13 Crypto Phishing Scams and How to Spot Them

How to use this page: look scams up by how they reach you

Crypto phishing comes in many variations, but it reaches you in only a handful of ways: a direct message, a pop-up, a search result, an email, a parcel. This page sorts the common techniques into 13 types by that point of entry. For each one it covers three things: what it looks like, which step does the damage, and what to check before you act. Where a check involves a specific product, it links to the vendor's or agency's own page; the external links were checked in October 2026.

Write-ups of incidents documented in primary sources are kept under Security Incident Write-Ups.

If you've already been hit, go straight to what to do, in order.

How much was lost to scams in 2025: figures from two annual reports

Both reports came out in January 2026. They measure different things, so the figures can't be added together.

Chainalysis published its annual crypto scam report on January 13, 2026. It counts the money received on-chain by scam addresses of all kinds: at least $14 billion in 2025. The 2024 figure was recalculated from the $9.9 billion first reported to $12 billion, and the report expects that the 2025 figure could pass $17 billion as more addresses are identified. It singles out impersonation scams as having grown by more than 1,400% over 2024, and gives one comparison: scams with on-chain links to AI tool vendors took in an average of $3.2 million per operation, against $719,000 for those without such links.

Scam Sniffer published its 2025 phishing report on January 3, 2026. It counts only wallet-signature phishing: $83.85 million lost by 106,106 victims in 2025, against $494 million in 2024, a fall of 83% in the amount. The largest single case of the year was $6.5 million in September, from one Permit signature; the report also says Permit / Permit2 signatures made up 38% of the losses in large cases.

Taken together: the total for signature phishing fell, impersonation is growing, and the large losses still cluster around signatures such as Permit.

The 13 types at a glance

1. Someone claiming to be support messages or calls you first: how to tell if it's real

Suppose you post “why hasn't my withdrawal arrived yet” on a social platform. Before long an account with the exchange's logo as its avatar and “Support” in its name sends you a DM, or replies under your post with a link to an “appeal form”. Or it might be a phone call from someone claiming to be from the security team, saying there has been an unusual login and you need to cooperate with verification.

All three routes are after the same things: your seed phrase, private key, login password, the code from a text message or an authenticator, the authenticator's setup QR code, or a transfer of your coins to a “safe address”. Hand over any one of these and the other side can move your money or log in to your account themselves, which is why no support process requires you to give them up.

• Avatars, names, verification badges and follower counts can all be faked, so none of them count as evidence. For an “official account” that replies under your post, first check the spelling of the account name, then compare it against the social accounts listed in the footer of the official site.
• If a caller asks you to read out a verification code, install remote-control software or move coins to a “safe account”, hang up. Ledger's official phishing campaigns status page states that Ledger will not contact you by text message or phone call, and that neither Ledger nor its support staff will ask for your 24-word recovery phrase.
• “Send some first and get double back after verification” or “pay a deposit before we can unfreeze it”: any pitch where you send first and receive later is a scam, whether it is dressed up as support, a promotion or a livestream.
• If you've already given out a verification code or the setup QR code: log in through the official entry point right away, change the password, reset two-factor authentication, and check the withdrawal allowlist and the logged-in devices for anything you don't recognize. If you've given out your seed phrase, follow the article on what to do when a private key or seed phrase leaks.

2. An unfamiliar token just appeared in your wallet. Can you sell it?

Suppose you open your wallet and find a token you never bought. Its name looks like some kind of reward or claim voucher, and there is a decent price shown next to it.

Sitting in your address, this token can't touch your other coins: approvals are separate for each token, so whatever approval you give on it concerns only that token. The damage comes at the next step. The token's name, or its “official site”, leads you to a claim or swap page, and the approval that page asks you to confirm covers the coins in your wallet that are actually worth something. That turns it into type 3 below.

To find out what it is, paste the contract address into a block explorer. A read-only page doesn't need a wallet connection. For more detail, see the FAQ page on unfamiliar tokens showing up in a wallet.

