These 8 scams go after beginners — here's how to spot them before you send anything

Fake exchange support · remote takeover of your account

Typical script

It starts with something that looks like a small problem on your account. A text message saying a withdrawal "could not be processed," or an email warning of "unusual login activity from a new device." A few minutes later someone "from support" reaches out by Telegram, WhatsApp or phone. They use your real name. The voice is calm and professional. They ask you to install a "remote assistance tool" so they can "check the issue" — AnyDesk, TeamViewer, or sometimes Quick Assist on Windows. You install it.

You watch the mouse move on your own screen. They open your exchange, change API permissions, rotate your withdrawal whitelist, push funds out. You hesitate to interrupt, because the "agent" is narrating each step as routine procedure. By the time you realize what is happening, the balance is gone.

What is actually happening technically

• The attacker already has your real name, partial phone number, and recent activity, pulled from past data leaks and from personal data traded on dark-web markets. They sound legitimate because they know enough about you to sound legitimate.
• The "official" text and email are SMS spoofing and phishing — the From-address can be set to almost anything by an attacker with the right relay. The branding looks authentic because the attacker copies it pixel-for-pixel.
• The real attack is the screen-share moment. Once you have given control, the attacker is operating as you. 2FA, Google Authenticator, hardware-key prompts — they all flow through your own session, which the attacker is now driving. Your second factor is no longer a second factor.

Defense

• Legitimate exchange support never DMs you first. Not on Telegram, not on WhatsApp, not by phone. If you need support, you initiate it from inside the app — settings → help → live chat. Treat any unsolicited "agent" reaching out as a scammer.
• Never install AnyDesk, TeamViewer, Quick Assist, or any remote-control tool at the request of someone you have not met. Real exchange employees do not ask for remote access. Ever.
• If a message tells you "your account is in trouble," ignore the link in the message and open the exchange app directly from your phone home screen. Real account-status notifications are visible inside the app and on the verified support pages — not buried in an email link.
• When in doubt, post a redacted screenshot on the exchange's official X / Twitter account and ask publicly. Real support responds. Scammers do not.

How it typically unfolds

A late-evening call from someone identifying as the exchange's "fraud prevention" team. The caller reads back your name, the last digits of your phone number, maybe your most recent deposit, then says the account has been "accessed from a foreign IP" and they need to "verify identity through assistance software." Once AnyDesk is installed, the so-called verification is actually enabling API permissions and switching off withdrawal confirmations. The balance is split across several addresses within a short time and pushed through mixers and bridges. Cross-border cases take a long time to investigate, and very little is ever recovered.

"Trading guru" signal groups · using you as exit liquidity

Typical script

On X, TikTok or YouTube Shorts a "seven-figure trader" shows you portfolio screenshots, photos of luxury cars, screenshots of grateful followers wiring tribute payments. They funnel you into a Telegram or Discord group, where you get the first three signals "for free." Coincidence of coincidences, the first three are all winners. You make some small wins. The guru seems remarkable. Then the guru announces "the trade of the cycle," 10x leverage, in a signal that drops a few seconds before you have time to think. You go in heavy. You blow up. You return to the group and find that you have been silently removed.

The arithmetic of the con is survivor selection. The guru starts with a thousand DM targets. He tells half of them BUY and the other half SELL. Whichever side won is the half he keeps. He splits that half again. By round four or five he has a small group of "lucky students" who have seen him be right four to five times in a row, and they think he is a genius. That is the group he sells the final losing signal to.

What is actually happening technically

• The "PnL screenshots" inside the group can be Photoshopped or taken from a demo account, so on their own they prove nothing.
• The "happy followers" in chat may be sockpuppet accounts and bots running on a posting cadence: "Guru got me +50% on that call," "thank you sir."
• The most aggressive version is the "house" variant: the platform the guru sends you to is a fake exchange where the guru is paid a cut of your losses. You are not just being mis-signaled — your counterparty is the guru. That is a scammer's own book, not how a real exchange works: on a real exchange, perpetual futures are matched between users and funding is paid between longs and shorts (the basics are in Perpetual vs Quarterly Futures).

Defense

• Real edge does not need followers. If a person can extract money from markets reliably, the income from trading dwarfs anything they could collect from VIP fees. The very fact that someone is collecting VIP fees is itself a strong signal that the actual edge is the fee, not the trade.
• Any guru who routes you to a no-name exchange to "open an account first" is running a scam. The route is the entire business.
• When someone posts profit screenshots, ask them to prove it with an on-chain wallet address. Exchange screenshots can be fabricated; a chain-linked wallet history cannot. The response to that question is the entire test.
• Time-stamp the "congratulations" messages inside any group. If forty messages land within five minutes of a signal and then traffic dies for hours, you are looking at bots.

