Crypto Scams to Avoid in 2026: How to Spot, Verify and Stop Them

Crypto scams in 2026 rarely begin with someone breaking a blockchain. They rely on social engineering, impersonation, phishing, fake investment platforms, malicious cryptocurrency wallet requests, and fraudulent payment instructions that convince users to take the damaging action themselves.

The scale is substantial. Chainalysis estimates that as much as $17 billion was stolen through crypto scams and fraud in 2025, while the FBI says reported cryptocurrency investment fraud losses exceeded $7.2 billion that year, up 24% from 2024. AI is also making impersonation more convincing. Chainalysis found that AI-enabled scams were 4.5 times more profitable than traditional scams in its 2025 data. At the same time, wallet-specific threats are evolving. Approval phishing can abuse legitimate smart-contract permissions to steal digital assets. Chainalysis documented approval phishing as a major scam technique in 2026.

This guide explains how to recognize a crypto scam, the most common schemes to avoid, how to verify a platform or person independently, what different wallet requests actually mean, and what to do if you have already clicked, signed, shared, or sent something.

Editor's Note (Aug. 19, 2026): We fully updated this article in August 2026 to reflect the latest crypto scam tactics and threat patterns. The refresh adds new coverage of AI-enabled impersonation, wallet drainers, address poisoning, crypto job scams, fake investment platforms, transaction simulation risks, platform verification, and step-by-step guidance based on what a victim has clicked, signed, shared, or sent.

What Is a Crypto Scam?

A cryptocurrency scam is a form of fraud that deceives someone into taking an action that gives a criminal access to their money, accounts, or digital assets. Instead of breaking a blockchain directly, scammers often rely on social engineering to convince victims to send cryptocurrency, reveal login credentials or a private key, authorize a malicious smart contract, install malware, or deposit funds into a fraudulent platform.

Crypto can amplify the damage because a confirmed blockchain transaction is impossible to reverse. Self-custody also places signing authority directly with the wallet owner, so approving the wrong transaction or permission can give an attacker access to assets without compromising the blockchain itself. Pseudonymous wallet addresses can make the real-world identity behind a recipient difficult to establish, while stolen funds can be moved rapidly between wallets, networks, bridges, and services.

Scam vs Hack vs Exploit

These categories can overlap. For example, a phishing scam might steal account credentials that are then used to hack an exchange account, while an attacker could use social engineering to persuade someone to interact with a malicious contract.

How Can You Tell If Something Is a Crypto Scam?

Crypto scams can look very different, but the same warning signs recur across investment fraud, phishing, impersonation, fake support, and wallet scams. The strongest signals are urgency, demands for extra payments, requests for sensitive credentials, and proof that cannot be independently verified.

Someone Is Creating Urgency

Scammers use urgency to stop you from checking their story. Common examples include account suspension threats, countdown timers, limited investment slots, emergency wallet migrations, sudden withdrawal deadlines, and pressure not to speak to anyone else.

The principle is simple: urgency reduces the time available for independent verification. If someone is pushing you to act immediately, slow down and verify through an official channel you find yourself.

You Must Send More Money to Withdraw Your Money

A demand for another payment before you can withdraw funds is a major warning sign of a fake trading platform or advance-fee fraud.

Common excuses include:

• Withdrawal tax
• Verification payment
• Liquidity fee
• Security deposit
• AML fee
• Account-unlock fee
• Supposed gas payment

A scammer may first show fake profits or allow a small withdrawal, then demand USDT, another stablecoin, or another deposit before releasing the rest.

They Ask for Credentials, a Seed Phrase or Remote Access

A legitimate wallet or exchange support agent should not need your:

• Seed phrase or recovery phrase
• Private key
• Password
• Authenticator code
• Remote access to your device

Fake customer support may ask you to install tools such as AnyDesk or TeamViewer, then use that access to steal credentials or take over accounts.

If someone claiming to be support asks for sensitive information or remote control, end the interaction and contact the company through its official website or app.

Their Proof Cannot Be Independently Verified

Screenshots, testimonials, trading dashboards, influencer videos, Telegram groups, verification badges, supplied certificates, and promoter-provided reviews are all weak evidence because scammers can create or manipulate them.

A polished trading platform can still be fraudulent. A large social-media following can be purchased. A certificate can be forged.

Verification should come from a source the promoter does not control.

Check the company's legal entity, regulator or registration record where applicable, official domain, app publisher, and independent warnings yourself rather than relying on material supplied by the person asking for your money.

How Do Crypto Scams Usually Work?

Most crypto scams follow a similar sequence even when the story, platform, or scam name changes:

Contact → Trust → Action → Extraction → Re-Extraction

Contact

The scammer first reaches the victim through channels such as social media, dating apps, Telegram, WhatsApp, phishing email, search ads, fake customer support, or recruiter messages.

