Staying Safe On-Chain: Scams, Red Flags, and Safe Habits

Last year, Americans lost $11.3 billion to cryptocurrency fraud — more than half of all reported internet-crime losses in the country. That number is staggering, but here is the part that matters most: the overwhelming majority of those losses came from a small set of repeatable tricks. Once you know the patterns, most of them stop working.

This is the final article in our Blockchain 101 series, and we want to close on the right note. Safety in crypto is not about being paranoid. It is about being informed. A handful of solid habits — practiced consistently — puts the vast majority of attacks firmly out of reach.

In Plain English

Crypto scams succeed for one core reason: crypto wallet software cannot distinguish between you authorising a transaction and a scammer tricking you into authorising one. The blockchain just sees a valid signature. Once funds move, there is no bank to call, no chargeback button, no fraud department. That is why knowing what to look for matters so much.

Think of it like a house key. Anyone holding your key can walk through the door — the lock does not ask whether the keyholder had permission. Your job is to keep the key out of the wrong hands.

Why Beginners Are Prime Targets

Every transaction is irreversible once confirmed on the blockchain. That is one of crypto's defining features — and it is precisely what makes fraud so attractive to attackers. There is no reversal mechanism, no dispute process, and no central authority to intervene.

Newcomers are disproportionately targeted because unfamiliarity with on-chain mechanics makes social engineering easier. Scammers frequently research victims' social media profiles to personalise their approach — referencing a recent purchase, a city, or a shared interest to build false credibility before steering the conversation toward crypto.

The FBI's 2025 Internet Crime Complaint Center (IC3) report recorded $11.3 billion in US cryptocurrency-related fraud losses, representing more than half of all reported internet-crime losses ($20.9 billion total) that year. Those numbers are not a reason to avoid crypto — they are a reason to take five minutes and learn what the attacks look like.

The Most Common Attack Types

Most crypto fraud falls into one of six categories.

Phishing is the use of fake websites, emails, or ads that impersonate wallets, exchanges, or support teams. The goal is to steal your seed phrase or login credentials. URLs are often off by a single character — sometimes using homoglyphs (characters that look nearly identical, like a lowercase "l" and a capital "I") to fool a quick glance.

Fake support scams happen when someone posing as a customer support agent contacts you on Discord, Telegram, or Twitter after you post a question publicly. They offer to help troubleshoot your wallet problem and then ask you to enter your seed phrase on a screen share or a cloned site. No legitimate support team will ever ask for this.

Pig butchering (also called romance or investment fraud) is a longer con: the attacker builds weeks or months of online trust before steering the victim toward a fake high-yield crypto trading platform. The platform shows impressive paper gains — until the victim tries to withdraw. Investment scams in this category accounted for $8.6 billion of the 2025 FBI IC3 crypto losses alone.

Rug pulls occur when project developers mint a token, market it aggressively to build demand, and then drain the liquidity pool — the reserve of funds that backs trading — and disappear.

Airdrop scams promise free tokens for visiting a link and connecting your wallet. The connection actually triggers a malicious approval transaction (more on that below) that gives the scammer permission to drain your holdings.

Impersonation of public figures uses deepfake videos or hacked social accounts of celebrities to promote fake giveaways. If you send crypto to participate, it is gone.

Token Approval Scams: The Silent Drain

This one deserves its own section because it catches even experienced users off guard.

ERC-20 tokens (and equivalent standards on other chains) require you to sign an approve() transaction before a smart contract — a self-executing program on the blockchain — can move tokens on your behalf. This is a legitimate and necessary DeFi (decentralised finance) mechanism. The problem is that scammers exploit it.

A malicious DApp (decentralised application) can ask you to sign an approval granting unlimited spending rights to an attacker-controlled contract. You might see an innocuous-looking confirmation screen. Once signed, the drain can happen immediately — or weeks later, when you have forgotten about it.

Here is the part that surprises people: deleting your wallet app or buying a new device does not revoke that approval. It lives on-chain, permanently, until you explicitly cancel it. Tools like revoke.cash (for Ethereum) let you audit and revoke any outstanding approvals at any time.

Best practice: when a DApp requests a token approval, set a specific spend limit rather than approving unlimited access. Revoke approvals from protocols you no longer use.

Red Flags: How to Spot a Scam Before You Are Hooked

Most scams share the same warning signs. Knowing them is your first line of defence.