Variant · the copy-trading trap

In the last two years a more sophisticated version has emerged on copy-trading platforms. Some "high-ROI" trader runs a large leveraged position on his public profile to flex eye-popping short-term returns, attracts followers, then secretly opens an opposite-direction position on a second account. When the followers copy his showcase trade and get liquidated, the second account collects the other side. Platforms find this hard to stop, because they have no way to know whether a trader is being authentic or running a setup. The core risk of copy trading is that you hand your judgment to someone you do not really know. Ignore short-term return leaderboards, look at the long-run record and the worst drawdown, and only copy with money you can afford to lose.

Approve drains · one signature empties the whole wallet

Typical script

You see an NFT project advertising an airdrop, or a DeFi yield product with an obscenely high APR. You click the link in a tweet (the URL is one character off from the official domain — uniswap-claim.com instead of uniswap.org). You connect MetaMask. You click "Claim Airdrop" or "Stake Now." MetaMask pops up a signature prompt. You scan it quickly — it looks like a normal approval. You click confirm. Within seconds your USDC, ETH, WBTC, and any blue-chip NFTs are gone. The wallet is empty.

What is actually happening technically

• You think you signed "claim airdrop." What you actually signed is approve(attackerAddress, MAX_UINT256) — granting unlimited spending permission of one of your tokens to the attacker's contract. Once the approval is on chain, the attacker can drain that token at any time, without any further interaction from you.
• For NFTs the worst version is setApprovalForAll(attacker, true) — giving the attacker permission to transfer every NFT in your wallet from a given collection. One signature; entire CryptoPunks position gone.
• Another family is off-chain signature phishing: EIP-2612 permit signatures and Uniswap's Permit2 signatures. Signing costs no gas and nothing hits the chain, so it looks like a harmless message; the attacker then submits your signature on chain and moves the tokens. The theft itself is an on-chain transfer — the signing step is what goes unnoticed.

Defense

• Before signing any wallet popup, read the "Function" field. Transfer = transfer (the amount is visible and bounded). Approve = approval (the amount, especially MAX_UINT256, is what enables drains). Signature request = an off-chain signature — read what it says, because Permit and Permit2 signatures can authorize someone else to move your tokens; check the spender address.
• Verify every URL at the character level before connecting. Cross-check the link against the project's verified X account and Discord. Bookmark the official URL the first time you visit and never type or click the link again.
• Run a separate "hot wallet" for risky interactions — a fresh MetaMask address that holds only the ETH you need for gas. Your main holdings live in a separate wallet that never touches new contracts. If the hot wallet is drained you lose lunch money, not your savings.
• Audit your active approvals at revoke.cash every month. Revoke anything you are not actively using. Each revoke costs a few dollars of gas; it is the cheapest insurance in DeFi.
• Use a hardware wallet for serious holdings. A Ledger or Trezor displays the full transaction payload on its own screen before you confirm — an approve drain is conspicuously visible at that point in a way that it is not in a MetaMask popup.

Real case · the Ledger Connect Kit supply-chain attack (Dec 2023)

The Connect Kit JavaScript library that Ledger publishes for DApp developers — used by SushiSwap, Zapper, Revoke.cash itself, and many other front-ends — was poisoned after an attacker phished a former Ledger employee and took over his npm account. For roughly five hours, every site that imported the library was a phishing site: connecting a wallet and signing what looked like a normal interaction actually triggered an approve to attacker-controlled addresses. Total losses across the window were about $600,000. The most painful detail is that even Revoke.cash, the standard tool for protecting against approve attacks, was compromised. Even tools you trust can flip in a moment, so keep the wallet you use for DeFi interaction separate from your main wallet.

Fake airdrops · tokens that appear in your wallet unannounced

Typical script

You open MetaMask one morning and notice a new token sitting in your wallet. It is called something like "Visit Site Claim Reward" or "$25000_USDT_Reward." The displayed balance suggests it is worth thousands of dollars. Curious, you click through. A popup tells you to "go to the official site to claim." You land on a slick, professional-looking page that asks you to connect your wallet and sign. You sign. Your USDC and ETH disappear.

