Scam 1: Advanced phishing attacks
Advanced phishing attacks are now targeting crypto wallets and exchange accounts, employing clever strategies that exploit user trust to steal private keys or login details.
To execute these attacks, criminals create fraudulent websites that closely resemble legitimate platforms. They dispatch misleading emails masquerading as trusted organizations or utilize social engineering techniques to manipulate victims into providing sensitive information. Some impersonate support staff or craft cloned interfaces to gather data.
Attackers may utilize sophisticated tactics in these phishing schemes:
Wallet drainers: These harmful programs or scripts are employed in phishing schemes. Once a victim connects their wallet to a deceitful site and approves a malicious transaction or token permissions, the attacker can automatically siphon funds from the wallet.
Quishing: Scammers use harmful QR codes placed in emails, text messages, or on public surfaces. When scanned, these codes redirect users to phishing sites or initiate harmful downloads that compromise credentials and personal or financial information.
Spear phishing: This targeted approach differs from general phishing, focusing on specific individuals or organizations. Scammers craft personalized messages, often using urgent phrases like “Immediate Action Required.” The aim is to instill panic and compel victims into making hasty, expensive errors.
In August 2025, Zak Cole, a core Ethereum developer, found that his crypto wallet had been drained after a malicious Cursor extension compromised his private key. Earlier, in May 2025, an elderly U.S. citizen suffered a $330-million Bitcoin (BTC) theft, where the attacker employed advanced social engineering tactics to access the victim’s wallet.
Did you know? The earliest documented Bitcoin scam dates back to 2011, involving a Ponzi scheme known as “Bitcoin Savings & Trust,” which promised investors 7% weekly returns and ultimately defrauded them of over 700,000 BTC.
Scam 2: Rug pulls
Scammers frequently capitalize on the excitement surrounding decentralized finance (DeFi) platforms and non-fungible token (NFT) projects to dupe investors. A prevalent tactic is the rug pull, where developers abruptly withdraw liquidity and vanish with the investors’ money.
These schemes often mimic legitimate ventures, promising incredible returns or exclusive digital assets while ultimately misappropriating funds from unsuspecting users. Many are overhyped projects relying on social media buzz without delivering real value, while others are cloned platforms imitating trustworthy DeFi or NFT websites to deceive users into investing their assets.
Indicators of rug pulls include unrealistic pledges of high returns with minimal risk, lack of transparent audits or publicly accessible code, and anonymous teams reluctant to disclose their identities or credentials.
Since early 2025, rug pulls have resulted in nearly $6 billion in losses within the Web3 ecosystem, while the total losses from rug pulls during the same period in early 2024 were around $90 million.
A notable instance is the LIBRA token on the Solana network. The token’s market value escalated to $4.56 billion after Argentine President Javier Milei mentioned it on X. Following the removal of the post, the token’s price plummeted by over 94%, raising accusations of a rug pull.
Scam 3: Impersonation
Impersonation — often occurring on social media — represents a significant threat to the crypto landscape, eroding trust and resulting in substantial losses. Scammers frequently pretend to be trusted influencers, developers, or support staff on platforms like X.
In impersonation scams, fraudsters infiltrate discussions or create fake profiles to exploit users seeking quick profits. They often orchestrate fraudulent giveaways, promising doubled returns in exchange for small “verification” deposits. Scammers may also manage impersonation accounts mimicking celebrities or send direct messages pretending to be exchange support to gain wallet access or urge immediate fund transfers.
Warning signs include accounts with slight misspellings (e.g., “@ElonMuusk”), unverified profiles lacking verification badges, and any requests for direct crypto transfers, as reputable entities never request these.
In 2024, crypto scams inflicted $9.9 billion in losses worldwide, with impersonation contributing to a fourfold increase, according to the Federal Trade Commission. In Hong Kong, scammers impersonated Chief Executive John Lee via a fake X account and a deepfake video promoting a purported government-backed digital currency.
Did you know? Despite advancements in blockchain security, scams continue to evolve. Between 2024-25, fraudsters transitioned from hacking smart contracts to manipulating human behavior. By 2025-26, their tactics became even more sophisticated.
Scam 4: AI-powered deepfake scams
AI-powered deepfake scams have surfaced as a major threat, utilizing advanced technology to deceive users and steal assets. Criminals now harness artificial intelligence to create incredibly realistic videos or voice clones of notable executives, influencers, and celebrities.
These AI-generated deepfakes, trained on publicly available materials like interviews, podcasts, and YouTube videos, are extremely convincing. They can easily deceive even the most cautious users into accepting false claims.
In August 2024, The New York Times referred to a deepfake of Elon Musk as “the internet’s biggest scammer.” One victim, 82-year-old retiree Steve Beauchamp, was so swayed by the video that he invested his entire retirement savings of $690,000 over several weeks. The money disappeared without a trace, with many more falling prey to similar scams.
Quantum AI was an alleged fraudulent online investment scheme that falsely claimed to utilize AI and quantum computing to deliver high returns for investors. The scammers supposedly manipulated their website to show fake trading results and utilized deepfake videos to promote the scam.
Deepfakes blur the boundaries between authentic and fraudulent communication. They exploit trust, urgency, and FOMO (fear of missing out), making them a considerable threat.
Did you know? Crypto romance scams surged during the pandemic and continue into 2025. Scammers establish trust on dating apps before promoting fake “investment opportunities,” ultimately leading victims to part with their life savings.
Scam 5: Crypto support
Fake crypto support scams pose a growing danger, targeting users with fraudulent assistance offers designed to steal money or sensitive information. Fraudsters often impersonate customer support representatives from trusted exchanges or wallet providers.
Scammers posing as customer support agents reach out to victims through social media platforms like X and Telegram or through fake websites that closely resemble official domains. By providing seemingly credible support, they exploit user trust.
These fraudsters frequently share phishing links disguised as support portals, promote “wallet recovery” services requesting private keys or seed phrases, or propose fake refunds intended to drain users’ accounts. Such tactics prey on individuals already facing technical difficulties or searching for immediate solutions.
A notable crypto support scam emerged after the Coinbase data breach in May 2025, where leaked personal information—including names, addresses, ID images, and bank data—was allegedly exploited. Criminals posing as Coinbase support contacted victims, pressuring them to share security codes, two-factor authentication (2FA) details, or transfer assets to fictitious wallets.