The opening may look harmless. It could be an investment tip, job offer, account warning, romantic conversation, or supposed support request.

Trust

Next, the scammer builds credibility. They may pose as a romantic partner, celebrity, executive, investment expert, recruiter, or customer-support agent.

Fake reviews, testimonials, trading dashboards, apparent investment returns, and even a small successful withdrawal can be used as social proof. In a confidence scam, these steps are designed to make the victim comfortable enough to take a larger risk.

Action

Once trust is established, the victim is pushed toward an action that creates exposure.

That might mean:

• Depositing crypto
• Sharing credentials
• Connecting a wallet
• Signing a token approval
• Installing malware or remote-access software
• Scanning a QR code

The exact action varies, but this is usually the point where the scam becomes financially dangerous.

Extraction and Re-Extraction

The first loss may come from a direct transfer, account compromise, or malicious wallet approval.

Scammers often do not stop there. Victims may then be asked to pay a withdrawal fee, tax, account-unlock charge, or additional deposit. Some are later approached by a fake recovery service promising to retrieve the stolen cryptocurrency for another upfront payment.

This is why pig-butchering scams, fake investment platforms, advance-fee fraud, wallet drainers, and recovery scams can overlap. They may look different at first, but the underlying goal is the same: keep extracting money after the victim has already committed.

What Are the Most Common Crypto Scams in 2026?

The most common crypto scams in 2026 fall into several broad families. Some manipulate investment decisions, others impersonate trusted people, while wallet scams target the permissions users give through blockchain transactions.

Fake Crypto Investment Platforms and Pig-Butchering Scams

Pig-butchering and confidence scams often begin through social media, dating apps, Telegram or WhatsApp. The scammer builds trust, introduces a cryptocurrency investment, then directs the victim to a fake trading platform showing fabricated profits.

Deposits usually increase until withdrawals are blocked and the victim is asked for additional taxes, verification fees or security payments. A small successful withdrawal does not prove legitimacy, as scammers may allow one early withdrawal to build confidence.

The FBI says these schemes convince victims to keep depositing into investments that do not actually exist. As of March 2026, its Operation Level Up had contacted 8,935 cryptocurrency investment-fraud victims, 77% of whom did not realize they were being scammed.

Phishing, QR-Code Scams and Fake Crypto Websites

Crypto phishing can arrive through fake exchange emails, cloned wallet websites, malicious ads, fake login screens, browser extensions, QR codes and even physical mail.

A fake WalletConnect page might ask users to connect a wallet, while a spoofed exchange page may steal account credentials.

Reduce the risk by:

• Bookmarking trusted crypto websites
• Checking the full domain name
• Avoiding unsolicited links and QR codes
• Verifying account warnings through the official app or website

The goal is the same regardless of the channel: convince you that the attacker's page or request is legitimate.

Wallet Drainers and Malicious Signature Requests

Wallet drainers trick users into giving a smart contract or attacker permission to move assets.

The actions are not interchangeable:

• Connecting lets a DApp interact with your public wallet address.
• Signing cryptographically authorizes a message or action.
• Approving can give a smart contract permission to spend tokens.
• Sending executes a blockchain transaction.

Dangerous requests can include ERC-20 approvals, unlimited token allowances, Permit signatures and SetApprovalForAll permissions.

Address Poisoning and Clipboard Malware

Address poisoning tricks users by inserting a lookalike wallet address into their transaction history. A victim later copies that malicious address, believing it belongs to someone they previously paid.

Clipboard malware instead replaces a copied wallet address before it is pasted.

This is not a theoretical edge case. Researchers identified around 270 million address-poisoning attempts targeting 17 million potential victims across Ethereum and BNB Smart Chain over two years, with at least $83.8 million in measured losses.

Never rely on a few matching characters or transaction history alone when confirming a recipient address. Use a trusted address book or independently verified source whenever possible.

AI Deepfakes and Impersonation Scams

Artificial intelligence is making impersonation scams harder to judge by appearance alone. Scammers can create deepfake livestreams, cloned voices, fake executives, government officials, AI investment advisers and promotional videos for fraudulent trading platforms.

Hacked social-media and YouTube accounts can also be used for fake giveaways or AI trading-bot promotions.

A current example came on Aug. 17, 2026, when Australia's ASIC warned that scammers were using generative AI to create networks of deepfake websites and endorsements promoting fraudulent investment opportunities.

The FBI has separately warned that scammers are using AI-generated video during calls to impersonate executives, law enforcement and other authority figures.

Crypto Job and Task Scams

Crypto job scams disguise deposits as part of remote employment. Victims may be offered "optimization" work, product-rating tasks or other online jobs before being told to deposit USDT or another cryptocurrency to continue working.