What is actually happening technically

• Attackers use the airdrop function to spray "tokens" to tens of thousands of wallets at once. Issuing a token is essentially free — gas is the only cost, and on cheap chains like Polygon or BSC it is negligible.
• The tokens are honeypots. You can see the balance on the explorer but you cannot sell — the contract has a transfer restriction that allows only the deployer's addresses to move them. The "value" is a mirage.
• The token name itself contains the phishing URL. The point of the token is not the token; the point is to lure you to a website.
• Once you visit the site, the playbook collapses into CASE 03 — connect wallet, sign approve, get drained.

Defense

• Unexpected tokens in your wallet are almost always scams. Hide them; do not interact. Etherscan, Arbiscan, OKLink, and BSCScan all flag the obvious ones as "Spam" or "Phishing" — when you see those labels, simply mute the contract.
• Real airdrops are announced through the project's verified X account and Discord. You typically have to actively claim them, and the signature is a simple message proof, not an approve.
• Apply a 24-hour cooldown to any "limited-time airdrop." Real airdrops never have 24-hour cliffs; the urgency is the tell.

Real-airdrop vs. fake-airdrop checklist

• Real: announced from a verified project account with a credible history. Snapshot date is published. Claim site uses the project's main domain. The signature you sign is a plain message proof, not an unlimited approve.
• Fake: token appears in your wallet out of nowhere. Token name contains a URL. The "claim site" is on a sketchy TLD (.xyz, .top, .live, .app). Connecting your wallet immediately prompts for an approve on a large-balance token.

Uniswap, Arbitrum, Optimism, ENS — the genuine large airdrops were all announced through official channels and claimed on the project's own domain. Some gave notice ahead of time and some were claimable the day they were announced, so "was it announced long in advance" is not a reliable test. If you ever have doubt about whether an airdrop is genuine, the simplest verification is to look up the project's official Discord announcement channel. Real ones say "claim is live" or "claim has ended"; fake ones never have any official mention at all.

Fake exchanges · lookalike domains and clone apps

Typical script

You search "Binance download" on Google. You click the first ad result. You install the app. The interface is pixel-identical to Binance. You complete KYC, deposit USDT, and trade for a few weeks — everything appears to work. A few months later you try to withdraw. The app responds with "withdrawal requires a 30% tax clearance deposit before release." You pay. The app says it still needs more. You pay again, with rising doubt — but by now your balance no longer displays.

What is actually happening technically

• The attacker registers a lookalike domain (binance-us.app, binance-pro.live) and pays for the top Google search ad. Always check the URL after clicking a sponsored result.
• The "exchange" is a clone front-end with the attacker's own back-end database. Deposits to the app go directly to attacker-controlled addresses; the app simply pretends to credit your account.
• On iOS, these apps are distributed via enterprise certificates (App Store would flag them). On Android, via direct APK side-load. The certificate trick is the giveaway. Real exchanges normally distribute through the App Store and Play Store; where an exchange has been pulled from a regional store, get the download link from its official website, never from a link someone sends you.

Defense

• Never download an exchange app from a search-engine ad. Go directly to the App Store, the Play Store, or the exchange's bookmarked main domain.
• iOS users: if an app prompts you to "install enterprise certificate" or "trust developer profile," it is almost certainly fake. Real exchange apps never require this.
• A small withdrawal going through does not prove a platform is real. Scam platforms routinely let small withdrawals out to build trust. Verify before you deposit anything: the official domain, the app's developer name in the store listing, and the exchange's licensing information.
• "Withdrawal verification bond," "tax clearance fee," "regulatory release" — these are always scam triggers. Real exchanges do not ask you to deposit additional funds to withdraw existing ones.

How lookalike domains usually fool people

• Character substitution: "binance" written as blnance (a lowercase L posing as i), b1nance (the digit 1), or with a Cyrillic "а" instead of a Latin "a." The rendered domain looks nearly identical in most fonts.
• TLD substitution: binance.com vs. binance.app, binance.live, binance.io. The prefix is correct; the suffix is the trap.
• Subdomain dressing: binance-us.com, binance-official.com. The legitimate-sounding hyphenated suffix lowers suspicion.
• Punycode homoglyphs: Unicode characters that render identically in the browser's address bar but represent different code points. Modern browsers warn for the most egregious cases, but not all.

The fix is mechanical: bookmark every official exchange URL on the day you first sign up, and after that, always reach the exchange through the bookmark. Never type the URL again, never click a search result. This single habit eliminates the entire category of attack.

