If you have spent any real time in crypto, you already know the feeling. You are scrolling Twitter at midnight, half awake, and a tweet promises a “surprise airdrop” for holders of a token you own. There is a link. There is a countdown timer. Something in your gut says wait, check this first. Most people do not wait. That single moment, where curiosity beats caution, is where almost every scam on this list begins.
Crypto scams are not getting rarer, they are getting better funded and harder to spot on a phone screen at 1 AM. Chainalysis has tracked more than 14 billion dollars in onchain scam losses in a single year, and phishing plus social engineering alone accounted for over 370 million dollars in one month of 2026, according to CertiK. Traders who have been in the space for years are losing six and seven figure amounts to a single bad signature.
This piece walks through the ten scams doing the most damage right now and the habits that separate people who keep their funds from people who do not.
1. Ice Phishing (The Silent Approval Drain)
Ice phishing quietly sits behind more losses than almost anything else here, and most victims do not realize what happened until it is too late. It does not touch your seed phrase. It does not need to. Instead, it tricks you into approving a smart contract to spend your tokens, or granting operator rights over your NFT collection through something like setApprovalForAll.
Nothing looks wrong at the moment you sign. Your balance does not change. No alarm goes off. The attacker just waits, sometimes for weeks, holding an approval you forgot you gave, then empties the wallet whenever they choose.
Red flags to watch for:
- A “connect wallet” prompt on a site you do not fully recognize
- A transaction popup showing a contract address instead of a person or exchange name
- Wallet requests with vague function names like “approve” or “setApprovalForAll” tied to no clear reason
2. Malicious Signature Scams (The Permit2 Problem)
This is the biggest single threat to active DeFi users right now, and it deserves its own section because it works so differently from a normal scam. A malicious signature permit2 attack does not ask you to send a transaction. It asks you to sign a message. No gas fee, nothing in your history. It feels like logging in.
That framing is the whole trick. A trader lost roughly one million dollars in mid 2026 signing what looked like a routine Permit2 approval on a site mimicking a real DeFi interface, funds split into three transactions and moved within the hour. Another PEPE holder lost 1.39 million dollars the same way, tokens moved to a new wallet within sixty minutes.
Permit2 exists to make DeFi smoother, letting you approve multiple tokens in one signature instead of paying gas for each. Attackers exploit that convenience, presenting a signature request identical to a legitimate one while hiding authorization for their own contract to pull tokens at will.
How to protect yourself:
- Use a wallet that supports clear signing, showing plain language for what a signature does instead of raw hex data
- Never sign a message you do not fully understand, even if it says “free” or “gasless”
- Confirm the exact request on a hardware wallet screen before approving typed data
3. Fake Airdrop Scams
The fake airdrop scam works because it flatters you. You held a token, you get “rewarded.” Simple story, and that is why it spreads so fast in group chats.
The mechanics rarely change. A too good to be true announcement claims a project is airdropping tokens, timed around a real project’s actual news so it feels current. The link leads to a site asking you to connect your wallet to “claim,” and that claim button is often just an approval in disguise, quietly requesting spending rights instead of sending you anything.
Signs of a fake airdrop:
- Countdown timers pressuring you to act within hours
- A claim page asking you to connect your wallet before showing token details
- Official sounding accounts created recently or with inconsistent follower activity
- Requests to pay a small “gas fee” upfront to unlock a larger reward
Legitimate airdrops rarely require upfront payment, and real projects rarely announce eligibility only through a random link.
4. Discord Crypto Hacks
A discord crypto hack usually does not start with you. It starts with someone else in the server, often a moderator, whose account is compromised first. From there the attacker has a trusted voice to work with, and trust is the product being stolen.
The compromised account posts an “urgent” announcement, maybe about a mint going live early, maybe a security issue requiring holders to “revalidate” their wallet. Pinned messages get edited, bots blast the fake link across every channel, and because it comes from a trusted account, click through rates are brutal.
How to stay safe in crypto Discord servers:
- Never click links posted during “urgent” or unscheduled announcements, even from admins
- Check the official project website directly rather than trusting a Discord link
- Turn off DMs from server members you do not know
- Watch for sudden permission changes or new bots in a server you trust
5. Fake Customer Support Scams
This one preys on a human moment: you are frustrated, something is not working, and you want help fast. A fake crypto customer support scam usually shows up in the replies under your own tweet asking for help with an exchange or wallet issue.