3. The approval window that pops up when you claim an airdrop: which ones not to confirm

Suppose you land on a “claim airdrop” or “mint NFT” page, connect your wallet and click Claim on the page. The wallet pops up a confirmation window, and you assume you're collecting something.

That window is where it goes wrong. The button on the page says “Claim”, but the operation in the wallet window is approve, increaseAllowance or setApprovalForAll. The first two hand an allowance of one token to an address; the third hands every item you own in an NFT collection to an address to manage. Once you confirm, the other side can move the coins or NFTs within that allowance without going through you again, either straight away or some time later.

• Claiming something doesn't require you to approve an allowance on assets you already hold. If the window shows an unlimited amount, or the amount is a long string of digits, reject it.
• If you don't recognize the counterparty address, don't confirm. A project's contract addresses are the ones published in its official documentation; don't use what the page displays to verify the page itself.
• Keep the address you use for trying new projects separate from the address you use for long-term holding, and keep only small amounts in the wallet for new projects.
• If you've already confirmed a suspicious approval: revoke it following the steps in How to Check and Revoke Token Approvals, then move the approved asset out of that address.

4. Fake wallet apps: where to download the real one

A fake wallet app or fake exchange app can look identical to the real one. The difference is where what you type ends up: create or import a seed phrase in a fake wallet and you're no longer the only one who has it; log in to a fake exchange app and your account name, password and verification codes all go to the other side. How convincing the interface looks and how complete the features are tell you nothing. The only thing that does is where you downloaded it from.

• Type the official domain into the address bar yourself, or use a bookmark you saved earlier, and follow the download button on the official site through to the app store page before installing. Don't search the store for an app of the same name, and don't click ads in search results. Taking MetaMask as an example, its official download page gives the App Store and Google Play store links.
• Don't install installers shared in chat groups, links to an “internal version” or “latest version”, or packages from third-party download sites.
• Where the official site provides both an installer and a checksum (SHA-256), compute the checksum after downloading and before installing: on macOS use shasum -a 256 filename, on Windows use certutil -hashfile filename SHA256 (Microsoft documentation). If the result doesn't match what the official site publishes, delete the file.
• Gatekeeper on macOS checks whether software is signed by an identified developer and has been notarized by Apple (Apple Platform Security guide). It doesn't judge for you whether that developer is the brand itself. An app that opens without complaint isn't necessarily the genuine one.
• If wallet software asks you to type in your seed phrase for an upgrade, a sync or a verification, quit. Ledger's status page puts it plainly: the 24 words should only ever be entered on the device itself, and there is no legitimate reason to type them into a computer.

If you've already typed something into a suspicious app: if it was a wallet, treat the seed phrase as leaked; if it was an exchange, log in from the official site on a clean device, change the password, reset two-factor authentication, and delete any withdrawal addresses and logged-in devices you don't recognize.

5. Is a second-hand hardware wallet, or one of unknown origin, safe to use?

Suppose you see a hardware wallet on a second-hand marketplace at a good discount, and the seller says it was barely used. Or a parcel you never ordered arrives, containing a branded hardware wallet and a card marked “gift”.

The problem with devices like these is that you may not be the only one who knows the seed phrase. In May 2023 Kaspersky took apart a fake Trezor that a buyer had bought on a classifieds site: the holographic stickers on the box and on the device were present and undamaged, but the microcontroller inside had been replaced, and the firmware held 20 pre-stored seed phrases, so the phrase the device “generated” was one of those.