Where the money goes after a fake-exchange deposit

USDT deposited to a fake exchange typically moves out of the receiving wallet quickly. The path is industrialized — first to a hot collector, then split across dozens of mid-tier intermediary wallets, then converged into either a mixer (Tornado Cash, eXch) or pushed across a bridge to Tron or Solana to swap out of stablecoins entirely. Organized groups run the whole sequence fast. That is why the checks on domain, developer and licensing have to happen before any real deposit. After the deposit is in, even if you recognize the platform is fake immediately, the funds are already in the laundering pipeline and recovery is essentially impossible.

Pig butchering · romance + "guaranteed-yield trading platform"

Typical script

A match on Tinder or Bumble, a connection request on LinkedIn, a chance encounter on WeChat or Telegram. The profile is a polished young professional — Singapore-based investment banker, San Francisco product manager, Hong Kong fund analyst. The photos look real and the conversations flow naturally. Over weeks, the relationship deepens. They talk about life, work, family, ambitions. Eventually, the conversation drifts to investing. They mention that their uncle (or family friend) has access to an "internal trading system" that produces five to ten percent weekly returns in crypto. They are already participating. Would you like to try a small test trade together?

You put in $1,000. The platform shows a $200 profit. You request a withdrawal. The withdrawal arrives in your bank within hours. Encouraged, you deposit $10,000. Then $50,000. Then $100,000. The on-screen account keeps growing. The relationship continues to deepen. When you finally try to withdraw the full balance, the platform tells you it requires a "tax pre-payment" — typically 20 to 30 percent. You either pay it or watch the balance freeze. If you pay, a new fee appears. Then a new fee. Eventually you stop and try to call them. The phone is disconnected. The Tinder match has vanished. WeChat blocked. There is no person — there never was.

What is actually happening technically

• The "investment banker" is an industrial persona. The photos are scraped from Instagram or stolen from third-party social accounts. The conversational personality is run by a team of operators using a shared script, often working from compounds in Southeast Asia.
• The "trading platform" is a custom dashboard with no real settlement engine behind it. Deposits go directly to the operators' addresses; the screen-balance is a number in a database that is incremented to whatever the script calls for.
• The small withdrawal you receive early is bait. It is paid out of the same pool the next victim's deposit will fund — it costs the operators nothing relative to the eventual extraction.

Defense

• Any crypto investment "discovered through a new acquaintance" is pig butchering. No exceptions, no edge cases — if the lead came from someone you met on a dating app or LinkedIn within the last few months, walk away.
• A stranger online steering you to download an app or open an account on an unfamiliar platform is the textbook opening move. Treat the request itself as the red flag.
• If you do video calls, watch for telltale signs of AI face replacement — lip-sync drift on consonants, abnormal blink frequency, soft hair edges, lighting that does not match the room. Ask the person to wave a hand in front of their face; AI face filters often glitch on occlusion.
• Real relationships do not produce "internal investment opportunities" three weeks in. Real investing relationships are slow, boring, and start with a registered advisor — not a Bumble match.

The pig-butchering supply chain

The term "pig butchering" — a translation of the Mandarin shā zhū pán — is the industry slang for the full lifecycle: fatten the pig (build trust, induce larger deposits), then slaughter it (extract everything and disappear). In recent years it has industrialized into a global criminal supply chain.

• Lead generation: teams of operators run hundreds of fake profiles on Tinder, Bumble, Hinge, LinkedIn, WhatsApp, WeChat, Instagram. A single operator can swipe-and-DM a large batch of targets every day.
• Cultivation team: separate operators maintain the "successful young professional" persona, following a relationship-script playbook — good-morning texts, life sharing, gradual financial topic introduction. One cultivator handles dozens of marks in parallel.
• Tech team: builds and maintains the fake trading platforms, often using off-the-shelf SaaS scam kits. Generates the "account growth" displays victims see.
• Laundering team: handles outflows through mixers, bridges, on-chain P2P, OTC desks, and chains-of-shell-corp bank accounts in jurisdictions with weak supervision.

The compounds these operations run from are concentrated in Myanmar's Shan State, Cambodia's Sihanoukville zone, Laos's Golden Triangle special economic zone — regions where local enforcement is captured or absent. Recoveries are rare even when law enforcement gets involved. The only useful defense is to never engage in the first place. Any unsolicited stranger offering you a "way to make money in crypto" is a scammer, no exceptions, no benefit of the doubt.

Address poisoning · you think you copied your own address

Typical script

You have a wallet you transfer to often — call it 0xabc123...def456. One day you want to send funds and, out of habit, you copy the destination address from your recent transactions on Etherscan. You only glance at the first four and last four characters. They match. You paste, confirm, sign, send. The funds arrive at an attacker-controlled address with the exact same first-four and last-four characters as your real target. The middle is different. You did not check the middle.