Some schemes make small initial payments to establish trust. Others move conversations to Telegram or WhatsApp, while crypto professionals can also encounter fake recruiters, malicious coding tests or dangerous GitHub repositories.

The FBI describes scams where criminals impersonate legitimate companies, recruit victims for remote jobs and eventually require them to deposit their own money to complete tasks.

A legitimate employer should not require you to deposit cryptocurrency to unlock work or earnings.

SIM Swaps and Fake Crypto Support

SIM swaps and fake customer-support scams often lead to account takeover.

Attackers may impersonate exchange support, request remote access, compromise an email account or convince a mobile carrier to transfer the victim's number to another SIM. That can allow SMS interception and password resets.

The scale can be substantial. In 2025, the U.S. Justice Department sought forfeiture of more than $5 million in Bitcoin allegedly stolen through multiple SIM-swap attacks.

Protect the email account first, use stronger two-factor authentication such as passkeys or security keys where available, enable carrier PIN or port protection and never install remote-access software because supposed exchange support asks you to.

Rug Pulls, Pump-and-Dumps and Ponzi Schemes

These investment scams use different mechanisms:

• Rug pull: Insiders remove liquidity or otherwise extract value from a project.
• Pump-and-dump: Coordinated hype drives up a cryptocurrency token before insiders sell.
• Ponzi or HYIP: New deposits fund apparent investment returns rather than sustainable activity.

Shared warning signs include guaranteed returns, unrealistic APYs, unclear revenue sources, insider-heavy tokenomics, recruitment incentives, low liquidity and teams that cannot be independently verified.

Crypto Recovery Scams

Crypto recovery scams target people after an initial loss. Someone claiming to be a hacker, blockchain investigator, recovery service or law firm may contact the victim and promise to recover stolen cryptocurrency for an upfront payment.

Fake blockchain-tracing reports can then be used to justify additional fees.

Blockchain tracing itself is legitimate and is used by exchanges and law enforcement. Guaranteed recovery is different. Seeing stolen funds on-chain does not mean a private company can retrieve them.

How Do You Check If a Crypto Platform Is Legit?

Do not judge a crypto platform by how professional it looks. Verify its domain, legal entity, regulatory status where applicable, official app publisher, operating history, and withdrawal behavior independently before depositing cryptocurrency.

Check the Domain, Company and App Publisher

Start with the basics:

• Confirm the exact domain name.
• Identify the company or legal entity operating the platform.
• Check the relevant regulator or company register where applicable.
• Confirm the official app publisher in the App Store or Google Play.
• Look at how long the platform has operated.
• Search for regulatory warnings, enforcement actions, or scam reports.

A real company registration can support due diligence, but it does not automatically prove that the platform itself is trustworthy.

Know What Does Not Prove Legitimacy

Scammers can make fake trading platforms look extremely convincing. None of these signals proves legitimacy on its own:

A successful withdrawal is especially deceptive. Some fake platforms allow small withdrawals early on to build trust before encouraging much larger deposits.

The safest approach is to verify claims through sources the platform or promoter does not control, such as an official regulator database, the company's independently located website, and verified app-publisher information.

Verify Through a Source the Platform Does Not Control

Independent verification means checking claims without using the links, phone numbers, or documents supplied by the person promoting the platform.

For example:

• Type the official website URL manually or use a trusted bookmark.
• Open the official app directly rather than following a message link.
• Find the relevant regulator record yourself.
• Locate customer support through the company's official domain.
• Verify a smart contract address through the project's primary website or documentation.

If the only evidence that a platform, company, or contract is legitimate comes from the promoter, you have not independently verified it.

Can Your Wallet Be Drained Just by Connecting or Signing?

Connecting a wallet alone usually does not give a DApp permission to move assets. The risk depends on what you subsequently sign, approve, or authorize.

Why Token Approvals and Permissions Can Be Dangerous

Token approvals let a smart contract spend assets from your wallet. An ERC-20 approval may limit how much can be spent, while an unlimited approval gives the contract a much broader allowance until it is revoked.

Other permissions can be more powerful. SetApprovalForAll can give an operator control over supported NFTs, while Permit signatures can authorize token spending without a separate approval transaction.

Newer mechanisms such as EIP-7702 also allow an Ethereum account to delegate functionality to smart-contract code. That makes unfamiliar delegation requests especially important to verify before signing.

A wallet drainer does not necessarily need your seed phrase. A malicious approval or wallet signature may be enough to authorize asset movement.

Transaction Simulation Helps, but Is Not Absolute Proof

Transaction simulation can preview what a blockchain transaction is expected to do before you approve it. It can reveal token transfers, approval changes, and other smart-contract actions that may not be obvious from the button you clicked.