• Where to buy: only from the brand's official site or an authorized reseller listed there. Trezor's official page Is my device safe to use? tells you not to buy from unauthorized third parties.
• Checking a Trezor: the same page says where the holographic seal is for each model (over the connector on the Safe 7, Safe 5, Safe 3 and Model T; on the box for the Model One). Devices ship without firmware, which is installed during first-time setup, so don't use a device that turns out to have firmware on it already when you connect it. Trezor Suite only accepts devices whose firmware is correctly signed. The seal is only one of the checks; the device Kaspersky took apart had its seals intact.
• Checking a Ledger: for the steps of the genuine check, go by the current instructions in Ledger's help center, reached from ledger.com typed in yourself. Two points stated on Ledger's status page are worth remembering in the meantime: ledger.com is the only official source for downloading its software, and the 24 words are only ever entered on the device itself.
• Warnings during setup: if the device screen or the official app shows any warning, stop; don't dismiss it and carry on.
• Parcels you never ordered: don't initialize the device, don't scan the QR code in the parcel, don't call the phone number inside. Ledger's status page lists paper letters impersonating Ledger as phishing: the letter tells you to scan a code or visit a website, and in the end asks you to enter your 24 words.

If you've already put coins into a device like this: generate a new seed phrase on a device newly bought through official channels, move all the assets across, and stop using the old device.

6. A stranger sends you a private key and asks you to “help withdraw the coins”

Suppose a stranger messages you: they sent coins on the wrong chain, the coins are stuck in an address, and they're sending you the private key or seed phrase so you can help move them out, with half for you when it's done. After importing it you do see a balance, but the address has none of the coin needed to pay the fee, and they ask you to cover a little first.

This doesn't hold up from the start. Handing a private key to a stranger means handing over the whole address, and someone with a real problem wouldn't ask for help that way. The key came from them, so they can move that address at any time too, and every fee you send in is theirs to take.

7. The “exchange” an online acquaintance takes you to: pig butchering and fake platforms

This type works through time. Suppose you meet someone on a social or dating app and chat for weeks or months. They mention that they trade on a certain platform with steady returns and offer to show you how. Or you're pulled into a group where a “mentor” calls trades and members post screenshots of their gains every day. You try a small deposit, the balance goes up and a withdrawal arrives, so you put in more. When you try to take the larger amount out, the platform says you first have to pay tax, pay a deposit or upgrade the account.

The balance and the returns on the platform are only numbers it shows you. Small withdrawals work so that you'll put more in.

The US Federal Trade Commission's page on cryptocurrency and scams makes three points you can apply directly: only scammers guarantee profits or big returns; don't mix online dating and investment advice; and on a fake investment site you either can't withdraw your money at all or have to pay high fees first.

• Judge the person and the investment separately. Whoever recommended it, check the platform as you would any unfamiliar platform.
• If the platform's name or domain is a variant of a well-known exchange (one letter added, one letter swapped, a suffix added), treat it as a fake platform. Type in the official domain you've confirmed yourself and compare.
• If you're asked to pay in again before withdrawing, stop paying, whether it's called tax, a fee, a deposit or an unfreezing charge. A normal fee is simply deducted from the balance; there's no need for you to send in a separate payment.
• If a “staking” or “node hosting” page requires an approval on your USDT before you can take part, treat it as type 3: once the approval is given, the other side can move your USDT within that allowance.
• Don't follow a tutorial to deploy an “arbitrage bot” contract and then send coins into it. A Scam Sniffer report from March 2024 took such a contract apart: the tutorial walks people through deploying it in Remix and sending in ETH, and whichever function is called in the contract (Start, Stop or Withdrawal), the result is that the ETH sent in goes to the scammer's wallet.

8. You only signed and paid no gas. Why are the coins gone? (Permit)

Suppose you click Deposit or Verify on a page, and what the wallet pops up is a “signature request” rather than a transaction confirmation. It contains structured data with the fields owner, spender, value and deadline. It costs no gas and looks like nothing more than a signature.

This is a Permit. EIP-2612 added a permit function to ERC-20 tokens: the holder signs a message offline, and whoever has that signature can submit it on-chain, with the same effect as the holder sending an approve transaction that lets the spender use up to value tokens before the deadline. The signature itself isn't on-chain, so after signing there is no on-chain record until the other side submits it and then moves the tokens. Revoke.cash's explainer warns about the same thing: wallets give a warning for on-chain approvals but often not for Permit signatures, and people think they are only logging in to a website.

