How to Spot Crypto Scams
How to identify the most common 2026 crypto scams: pig butchering, fake support, address poisoning, fake airdrops, and impersonation.
What you'll need (prerequisites)
- Self-custodial wallet
- A second device for verification
- Block explorer (Etherscan, Solscan, etc.) familiarity
Recommended for this tutorial
Tools and accounts referenced in the steps below:
Step-by-step
-
Step 1: Know the common 2026 scam types
The highest-loss scams in 2026 are pig-butchering (long-con investment relationships built over weeks), fake support and impersonation of exchanges or wallet teams, wallet-draining airdrop and signature sites, and fake apps or browser extensions. Knowing the playbook is what lets you recognize one mid-attempt. Assume anyone who contacts you first about crypto is a suspect.
-
Step 2: Verify the real domain, URL, and app source
Type official URLs yourself or use a saved bookmark instead of clicking links from ads, DMs, or search results, which are routinely spoofed with lookalike domains. Install wallets and apps only from the project's official site or the genuine app-store listing, and check the developer name and reviews. A single wrong character in a domain is often the whole scam.
-
Step 3: Never share your seed phrase or private key
No legitimate wallet, exchange, support agent, or 'validation' site will ever ask for your seed phrase or private key — anyone who does is trying to steal your funds. Never type your seed into a website, and keep it offline. Treat a seed-phrase request as instant proof you are being scammed, however official it looks.
-
Step 4: Inspect every signature and approval before signing
Read exactly what each wallet prompt authorizes before you sign: a blind approval or Permit signature can hand a drainer unlimited access to your tokens. Use your wallet's transaction preview or a simulator to see what would leave your account, and be wary of connect-to-claim flows. If you cannot tell what a signature does, do not sign it.
-
Step 5: Treat guaranteed yields and urgency as red flags
Guaranteed or too-good-to-be-true returns, 'risk-free' yields, and doubling schemes are marketing for a scam — real markets never promise that. Pressure tactics like countdown timers, act-now framing, and rushed DMs exist to stop you from thinking. When someone combines a big promise with urgency, slow down and verify independently.
-
Step 6: Verify independently, then report
Cross-check any project or contact through official channels and a scam database such as Chainabuse before acting. If you have already interacted, review and revoke risky approvals at revoke.cash to limit your exposure. Report the address or site to Chainabuse and the relevant platform so others are warned.
Common errors and fixes
- Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
- Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
- Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
- Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
- Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.
FAQ
What is pig butchering and how do I recognize it?
Pig butchering is a long-con investment scam: a stranger builds trust over weeks on a dating or messaging app, then steers you to a fake trading platform showing fabricated gains. The clearest tell is being asked to deposit more to unlock, verify, or pay tax on withdrawals you can never actually make.
How do wallet-drainer scams actually take my funds?
Fake airdrop or claim pages ask you to connect and sign a transaction, but the signature is often a token approval or permit that grants the attacker permission to move your assets, which automated scripts then sweep in seconds. Read what every signature approves and reject unlimited or set-approval-for-all requests you do not understand.
How do I know if a support account or airdrop is fake?
Legitimate support never messages you first, never asks for your seed phrase, and never charges a fee to release your own funds. Reach support only through the official site you bookmarked yourself, and confirm any regulated claim on the regulator's own website rather than a badge shown on the platform.
What are the fastest red flags common to most crypto scams?
Urgency and pressure to act now, guaranteed or unrealistic returns, requests to move funds to keep them safe, and any contact that arrives unsolicited. Any one of these on its own is reason enough to stop and walk away.
How can I verify a project is legitimate before depositing?
Navigate only through your own saved bookmarks, check the contract and site against primary sources such as regulator databases, official docs, and established explorers, and verify the team's history rather than trusting screenshots or testimonials. If you cannot independently confirm it, treat it as hostile.