They talk about life, work, family, ambitions. Eventually, the conversation drifts to investing. They mention that their uncle (or family friend) has access to an "internal trading system" that produces five to ten percent weekly returns in crypto. They are already participating. Would you like to try a small test trade together?

You put in $1,000. The platform shows a $200 profit. You request a withdrawal. The withdrawal arrives in your bank within hours. Encouraged, you deposit $10,000. Then $50,000. Then $100,000. The on-screen account keeps growing. The relationship continues to deepen. When you finally try to withdraw the full balance, the platform tells you it requires a "tax pre-payment" — typically 20 to 30 percent. You either pay it or watch the balance freeze. If you pay, a new fee appears. Then a new fee. Eventually you stop and try to call them. The phone is disconnected. The Tinder match has vanished. WeChat blocked. There is no person — there never was.

What is actually happening technically

• The "investment banker" is an industrial persona. The photos are scraped from Instagram or stolen from third-party social accounts. The conversational personality is run by a team of operators using a shared script, often working from compounds in Southeast Asia.
• The "trading platform" is a custom dashboard with no real settlement engine behind it. Deposits go directly to the operators' addresses; the screen-balance is a number in a database that is incremented to whatever the script calls for.
• The small withdrawal you receive early is bait. It is paid out of the same pool the next victim's deposit will fund — it costs the operators nothing relative to the eventual extraction.

Defense

• Any crypto investment "discovered through a new acquaintance" is pig butchering. The FBI's IC3 division logged $5.6 billion in US crypto investment fraud reports for 2024 alone, the overwhelming majority of which traces back to this pattern. No exceptions, no edge cases — if the lead came from someone you met on a dating app or LinkedIn within the last few months, walk away.
• A stranger online steering you to download an app or open an account on an unfamiliar platform is the textbook opening move. Treat the request itself as the red flag.
• If you do video calls, watch for telltale signs of AI face replacement — lip-sync drift on consonants, abnormal blink frequency, soft hair edges, lighting that does not match the room. Ask the person to wave a hand in front of their face; AI face filters often glitch on occlusion.
• Real relationships do not produce "internal investment opportunities" three weeks in. Real investing relationships are slow, boring, and start with a registered advisor — not a Bumble match.

The pig-butchering supply chain

The term "pig butchering" — a translation of the Mandarin shā zhū pán — is the industry slang for the full lifecycle: fatten the pig (build trust, induce larger deposits), then slaughter it (extract everything and disappear). This has industrialized into a global criminal supply chain over the past five years.

• Lead generation: teams of operators run hundreds of fake profiles on Tinder, Bumble, Hinge, LinkedIn, WhatsApp, WeChat, Instagram. A single operator can swipe-and-DM 200+ targets per day.
• Cultivation team: separate operators maintain the "successful young professional" persona, following a relationship-script playbook — good-morning texts, life sharing, gradual financial topic introduction. One cultivator handles dozens of marks in parallel.
• Tech team: builds and maintains the fake trading platforms, often using off-the-shelf SaaS scam kits. Generates the "account growth" displays victims see.
• Laundering team: handles outflows through mixers, bridges, on-chain P2P, OTC desks, and chains-of-shell-corp bank accounts in jurisdictions with weak supervision.

The compounds these operations run from are concentrated in Myanmar's Shan State, Cambodia's Sihanoukville zone, Laos's Golden Triangle special economic zone — regions where local enforcement is captured or absent. Recoveries hover at around 12% even when the FBI is involved; absent FBI involvement, recoveries are effectively zero. The only useful defense is to never engage in the first place. Any unsolicited stranger offering you a "way to make money in crypto" is a scammer, no exceptions, no benefit of the doubt.

Address poisoning · you think you copied your own address

Typical script

You have a wallet you transfer to often — call it 0xabc123...def456. One day you want to send funds and, out of habit, you copy the destination address from your recent transactions on Etherscan. You only glance at the first four and last four characters. They match. You paste, confirm, sign, send. The funds arrive at an attacker-controlled address with the exact same first-four and last-four characters as your real target. The middle is different. You did not check the middle.

What is actually happening technically

• Attackers run on-chain crawlers that monitor large wallets for outgoing transfers. They see 0xabc123...def456 as a recipient.
• Using a vanity address generator with significant GPU brute-force, they generate a private key whose corresponding address starts with abc123 and ends with def456. With modern GPUs, this takes hours, not weeks.
• From the lookalike address, the attacker sends a tiny, zero-value transaction to your wallet. The point is to plant the lookalike address in your wallet's transaction history.
• The next time you check your history and copy the destination, you grab the poisoned address by mistake.