If the field names are PermitSingle or PermitBatch, it's a Uniswap Permit2 signature: according to the Permit2 documentation, the first approves one token and the second approves several tokens at once. The checks are the same.

If you've already signed a suspicious Permit:

• The fastest step is to move that token out of that address. The signature covers that token at that address; once it's no longer there, the other side has nothing to move.
• A signature can be invalidated before it's submitted on-chain. Under EIP-2612 each address has a nonce that goes up by 1 every time permit succeeds, so the same signature can't be used twice; if the nonce is used up first, the signature the other side holds stops working. Revoke.cash has a Signatures tab on its account page where you can try to cancel; it also says that beating the other side to it is hard, and that it has no way of knowing which signatures you've actually signed.
• If the other side has already submitted the Permit on-chain, the approval will show up in your approvals list and can be revoked like any other; the steps are in How to Check and Revoke Token Approvals.

9. Several wallets with the same name in the extension store: which one is real?

Suppose you search the Chrome Web Store for a wallet's name and the results show several extensions side by side with the same name and the same icon.

Installing the wrong one has the same consequence as a fake app: create or import a wallet in it and you're no longer the only one with the seed phrase. The other side won't necessarily act at once, so “I've used it for a while and nothing happened” proves nothing.

Taking MetaMask as an example (store page checked October 2026):

• Extension ID: the last segment of the address of a Chrome Web Store detail page is the extension ID. The address of MetaMask's store page ends in nkbihfbeogaeaoehlefnkodbefgpgknn.
• Developer: the developer shown on that page is Consensys Software Inc., and the website field points to metamask.io.
• Entry point: don't search the store; go in from metamask.io/download and let the official site take you to the store page for your browser.

For other wallets, follow the same order: the official site first, then the store by way of the official site. If you come across an “official extension” for a DEX or a project, first check on its official site whether it has released a browser extension at all. It's best to do wallet-related things in a separate browser profile that has only the wallet extension installed, and to remove extensions you don't use.

If you've already installed a same-name fake and created or imported a wallet in it, uninstalling doesn't solve the problem. Treat the seed phrase as leaked.

10. The “unusual account activity” link in an email or text message

Suppose you receive an email whose sender display name is an exchange's security team. It says an unusual login was detected and you must click a link to complete verification within 24 hours or the account will be frozen. The link text looks like the official site's address, but it actually points to a lookalike domain with an extra word added after the brand name.

The display name and the link text are both filled in by the sender and prove nothing. Clicking through brings up a login page identical to the official one, and the password and verification code you enter are used by the other side to log in to the real account.

• An email that asks you to enter your seed phrase on a web page, on the pretext of new firmware, a security upgrade or compensation for a data breach, is phishing. Ledger's status page says the recovery phrase is entered only on the device, and that Ledger and its support staff will not ask for it.
• If your exchange account has an anti-phishing code feature, set it: official emails will carry the string you chose, and any without it can be deleted. An email that does carry it has only one doubt fewer; to do anything on the account, still go in from your bookmark.
• Use a separate, private email address for the exchange account and far fewer phishing emails will reach it.

11. The first search result is an ad: how to avoid fake official sites

Suppose you search for the name of a wallet or an exchange. The first result is marked as an ad, its title says official download, and the address it displays looks like the official site too.

Google Ads' policy on ad destinations lists both of these as not allowed: a display URL whose domain doesn't match the URL you actually land on, and a redirect from the final URL to a different domain. A ban in the policy doesn't mean every ad you see complies. Scam Sniffer has one report from December 2023 and another from January 2025 tracing wallet phishing and malware delivered through ads.

• For official sites you use regularly, type the domain by hand the first time, save it as a bookmark, and use only the bookmark afterwards.
• When you have to search, use site: to restrict the domain, for example site:the-official-domain-you-confirmed download, so that results come only from that domain (Google's explanation).
• The same goes for pages that need a wallet connection, such as bridges and DEXs: go in from a link in the project's official documentation or on its official site, not from search results.
• If you've already downloaded an installer, verify it using the method under type 4 before deciding whether to install it.

