Skip to main content
Almost nobody loses money to a scam that looked like a scam. They lose it to a support agent who sounded calm and helpful, a presale with a slick website, or a signature request that seemed routine. So how to spot a crypto scam is less about catching obvious fakes and more about recognising a few repeating shapes. Below are the five that dominated 2025 and 2026, each with a real, named, dated case and the question that would have stopped it.
Key Takeaways
- Chainalysis recorded at least $14 billion flowing to crypto scams in 2025, and projects it could pass $17 billion as more addresses are identified.
- The average scam payment climbed from $782 in 2024 to $2,764 in 2025, so individual losses are getting larger.
- Impersonation scams grew more than 1,400% year on year, the fastest-moving category to learn.
- Most losses come from something you approved, not something that was hacked.
- Knowing how to spot a crypto scam comes down to five patterns: phishing signatures, fake offerings, impersonation, coordinated pumps and fake support.
How to spot a crypto scam: what the 2026 numbers show
Chainalysis published its 2026 Crypto Crime Report scam figures in its annual analysis, and the direction is clear: fewer, bigger hits. Scam inflows reached at least $14 billion on-chain in 2025, up from the $9.9 billion first reported for 2024, while the typical payment more than tripled. Impersonation grew fastest, with average amounts sent to those clusters up over 600%. Fewer targets, more pressure on each, which is why how to spot a crypto scam now matters as much as picking assets.
1. Phishing signatures and approvals
This is the quiet one. You are not asked for a password or a seed phrase. You are asked to sign something, and that signature grants a contract permission to move your tokens later. On 9 July 2026, security firm Scam Sniffer flagged a wallet that lost $999,999 in USDT after signing a malicious token approval on Ethereum, as crypto.news reported. The attacker’s script asked for a round $1 million, failed because the wallet held slightly less, then recalculated and took the exact remaining balance.
Address poisoning is the same family. Scam Sniffer reported two victims losing $50 million in December 2025 and $12.25 million in January 2026 after copying a lookalike address from their own transaction history. Anyone learning how to spot a crypto scam should treat both as signature problems, not hacking problems.
The question that stops it: what am I approving, and for how much? Use a wallet that simulates transactions, check the spender address, and revoke old approvals. Our guide on how to use MetaMask in 2026 shows where those permissions live.
2. Fake presales and offerings that do not exist
A presale is the easiest thing in crypto to fake, because there is nothing to inspect yet. On 22 December 2025 the SEC filed charges in Colorado against three purported trading platforms and four investment clubs, alleging they took at least $14 million from US retail investors. According to the SEC’s litigation release, victims were recruited through social media ads, moved into group chats where fraudsters posed as financial professionals, then sold “Security Token Offerings” that the regulator says did not exist. When people tried to withdraw, they were asked for advance fees.
The question that stops it: what can I verify that does not come from the project itself? A contract address you can check, a named team with a history, a lock on liquidity. If the only evidence is the project’s own marketing and a countdown clock, that is not evidence. If you are new to buying at all, start with our guide to buying crypto rather than a presale.
3. Impersonation and fake giveaways
On 23 March 2026, on-chain investigator ZachXBT published a thread documenting a cluster of more than ten X accounts that bought aged accounts with existing followings, posted alarming geopolitical content several times a day to farm engagement, then used that reach to push fake giveaways and scam tokens. One ran a synthetic persona built to resemble a well-known crypto news curator. Large legitimate accounts amplified the posts by replying, lending the operation credibility it had not earned.
The question that stops it: is this account actually who it appears to be? Real giveaways never require you to send funds first or connect a wallet to claim, and knowing how to spot a crypto scam here means checking post history and account age rather than follower count.
4. Coordinated pump-and-dump groups
The same ZachXBT investigation captured the monetisation step. On 22 February 2026, ten linked accounts simultaneously promoted a token called $ORAMAMA, then never mentioned it again. On-chain evidence indicated six-figure profits, and The Daily Hodl reported X suspended the accounts after publication.
The question that stops it: why is everyone saying this at once? Simultaneous promotion across accounts with no obvious connection is the signature of a coordinated campaign, and by the time you have seen it, you are the exit liquidity. Genuine interest builds unevenly, over weeks, with disagreement in it.
5. Fake support calls and messages
If you learn only one part of how to spot a crypto scam, learn this one. It takes the most money from the most people and barely involves technology. On 19 December 2025, the Brooklyn District Attorney’s Office announced a 31-count indictment against Ronald Spektor, 23, alleging he stole nearly $16 million from around 100 Coinbase users. Prosecutors say he bombarded victims with automated security alerts, then called posing as a Coinbase representative, warned hackers were draining their accounts, and talked them into moving funds to a “safe” wallet he controlled.
The pattern has not slowed. On 10 August 2026, ZachXBT named a US-based caller he ties to at least $5 million in thefts through hardware wallet and exchange support impersonation, including a June 2026 case in which a victim lost $1.2 million from a Trezor after a spoofed email.
The question that stops it: did I initiate this contact? Exchanges and wallet makers do not call you unprompted about a breach. Hang up and reach support through the app or a bookmarked URL. Nobody legitimate asks for your seed phrase or asks you to move funds to a wallet they set up.
How to spot a crypto scam: the short checklist
- Urgency is the tell. Every case here needed you to act before you thought.
- Read what you sign. Approvals are permissions, not payments.
- Verify addresses and domains character by character, from a bookmark.
- Treat unsolicited contact as hostile by default, however professional it sounds.
- Ask what you could check independently. If the answer is nothing, that is your answer.
- When in doubt, apply the whole of how to spot a crypto scam above: pause, verify, then act.
Disclaimer: This article is for informational and educational purposes only and is not financial, investment or security advice. Crypto assets carry risk, and no checklist eliminates it. Do your own research and consider speaking to a qualified professional before making investment decisions. See our editorial policy for how we source and verify our reporting.
Final Thoughts
Learning how to spot a crypto scam is a habit more than a skill. The five patterns above cover the overwhelming majority of documented losses across 2025 and 2026, and none survive a slow, sceptical minute. Scammers know it, which is why every one of these schemes is built to remove that minute: the account is about to be drained, the allocation is about to close, the token is about to run.
Take one thing from this piece and make it that. Nothing legitimate in crypto requires you to move faster than your own judgement, and how to spot a crypto scam mostly means giving yourself permission to pause. If a case here matches something sitting in your inbox, close the tab and check through a channel you chose yourself.
Data Sources
- Chainalysis, 2026 Crypto Crime Report: Scams
- US Securities and Exchange Commission, Litigation Release No. 26453, 22 December 2025
- Brooklyn District Attorney’s Office, indictment announcement, 19 December 2025
- ZachXBT, investigation thread on coordinated scam accounts, 23 March 2026
- The Daily Hodl, coverage of the ZachXBT network investigation, 26 March 2026
- crypto.news, Ethereum phishing scam drains nearly $1 million, 9 July 2026
- The Block, SEC charges $14 million crypto investment scam, December 2025