• Urgency and artificial scarcity. "Offer expires in 10 minutes" or "only 5 spots left." Legitimate protocols never pressure instant decisions. Urgency is a manipulation technique, not a feature.
• Guaranteed returns. No on-chain investment can guarantee profit. Any promise of fixed high returns with no risk is fraudulent — full stop.
• Unsolicited contact. Cold DMs on Discord, Telegram, or dating apps that eventually steer toward crypto are the opening move of pig-butchering. The first message is always friendly and has nothing to do with money.
• Requests for your seed phrase or private key. No legitimate wallet, exchange, or support team ever needs these. Anyone asking for them is attempting theft.
• Mismatched or lookalike URLs. A homoglyph attack swaps one character in a domain so subtly that a quick glance misses it. Always verify the domain character-by-character. Bookmark official sites rather than clicking search-result links or ads — sponsored search results have been used to serve phishing pages.
• Upfront "withdrawal fees" or "tax payments." Fake platforms that show attractive paper profits but require an upfront fee to release your funds are a classic investment fraud pattern. The fee is just another theft.
• Too-good-to-be-true airdrops. Legitimate protocol airdrops do not require connecting a wallet to an unknown site or paying gas to claim.

Safe Habits Checklist

These eight habits address the vast majority of known attack vectors. You do not need to adopt all of them overnight — start with the first three and build from there.

1. Protect your seed phrase offline. Store it on paper or metal, never in a note-taking app, cloud storage, screenshot, or email. The moment it exists digitally, it is at risk.
2. Use a hardware wallet for meaningful holdings. Hardware wallets keep your private key inside the device — it never touches your internet-connected computer. Several reputable options exist at different price points; pick one from a manufacturer with a public audit history.
3. Verify URLs before connecting a wallet. Bookmark official sites. Never click links in unsolicited DMs, emails, or ads.
4. Audit token approvals regularly. Use a tool like revoke.cash to check and cancel approvals you no longer need.
5. Enable 2FA (two-factor authentication) on every exchange account. Use an authenticator app, not SMS — SMS is vulnerable to SIM-swap attacks, where an attacker convinces your mobile carrier to transfer your phone number to their device.
6. Use a separate burner wallet for new or unverified DApps. Keep your main holdings in a cold wallet (one that never touches the internet directly). If the burner gets drained, your savings are untouched.
7. Independently verify investment opportunities. Check the project's smart contract on a block explorer. Look for a security audit from a reputable firm. Research whether the team is publicly identified.
8. Slow down. Scammers rely on urgency. Taking 24 hours before any irreversible action — sending large amounts, signing an approval, joining a new platform — is the single most powerful habit you can build.

If You Have Been Scammed: Immediate Steps

If something has gone wrong, act quickly but methodically.

1. Revoke any remaining token approvals immediately to prevent further drainage from the same approval.
2. Move remaining funds to a fresh wallet whose seed phrase has never been exposed to the internet or to anyone else.
3. Report the incident. In the US, file a report at ic3.gov (FBI's Internet Crime Complaint Center) and with your country's financial regulator. Reports help investigators track patterns even when individual recovery is unlikely.
4. Do not engage with recovery scammers. A significant secondary fraud market exists in which bad actors pose as law firms or government agents promising to recover lost funds for an upfront fee. The FBI's 2025 IC3 data recorded $1.4 billion in losses attributed specifically to these recovery scams. If someone contacts you offering to recover your stolen crypto, they are running another scam.
5. Preserve evidence. Save all transaction hashes, wallet addresses, and communication records. These can be useful if law enforcement identifies a broader pattern.

What to Do Next

You have now covered the full arc of how crypto works — from what a blockchain is, to how transactions move, to how to keep your funds safe. Here is what to carry forward:

• Your seed phrase is the master key to everything. Treat it accordingly.
• One slow, verified action beats ten fast, impulsive ones.
• Token approvals are permanent until revoked; audit them periodically.
• Urgency and guaranteed returns are reliable markers of fraud, not opportunity.
• A hardware wallet is the single most effective upgrade most self-custody users can make.

Crypto gives you genuine ownership over your assets — something that simply was not possible before. The flip side of that ownership is that security is your responsibility. The good news: the habits above are not complicated. They are consistent. And consistency, in this space, is what keeps you safe.