43 crypto scam patterns, and how to spot each one

Evidence indicators

• no clear reason for spending rights
• spender not tied to known dapp
• approval value set to max uint

Things they say

• “approve now and revoke later”
• “normal signature for all users”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• setApprovalForAll or unlimited approval request
• approval framed as one-time or harmless
• claim or reward narrative attached to approval
• batch or multicall framing
• migration or sweep language

Things they say

• “Approve max tokens to interact with our smart contract”
• “Sign this permit to unlock your staking rewards”
• “One-time approval needed to claim your NFT airdrop”
• “Unlimited approval required for the trading bot to work”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• APK or sideload request
• private link outside app stores
• beta or exclusive framing for download

Things they say

• “Download our official app from this private link — not on app store yet”
• “Install the APK file I sent for the exclusive trading platform”
• “The desktop client gives 10x better trading conditions than web”
• “Our app is in private beta — download here before public launch”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• no legal entity listed
• fake app-store reviews
• withdrawals blocked by tier upgrade

Things they say

• “install this private app only”
• “mainstream exchanges are too slow”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• selling described as restricted or paused
• very high sell tax framing
• holding period requirement

Things they say

• “This token has anti-whale mechanics that restrict large sells temporarily”
• “Selling is temporarily paused for market stability — only buying allowed”
• “The sell tax is 99% during the launch phase to prevent dumping”
• “Token has a holding period — sell after 30 days for full value”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• custom transfer restrictions
• owner can blacklist wallets
• sell tax set extremely high

Things they say

• “hold for guaranteed moon”
• “selling is disabled for market stability”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• extension installation request
• executable download from external link
• framed as security or optimization tool

Things they say

• “Install this security extension to protect your MetaMask wallet”
• “Download the official wallet backup tool from this link”
• “Our trading bot requires a Chrome extension — install here”
• “Run this executable to sync your portfolio across devices”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• unsigned installer
• download from file-sharing link
• browser extension asks for broad permissions

Things they say

• “official patch from support”
• “run this tool to unlock account”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• domain that resembles but does not exactly match official brand
• urgent action required at the domain
• wallet or credentials required on unfamiliar site
• explicit seed phrase request
• for verification only framing

Things they say

• “Visit coinbase-support.net to verify your account immediately”
• “Log in at metamask-wallet-sync.com to reconnect your wallet”
• “Your Ledger device needs firmware update at ledger-security.org”
• “Binance compliance portal is at binance-verification-center.com”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• seed phrase requested in chat
• copy/paste phrase into form
• threat of account suspension

Things they say

• “for verification only”
• “our system needs your 12 words”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• relationship-building before investment ask
• scripted proof of profits
• pressure to keep deposits private
• relationship-building before any financial ask
• claims of special access or insider information

Things they say

• “i only share this strategy with people i trust”
• “do not tell anyone until withdrawal clears”
• “I found your contact by accident but I feel like we were meant to connect”
• “I am a successful trader and I would like to share my knowledge with you”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• emotional relationship framing with financial ask
• trust language paired with investment pressure
• family or future narrative
• screenshot or image proof of earnings
• appeal to teach victim the same strategy

Things they say

• “I care about you and want to help you secure your future”
• “Trust is the foundation of our relationship — invest with me”
• “My family uses this platform and I would not share if I did not care”
• “If you love me you will trust my financial advice”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• pushes secret investment
• rapid emotional escalation
• avoids real-world verification

Things they say

• “if you trust me, invest now”
• “this is for our future together”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• ownership renouncement as safety signal
• liquidity lock claims without verifiable proof
• concentrated token supply claims

Things they say

• “Buy now before the dev locks liquidity for 10 years”
• “Team has renounced ownership — completely decentralized now”
• “All tokens locked in contract for guaranteed safety”
• “Dev wallet contains only 1% of supply — fully community owned”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• renounced ownership claim without proof
• concentrated token ownership
• sudden liquidity movement

Things they say

• “temporary sell lock”
• “migration needed immediately”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• requests blind signing
• spender address not explained
• approval has unlimited amount

Things they say

• “just sign once to verify”
• “safe approval only takes 3 seconds”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• existing balance or prize framing
• small fee relative to large promised amount
• tax, insurance, or compliance language