Defense

• Always verify the full address character-by-character before sending. Not just the first four and last four. Read or paste-compare the whole thing.
• Copy destination addresses from a trusted source — your own wallet's address book, a saved text file, the recipient exchange's deposit page — not from your transaction history.
• Run a small test transfer first ($1 USDC) before any large transfer. Confirm it lands at the intended target before sending the rest.
• Use the address-whitelist feature your wallet provides (MetaMask, Coinbase Wallet, exchange withdrawal whitelists). Outgoing transfers are restricted to addresses you pre-added under non-urgent conditions.

Real case · the $68 million address-poisoning whale (May 2023)

An anonymous large holder attempted to move $68M of USDT to their own cold wallet. They copied the destination address from a recent transaction history entry that turned out to be a poisoned lookalike. The funds flew straight to the attacker. The incident was tracked across X within hours, the attacker came under enormous public pressure, and — in an extraordinarily rare outcome — eventually returned the funds. Ninety-nine percent of address-poisoning victims never see their money again. The lasting consequence of that case is that hardware-wallet manufacturers now display the entire forty-character destination address on the device screen, with mandatory page-by-page confirmation. Ledger and Trezor both made this change in subsequent firmware. The mechanism that ate $68M from a whale was deemed too dangerous to handle in software alone.

Rug pulls and contract backdoors · the team vanishes overnight

Typical script

A new DeFi farm appears, advertising 5,000% APY. KOLs are retweeting it. The Telegram is buzzing with 20,000 members. The team published a one-page audit summary. You stake a few thousand USDC. Twenty-four hours later you come back to check. The liquidity pool reads zero. The token chart looks like a cliff. The project's X account is deleted. The Telegram link is dead. Nothing has been refunded; nothing will be.

What is actually happening technically

Rug-pull backdoors come in several common flavors:

• Unbounded mint function: the team can call mint() at any time and dump the inflation onto the open market.
• Owner can drain liquidity: the LP tokens are held by the deployer, not locked. One call and the entire pool of USDC and ETH walks out.
• Blacklist function: the contract can block specific addresses from selling, leaving retail unable to exit while the team disposes of its own bag.
• Fake audit: claims of "audited by CertiK" turn out to be a screenshot of someone else's audit, or an audit of a different contract.

Defense

• Any project advertising APY above 100% is 98% likely a Ponzi or rug pull. Sustainable on-chain yield sits in the 5-30% APY range — anything dramatically beyond that is being printed out of someone else's eventual loss.
• Inspect owner permissions. A contract whose owner can mint unboundedly, pause transfers, or blacklist users hands all power to the team. Treat ownership keys as the project's true governance.
• Check liquidity-lock status. Projects that lock LP for 12+ months on Unicrypt or Team Finance are meaningfully safer than projects that do not. "Locked liquidity" with no on-chain proof is not locked.
• Verify audits at the source. CertiK, Trail of Bits, OpenZeppelin, Halborn, Spearbit — their reports are published on the auditor's own site, not in PDFs hosted by the project itself.
• Size positions small. First week of a new project: pass. First month: small-bet position only. The amount you put into a brand-new project should be the amount you can write off as a learning expense.

Notable rug pulls of recent years

• Squid Game Token (Nov 2021): rode the Netflix series buzz to a 10,000x pump in five days, then the team cashed out and the token collapsed to zero. Estimated theft: $3.3M.
• AnubisDAO (Oct 2021): OlympusDAO-flavored fork raised 13,556 ETH (~$60M at the time) in hours; the funds were swept out of the multisig the same night.
• Snowdog (Nov 2021): Wonderland-flavored fork; the team exploited a pre-embedded backdoor 24 hours after launch and cashed out roughly $10M.
• Mantra OM (Apr 2025): the most recent reminder — a "compliant, mainstream" project audited by multiple firms and listed on tier-1 exchanges crashed 90% in a single afternoon, with strong evidence of coordinated insider selling. Audit and exchange listing are not protection.

The pattern: large market cap and long uptime do not immunize a project from rug behavior. The Mantra incident specifically caught a lot of people who had been confident that "mainstream" projects were past this risk. Never lower your guard because a project looks mature.