What is actually happening technically

• Attackers run on-chain crawlers that monitor large wallets for outgoing transfers. They see 0xabc123...def456 as a recipient.
• Using a vanity address generator with significant GPU brute-force, they generate a private key whose corresponding address starts with abc123 and ends with def456. With modern GPUs, this takes hours, not weeks.
• From the lookalike address, the attacker sends a tiny, zero-value transaction to your wallet. The point is to plant the lookalike address in your wallet's transaction history.
• The next time you check your history and copy the destination, you grab the poisoned address by mistake.

Defense

• Always verify the full address character-by-character before sending. Not just the first four and last four. Read or paste-compare the whole thing.
• Copy destination addresses from a trusted source — your own wallet's address book, a saved text file, the recipient exchange's deposit page — not from your transaction history.
• Run a small test transfer first ($1 USDC) before any large transfer. Confirm it lands at the intended target before sending the rest.
• On exchanges, turn on the withdrawal address whitelist, so withdrawals can only go to addresses you added in advance under non-urgent conditions. In a self-custody wallet, save regular recipients in the address book and pick them from there.

Real case · the roughly $68 million WBTC poisoning (May 2024)

In May 2024 a large holder copied a destination address from their transaction history that turned out to be a poisoned lookalike, and sent about 1,155 WBTC — roughly $68M at the time — straight to the attacker. The incident was tracked across X within hours, and the attacker eventually returned the funds. Do not count on that outcome. If you send from a hardware wallet, read the full destination address on the device screen, start to finish, before you confirm.

Rug pulls and contract backdoors · the team vanishes overnight

Typical script

A new DeFi farm appears, advertising 5,000% APY. KOLs are retweeting it. The Telegram is buzzing with 20,000 members. The team published a one-page audit summary. You stake a few thousand USDC. Twenty-four hours later you come back to check. The liquidity pool reads zero. The token chart looks like a cliff. The project's X account is deleted. The Telegram link is dead. Nothing has been refunded; nothing will be.

What is actually happening technically

Rug-pull backdoors come in several common flavors:

• Unbounded mint function: the team can call mint() at any time and dump the inflation onto the open market.
• Owner can drain liquidity: the LP tokens are held by the deployer, not locked. One call and the entire pool of USDC and ETH walks out.
• Blacklist function: the contract can block specific addresses from selling, leaving retail unable to exit while the team disposes of its own bag.
• Fake audit: claims of "audited by CertiK" turn out to be a screenshot of someone else's audit, or an audit of a different contract.

Defense

• Treat any project advertising APY above 100% as a likely Ponzi or rug pull. Work out where the yield actually comes from before you put money in.
• Inspect owner permissions. A contract whose owner can mint unboundedly, pause transfers, or blacklist users hands all power to the team. Treat ownership keys as the project's true governance.
• Check liquidity-lock status. Projects that lock LP for 12+ months on Unicrypt or Team Finance are meaningfully safer than projects that do not. "Locked liquidity" with no on-chain proof is not locked.
• Verify audits at the source. CertiK, Trail of Bits, OpenZeppelin, Halborn, Spearbit — their reports are published on the auditor's own site, not in PDFs hosted by the project itself.
• Size positions small. First week of a new project: pass. First month: small-bet position only. The amount you put into a brand-new project should be the amount you can write off as a learning expense.

Notable rug pulls of recent years

• Squid Game Token (Nov 2021): rode the Netflix series buzz to a 10,000x pump in five days, then the team cashed out and the token collapsed to zero. Estimated theft: $3.3M.
• AnubisDAO (Oct 2021): OlympusDAO-flavored fork raised 13,556 ETH (~$60M at the time) in hours; the funds were swept out of the multisig the same night.
• Snowdog (Nov 2021): Wonderland-flavored fork; the team exploited a pre-embedded backdoor 24 hours after launch and cashed out roughly $10M.
• Mantra OM (Apr 2025): the most recent reminder — a "compliant, mainstream" project audited by multiple firms and listed on tier-1 exchanges crashed 90% in a single afternoon. The market suspected concentrated selling by the team or related wallets; the project denied it. Strictly speaking it is not a classic contract-backdoor rug — it is here as a reminder that audits and exchange listings are not protection.

The pattern: large market cap and long uptime do not immunize a project from rug behavior. Before it collapsed, Mantra looked like exactly that kind of "mainstream" project. Never lower your guard because a project looks mature.