That makes simulation a useful defense, but not an absolute guarantee. Research published in 2026 identified simulation-phishing attacks designed to make a transaction appear harmless during simulation while behaving differently when executed.

The safer approach is layered: use transaction simulation, read wallet prompts carefully, verify the DApp and smart contract independently, and avoid signing requests you do not understand.

What Should You Do If You Think You Were Scammed?

The correct response depends on what you exposed. Clicking a phishing link, sharing credentials, signing a token approval, revealing a seed phrase, and sending cryptocurrency create different risks, so the first response should match the compromise.

If You Clicked a Link or Entered Credentials

Clicking a phishing link does not automatically mean your crypto is gone. Close the page, check whether anything downloaded or installed, and do not approve any follow-up prompts.

If you entered a password or other credentials, change them immediately from a trusted device. Secure the associated email account too, since email access can be used to reset exchange passwords and authentication.

Key distinction: Clicking creates possible exposure, while entering credentials gives the attacker information they may be able to use.

If You Connected a Wallet or Signed Something

A wallet connection alone usually does not authorize asset transfers. Disconnect the DApp and review recent activity and permissions.

If you signed a token approval, Permit, SetApprovalForAll request, or another suspicious wallet signature, the risk is higher. Review what was authorized and revoke malicious or unnecessary token allowances where possible using the relevant blockchain explorer or a tool such as Revoke.cash.

Key distinction: Connecting a wallet is not the same as granting a smart contract permission to spend assets.

If You Shared Your Seed Phrase or Private Key

If a scammer has your seed phrase or private key, treat the wallet as compromised.

Create a fresh wallet using a trusted device and move any remaining assets to new addresses. Do not reuse the exposed seed phrase, even if no theft has happened yet.

Revoking token approvals is not enough in this situation. A private key or recovery phrase gives an attacker direct control over the wallet.

If You Sent Crypto

Stop sending money immediately, even if the scammer claims another payment will unlock a withdrawal or recover the original transfer.

Collect:

• Transaction hashes
• Recipient wallet addresses
• Blockchain network
• Amount and timestamp
• Screenshots and messages
• Website domains and social accounts

Contact any cryptocurrency exchange or service involved as quickly as possible and report the scam to the appropriate authorities. A confirmed blockchain transaction may not be reversible, but fast reporting can still help if stolen funds reach a service capable of freezing them.

Do not pay anyone who unexpectedly contacts you promising guaranteed recovery.

If Your Exchange Account or Phone Was Taken Over

For a suspected account takeover or SIM swap, secure the accounts that can be used to reset everything else.

Prioritize:

• Email account: Change the password and revoke unknown sessions.
• Mobile carrier: Report an unauthorized SIM swap or port immediately.
• Authentication: Replace compromised SMS or two-factor authentication methods.
• Exchange account: Revoke sessions, inspect withdrawals, and contact official support.
• Other linked accounts: Change reused or exposed credentials.

Unexpected loss of mobile service can be a warning sign of a SIM swap, especially if it occurs alongside password-reset emails or exchange login alerts.

Quick Rule: Match the Response to the Exposure

• Clicked → check device
• Entered credentials → secure account
• Connected wallet → review permissions
• Signed approval → revoke authorization
• Shared seed phrase → replace wallet
• Sent crypto → stop payments and report
• Lost phone service → investigate SIM swap

The more authority the scammer obtained, the more urgent the response should be.

Where Should You Report a Crypto Scam?

Report a crypto scam to the exchange or wallet provider involved, local law enforcement, the relevant national fraud or cybercrime service, and any financial regulator connected to the scheme. Also report the scammer's account to the social platform, messaging app, or marketplace they used.

For U.S. readers, the main reporting channels are:

• FBI Internet Crime Complaint Center, IC3 for cyber-enabled fraud and cryptocurrency scams
• FTC ReportFraud for consumer fraud
• SEC Tips, Complaints and Referrals for potential securities-related investment fraud
• CFTC Complaints for fraud involving derivatives, commodities, or relevant crypto trading activity

Before reporting, collect as much evidence as possible:

• Transaction hashes
• Wallet addresses
• Blockchain network
• Amount sent
• Timestamps
• Screenshots
• Website domains
• Usernames
• Phone numbers
• Email addresses
• Chat or payment records

A transaction hash and wallet address are especially useful because they give exchanges, blockchain investigators, and law enforcement concrete on-chain data to trace.

Closing Thoughts

Crypto scams keep changing appearance, but the underlying playbook is remarkably consistent:

Build trust → create urgency → trigger an irreversible action.

The best defense is equally simple: Stop. Verify independently. Confirm exactly what you are sending, signing, or approving.

If a platform, person, or wallet request cannot survive independent verification, do not proceed.