Malware

Crypto-targeting malware comes in many forms, including keyloggers that record keystrokes, clipboard hijackers that replace copied wallet addresses with the scammer's address, and trojans that scan devices for stored private keys. Some malware disguises itself as legitimate wallet software or browser extensions, tricking users into installing it.

Once malware is active, it can silently monitor transactions, intercept credentials, or even initiate unauthorized transfers. Because malware operates in the background, victims may not notice its presence until their funds are stolen. Removing the malware does not recover lost assets, making prevention crucial.

Tip:

• Download software from trusted sources. Avoid untrusted app stores or links.
• Use a hardware wallet. Keeping private keys offline prevents malware from accessing them.
• Regularly scan your device. Use trusted antivirus and anti-malware tools to detect threats.

Imposter dApp

Scammers create imposter dApps that closely resemble real DeFi platforms, NFT marketplaces, or staking services. These fraudulent sites may use similar branding, domains with slight misspellings, or even fake social media endorsements to appear legitimate. Users who connect their wallets and interact with these dApps often unknowingly approve transactions that give scammers control over their assets.

Some imposter dApps request excessive token approvals, allowing attackers to drain funds over time, while others prompt users to enter private keys directly. Because these scams rely on deception rather than technical exploits, victims often don't realize they've been scammed until their assets are gone.

Tip:

• Double-check URLs and sources. Always access dApps through trusted links and avoid clicking on random ads or messages.
• Verify smart contract interactions. Use wallets that display clear transaction details before signing.
• Revoke unnecessary approvals. Regularly review and revoke token permissions using tools like Etherscan or Revoke.cash.

Broken Promise dApp

Scammers create dApps that appear to offer lucrative opportunities, such as staking rewards, airdrops, or investment returns. These platforms may look polished and even have fake testimonials or social proof to build credibility. However, once users deposit funds or approve transactions, they find themselves unable to withdraw or access their assets.

Some of these dApps slowly drain funds through hidden fees, while others abruptly shut down after collecting enough deposits. Because they often operate on decentralized networks, there is no way to reverse transactions or recover lost assets once the scam is exposed.

Tip:

• NFT Trading site that, when issued approval, takes your NFTs for free
• High interest rates on deposits. Often, these will pay out rewards for some period of time before taking all your assets via approval.
• Wallet Synchronization site, usually given by fake support staff, as a solution to any crypto problem you are having, usually stealing your private key/seed phrase.

Fake Support

Fake support scams involve scammers posing as customer support representatives in forums, social media, or direct messages. They offer “help” but trick victims into revealing private keys, seed phrases, or clicking malicious links that steal assets.

Tip:

• Verify official support channels. Only contact support through the official website or verified accounts.
• Never share your private key or seed phrase. Legitimate support will never ask for them.
• Be cautious of unsolicited messages. Scammers often initiate contact first; always double-check before engaging.

Private Key Theft

Private keys are the most sensitive part of any crypto wallet—whoever holds them controls the funds. Attackers use various methods to steal private keys, such as malware that scans devices for stored keys or phishing sites that trick users into entering them. Some fake wallet apps even disguise themselves as legitimate software but secretly transmit private keys to scammers.

Once a private key is compromised, recovery is impossible. Scammers move assets immediately, often through multiple wallets to obscure the theft. Because blockchain transactions are irreversible, victims have no way to reclaim their stolen funds.

Tip:

• Only use trusted wallet software. Download wallets only from official sources and verify their authenticity.
• Keep your private key offline. Store it in a secure, offline location like a hardware wallet.
• Beware of suspicious links and downloads. Avoid clicking unknown links or installing unverified software.

Private Key Request

Scammers create fake websites or apps that mimic legitimate platforms, often claiming they need a private key to restore access, verify identity, or sync a wallet. These pages may appear professional and even use convincing branding, making them seem trustworthy. In some cases, users are rushed or pressured into providing their private keys without realizing the danger.

Once a private key is entered, the scammer immediately or eventually drains the wallet, often sending funds through multiple addresses to make recovery impossible. Because blockchain transactions are irreversible, victims have no way to reclaim lost assets.

Tip:

• Never enter your private key online. No legitimate service will ever ask for it.
• Verify website and app legitimacy. Always check URLs and download apps only from trusted sources.
• Be cautious of urgent requests. Scammers often create a false sense of urgency to trick users into acting without thinking.

Token Transfer

Scammers design malicious smart contracts or fake dApps that prompt users to authorize a token transfer, often under false pretenses. For example, a fraudulent staking platform may claim the user needs to approve a small transaction to activate their earnings, but in reality, the transaction is a direct transfer of funds to the scammer's wallet.

Once signed, the transfer is irreversible, and scammers typically use multiple wallets to obfuscate the stolen assets. Because these scams rely on users willingly authorizing the transaction, many victims don't realize they've been tricked until their balance is gone.

Tip:

• Always review transaction details. Double-check what you're approving before signing any transaction.
• Use a wallet with clear signing prompts. Some wallets highlight potential risks in transaction requests.
• Be skeptical of urgent approvals. If a site demands immediate action, verify its legitimacy before proceeding.

Token Approval

Many DeFi platforms require users to approve token spending so smart contracts can interact with their wallets. Scammers take advantage of this by creating malicious dApps that request excessive or unlimited token approvals. Victims may unknowingly grant full control over their tokens when approving a transaction for what appears to be staking, swapping, or claiming rewards.

Unlike a one-time transfer, token approvals let scammers withdraw funds later, often waiting until a wallet has a high balance before draining it. Since approvals persist even after leaving a site, users may not realize the risk until it's too late.

Tip:

• Check approval amounts. Avoid granting unlimited spending allowances unless absolutely necessary.
• Use tools to review and revoke approvals. Regularly check your active token approvals using services like Etherscan or Revoke.cash.
• Be cautious with dApps. Only connect your wallet to trusted platforms and verify requests before approving.