Things they say

• “Your prize funds are held pending a small release fee”
• “Pay $200 in crypto to unlock your trading account balance”
• “The compliance tax must be paid before withdrawal is processed”
• “A small activation fee unlocks your daily mining rewards”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• new domain mimics known project
• claim requires unlimited approvals
• asks for seed phrase to claim reward

Things they say

• “claim expires in minutes”
• “you are on the final allowlist slot”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• revocation tool URL is unfamiliar
• asks for broad permissions before scan
• redirects to unrelated dapp

Things they say

• “your wallet is under attack”
• “approve this to secure your funds”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• bridge backup or alternate URL
• manual relay fee request
• pending or stuck transaction framing

Things they say

• “Bridge is congested — use this backup relay to speed up transfer”
• “Your bridge transaction is stuck — contact bridge support here”
• “Manual relay required to complete your cross-chain transaction”
• “Bridge portal moved to new domain for security maintenance”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• new fee appears after every payment
• withdrawal always pending compliance
• support avoids fixed final amount

Things they say

• “one final payment”
• “funds are frozen until fee is paid now”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• bridge URL not from official docs
• unexpected destination wallet
• manual relay fee request

Things they say

• “bridge is congested, use this backup portal”
• “manual release needs top-up”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• time-limited claim window
• wallet connection or seed phrase required
• gas-free or effortless framing
• upfront payment to join whitelist
• signature or approval required

Things they say

• “You have been selected for our exclusive airdrop — claim now”
• “Connect your wallet to the claim portal to receive 500 tokens”
• “Airdrop closes in 30 minutes — verify your wallet immediately”
• “Enter your seed phrase to confirm eligibility for the reward”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• unverifiable mining dashboard
• guaranteed payout regardless of market
• withdrawal locked behind extra fee

Things they say

• “start today and compound instantly”
• “you were selected for premium mining tier”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• wallet address changes frequently
• no audited token sale contract
• funds collected off-chain

Things they say

• “last whitelist seat”
• “send first to reserve your allocation”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• APY far above market rates
• daily compounding guarantee
• locked principal with no withdrawal option mentioned

Things they say

• “Stake your tokens for guaranteed 500% APY with daily compounding”
• “Locked staking vault offers 3% daily with zero risk”
• “Auto-compound feature doubles your stake every week”
• “Our vault has returned 40% monthly for the past 12 months”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• apy far above market
• no lockup terms disclosed
• cannot withdraw principal

Things they say

• “earn 3% daily guaranteed”
• “only insiders get this vault”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• presale price discount framing
• send ETH directly to address for allocation
• listing on known DEX promised
• alphanumeric token identifier with no verifiable contract
• proprietary blockchain claim

Things they say

• “Exclusive presale price before public listing — only 48 hours left”
• “Get in at ground floor before this token 100x on DEX launch”
• “Private sale for whitelist members only — send ETH to this address”
• “Our token goes live on Uniswap tomorrow — buy presale now at 50% discount”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• fixed daily or weekly return percentages
• insurance or guarantee claims
• no mention of investment risk

Things they say

• “Guaranteed 3% daily returns on all deposits”
• “Your investment is 100% safe and insured by our platform”
• “We have never had a losing month in 5 years of operation”
• “Double your crypto in 30 days or your money back”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• contact started in unofficial channel
• username close to real brand
• urgent identity verification outside official site
• brand name + security/compliance framing
• urgency to verify outside official site

Things they say

• “i am from security desk”
• “this is an executive escalation”
• “This is the Binance security team — your account is under review”
• “Coinbase compliance requires urgent identity verification now”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• free or cheap NFT with wallet approval required
• gas refund narrative
• mint pass or allowlist framing

Things they say

• “Mint your free NFT by connecting wallet and approving once”
• “Gas fee refund after successful NFT mint — approve now”
• “Limited edition NFT drop — sign to secure your mint pass”
• “Free allowlist mint — approve smart contract to verify eligibility”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• mint site launched same day
• contract has hidden transfer methods
• mint requires token approvals

Things they say

• “mint closes in 2 minutes”
• “gas refund after wallet verification”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• escrow admin identity cannot be verified
• send first framing
• automated release narrative

