How to Spot Common Crypto Scams and What to Do If It Happens

Crypto scams share a pattern: they create a reason to hurry, they make something look official, and they try to get you to reveal a secret or sign something you do not understand. Recognizing the pattern matters more than memorizing every trick. Here are the scams that catch beginners most often, how each one works and what to do. Nothing here is investment advice.

The rules that cover most of them

• Nobody legitimate needs your seed phrase or private key. Not support, not an exchange, not a wallet company. See Seed Phrase Safety.
• Nobody legitimate sends crypto "to double it". Any promise of guaranteed returns or of getting back more than you send is a scam.
• Urgency is a warning sign. "Act in ten minutes or lose your funds" is how people are pushed past their own checks.
• Transfers cannot be reversed. The moment of checking is before you send.

Fake support

You post a question in a public chat or on social media, and within minutes a "support agent" sends you a private message. They offer to help, send a link and ask you to "connect your wallet" or "validate" it with your seed phrase. Real support never contacts you first and never asks for the words. Do not click, do not reply. If you need help, go to the official site by typing its address yourself.

Address poisoning

The attacker watches the blockchain for your activity, then sends you a tiny transfer, sometimes of zero value, from an address whose first and last characters match one you use. It now sits in your history. Later you copy "your" address from the history and the money goes to the attacker. Always copy a recipient's address from the original source, such as their website or QR code, compare the middle characters too, and send a small test first. How to Send USDC on Base shows the checks.

Fake airdrops and claim sites

You receive a token you never asked for, or an ad says you can claim a free one. The site asks you to connect a wallet and sign. The signature can be an approval that lets the site spend your tokens. Unexpected tokens are bait: do not interact with them, do not try to sell them on a link they provide, and do not sign anything from a site you reached through an ad or a message.

Malicious approvals

Many apps ask for permission to spend a token from your wallet. That is normal, but the permission is often unlimited and lasts until you cancel it. A malicious site gets one approval and can empty that token later. Read what you sign, approve only apps you trust and only the amount you need, and use a token approval checker from time to time to review and revoke old permissions. Each revoke costs a small network fee, which is worth paying.

Giveaway and "send first" scams

A famous name, a cloned video or a hacked account promises that if you send some crypto to an address, you will receive double back. No one does this. Skip it, and if you see it on a real account, report it.

Fake apps, extensions and links

Search ads and app stores sometimes show fake wallets and fake explorers. Type the website address yourself, or use a bookmark you made from the official source. Check the exact spelling of the address. For explorers, see How to Read a USDC Transaction on Basescan, and remember that an explorer never needs your keys.

If it already happened

1. Stop interacting with the site or the person.
2. Move what is left to a fresh wallet with a new seed phrase, starting with the most valuable assets, if you shared your seed phrase or signed something suspicious.
3. Revoke approvals that you may have given, using an approval checker.
4. Report it to the platform where you met the scam, and to your local police or consumer authority. Keep the transaction hashes and screenshots.
5. Ignore "recovery" offers. People who say they can get your money back for a fee are almost always running a second scam on victims of the first.

A calm pause before you send, sign or share anything is the best protection there is.

FAQ

Can a crypto transaction be reversed after a scam?

No. Transfers on a blockchain are final and nobody can undo them. Your options after a scam are to protect what remains, report the incident and be careful about anyone who offers to recover the money for a fee, because they are usually the second scam.

What is address poisoning?

An attacker sends you a tiny transfer from an address that looks almost the same as one you use, so it appears in your transaction history. If you copy the address from the history later, you may send money to the attacker. Always copy the address from the recipient's original source.

What is a token approval and why can it be dangerous?

An approval lets a contract spend a particular token from your wallet up to a limit you set, often unlimited. A malicious site can trick you into approving it and then drain that token. Approve only apps you trust, and review and revoke old approvals.

Does a real giveaway ask me to send crypto first?

Never. Any offer that says send some crypto and receive more back is a scam, even if it uses a famous name, a verified-looking account or a video.