12. The “urgent migration” video with a famous face in it

Suppose you come across a widely shared post. In the video an exchange founder says to camera that the platform will migrate assets within 24 hours, and that all users must complete verification at the link below the video or their assets will be frozen. The comments are a row of “migration successful”.

It isn't up to you to judge whether the person in the video looks real, and share counts, comments and verification badges can all be manufactured too. Chainalysis's annual report lists AI tools as one of the factors behind higher scam takings, in the figures quoted earlier. What you check is something else: whether the platform's own channels carry this announcement.

“Send coins first and get double back” promotions in a livestream or a video are scams in the same way.

13. After you've been scammed, someone says they can “get it back for you”

Suppose that after being scammed you post on a forum or a social platform asking for help, and soon someone sends a DM. They claim to be an on-chain forensics team, a lawyer or a white-hat hacker, and say they can recover the money once you pay an investigation fee, a retainer or legal fees up front.

The UK's Financial Conduct Authority (FCA) calls this a recovery room scam: scammers approach people who have already been scammed, or who have lost money on an investment, and say they can help get it back on condition of a fee paid first, often described as a tax, legal fees or a handling charge. The FCA's advice is to end contact immediately, pay nothing and give out no bank details.

• You can't verify who they claim to be (a former law enforcement officer, an employee of an on-chain analytics firm), so it doesn't count as evidence, and neither does a professional-looking website.
• If you want to pursue the money, report it: go to the police where you live and bring the chat logs, transaction hashes, the other side's addresses and screenshots of the web pages.
• Don't leave contact details in a post asking for help.
• If you've been scammed a second time, keep the evidence of that loss too and report it together with the first. Pay no further fees.

You know scams exist. Why do you still click?

The 13 types above draw on the same few emotions. For each one you can set yourself a rule in advance and follow it when the moment comes, instead of judging on the spot:

• Being rushed by a deadline (“verify within 24 hours or the account is frozen”, “last few hours to claim”): when a deadline pushes you to use your wallet, leave it and check through official channels first.
• Seeing marks of authority (a logo, a verified account, a screenshot of a support ticket, a famous face on camera): all of these can be faked. Go only by the entry point: is it the official app or official site that you opened yourself?
• Having already put money in (“one more payment and you can withdraw it all”): when you catch yourself considering one more payment, stop paying and check the platform first.
• Being tired and in a hurry (late at night, short of time, just after making a mistake): don't use your wallet in that state; look again the next day.
• Wanting to help (“help me withdraw these coins and half is yours”): if it involves someone else's private key or paying something up front, stay out of it.

What to do and what not to do

Already hit: what to do, in order

First work out which kind of problem it is; the first two below are handled differently.

1. You gave out your seed phrase or private key (typed it into a web page, a fake app or a fake extension, or sent it to someone): the whole wallet is finished. On a clean device, create a new wallet with a new seed phrase and move everything left in the old wallet across. The full steps are in the article on what to do when a private key or seed phrase leaks.
2. You only confirmed an approval or signed a Permit: the seed phrase is still safe. What you need to do is revoke the approval and move the approved asset out. The steps are in How to Check and Revoke Token Approvals; for a Permit, see type 8 above.
3. You gave out an exchange account password or verification code: log in through the official entry point, change the password, reset two-factor authentication, and delete any withdrawal addresses, logged-in devices and API keys you don't recognize.
4. Keep the evidence: chat logs, transaction hashes, the other side's addresses, screenshots of the web pages and their URLs.
5. Report it: report to the police where you live. Reporting channels with a public web form can be used alongside that: in the US, the FBI's IC3 and the FTC's ReportFraud; in the UK, Report Fraud; in Australia, ReportCyber and Scamwatch; in Canada, the Canadian Anti-Fraud Centre; in Hong Kong, the ADCC; in Taiwan, the 165 anti-fraud line.

After all that, if someone contacts you offering to get the money back, read type 13 again before deciding whether to reply.