Things they say

• “Send funds to the escrow wallet and I will confirm release”
• “Our trusted admin will hold funds until both parties confirm”
• “I am the official group escrow — pay me and I release to seller”
• “Escrow confirmation required — transfer your crypto to this address”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• escrow identity cannot be independently verified
• asks for funds before contract signed
• uses private group pressure

Things they say

• “i am the official escrow admin”
• “send now, release is instant”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• requires upfront retainer
• guarantees guaranteed recovery
• uses fake law-enforcement badges

Things they say

• “we already found your funds”
• “pay case activation fee now”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• upfront fee for recovery service
• claim to have already located funds
• law enforcement impersonation

Things they say

• “We are blockchain investigators and we have located your stolen funds”
• “Our recovery service guarantees 95% recovery rate — pay activation fee now”
• “We found the wallet your funds were moved to — pay trace fee to recover”
• “Law enforcement badge number provided — pay processing fee for release”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• asks for remote desktop
• asks for private credentials
• ticket created outside official platform

Things they say

• “we need temporary access”
• “share your phrase so we can sync wallet”

Protect yourself

• Do not send funds, connect a wallet, or share any key or code
• Screenshot everything and record the wallet address or URL
• If you already paid, file at ic3.gov and stop all contact

Evidence indicators

• technical jargon without verifiable specifics
• too advanced to explain framing
• AI or quantum attached to investment product

Things they say

• “Our revolutionary AI-powered blockchain optimizes yield automatically”
• “Proprietary quantum-resistant protocol ensures maximum returns”
• “Cutting-edge cross-chain arbitrage algorithm runs 24/7 on autopilot”
• “Our patented DeFi mechanism is unlike anything on the market today”

Protect yourself

• Verify the platform or sender through an independent channel
• Search the wallet or domain on chainabuse.com before acting
• Never approve a wallet connection you did not start

Evidence indicators

• urgent voting deadline
• signature or approval attached to governance framing
• reward or loss framing to coerce vote

Things they say

• “Vote on this urgent governance proposal to protect your tokens”
• “Snapshot proposal requires signature to keep your voting power”
• “DAO reward distribution requires governance wallet approval”
• “Sign this delegation to receive your governance staking bonus”

Protect yourself

• Verify the platform or sender through an independent channel
• Search the wallet or domain on chainabuse.com before acting
• Never approve a wallet connection you did not start

Evidence indicators

• proposal not found on official governance page
• signature payload unreadable
• vote link shared only in DM

Things they say

• “vote now to keep rewards”
• “you will lose voting rights today”

Protect yourself

• Verify the platform or sender through an independent channel
• Search the wallet or domain on chainabuse.com before acting
• Never approve a wallet connection you did not start

Evidence indicators

• move to private messaging
• secrecy instruction
• private wallet sharing request

Things they say

• “Message me on Telegram for the full investment details”
• “WhatsApp me directly — I cannot share this in public groups”
• “This conversation should stay between us for now”
• “Contact me on Signal for secure discussion about the opportunity”

Protect yourself

• Verify the platform or sender through an independent channel
• Search the wallet or domain on chainabuse.com before acting
• Never approve a wallet connection you did not start

Evidence indicators

• group screenshots as proof
• celebrity or media endorsement claims
• member count used as legitimacy signal

Things they say

• “Look at what our members are saying in the VIP group”
• “Here are 20 withdrawal proofs from real investors this week”
• “Our Telegram group has 50,000 satisfied members — join now”
• “The Forbes article confirmed our platform is legitimate”

Protect yourself

• Verify the platform or sender through an independent channel
• Search the wallet or domain on chainabuse.com before acting
• Never approve a wallet connection you did not start

Evidence indicators

• countdown or expiry language
• final warning framing
• immediate decision demanded

Things they say

• “Offer expires in 10 minutes — act now or miss out forever”
• “Only 3 spots left at this price — secure yours before it closes”
• “Price doubles tomorrow — buy tonight to lock in early rate”
• “This window closes at midnight — final warning”

Protect yourself

• Verify the platform or sender through an independent channel
• Search the wallet or domain on chainabuse.com before acting
• Never approve a wallet connection you did not start