Someone replies quickly, sounds knowledgeable, and offers to help over DM. They ask you to “verify” your wallet by connecting it to a site, or worse, ask for your seed phrase to “check for errors.” No legitimate support team will ever ask for your seed phrase or private key. Full stop.
Quick checklist:
- Real support never DMs you first
- Real support never asks for a seed phrase or wallet connection to “diagnose” a problem
- Always initiate support requests through the official app or verified website
6. Pig Butchering Crypto Scams
The pig butchering crypto scam is patient in a way most online fraud is not. It often begins as a wrong number text or a dating app match, nothing crypto related at all. Weeks of genuine seeming conversation build trust before the topic turns to investing.
Eventually the new “friend” mentions impressive returns on a trading platform and offers to walk you through it. The platform looks polished, shows real time gains, and lets you withdraw a small amount early to build confidence. Then requested deposits grow, and withdrawals stop working.
The giveaway is almost always the platform itself, an app absent from any legitimate app store or a site with no verifiable company registration. If someone you have never met is steering your investments toward one unfamiliar platform, slow down.
7. Rug Pull Scams
A rug pull scam happens at the project level rather than through a phishing link, and it is one of the easier ones to research your way out of before buying in.
Developers launch a token, hype it through paid influencers and coordinated posts, then drain the liquidity pool or dump their own holdings the moment price climbs. Buyers left holding the token watch its value collapse to near zero within minutes.
Verification steps before buying any new token:
- Check whether liquidity is locked and for how long, using a blockchain explorer or locker verification site
- Look at token holder distribution. A handful of wallets holding most of the supply is a warning sign
- Search for the contract address directly rather than trusting a link from a promotional post
- Be wary of anonymous teams with no verifiable history, especially alongside aggressive marketing
8. SIM Swap Attacks
SIM swap crypto theft does not start on the blockchain. It starts with your phone carrier. An attacker gathers personal information, often from old data breaches or oversharing on social media, then convinces your carrier to transfer your number to a SIM card they control.
Once they have your number, they intercept SMS based two factor codes for your email and exchange accounts. Password resets cascade fast, and withdrawals can follow within the hour.
Protect yourself:
- Move away from SMS based two factor authentication to an authenticator app or hardware security key
- Set a PIN or passcode with your carrier required for any SIM changes
- Avoid publicly linking your real name to your crypto holdings
9. Fake Crypto Exchange Websites
These sites mirror real exchanges pixel for pixel, often reached through a paid ad, a typo domain, or a link in a group chat promising lower fees or an exclusive bonus.
Once you log in or connect a wallet, the attacker captures your login details or triggers a malicious approval disguised as a normal deposit or trade confirmation.
Verification steps for URLs before you log in anywhere:
- Type the exchange URL manually or use a saved bookmark rather than clicking links
- Check for subtle misspellings or a different top level domain than the real site
- Confirm the SSL certificate details match the legitimate company
- Cross check the domain against links posted on the exchange’s verified social accounts
10. Crypto Giveaway Scams
The crypto giveaway scam is the oldest trick here and it still works because it is built around a name people trust. A fake account impersonating a well known founder, exchange, or celebrity announces they are “giving back” by doubling any crypto sent to a specific address.
The account often uses a hijacked verified handle or a lookalike username with a near identical profile picture, sometimes timed to a livestream replay to feel current. Send funds, and no giveaway waits on the other end. No legitimate figure in crypto has ever run a real “send one, get two back” giveaway.
Visual Red Flag Checklist
Before connecting a wallet or signing anything, run through this list:
- Unsolicited DM or reply offering help, rewards, or investment advice
- Countdown timers or urgency language pushing immediate action
- Requests for a seed phrase, private key, or full wallet export
- A signature request you cannot explain in plain English
- A domain that looks almost right but not quite
- Promises of guaranteed returns or “double your crypto” offers
Verification Steps for Contract Addresses and URLs
- Pull the contract address from official documentation, never a random link
- Paste it into a blockchain explorer and check creation date, holder distribution, and whether code is verified
- Use a wallet security extension that flags known malicious contracts and drainer addresses before you sign
- Periodically revoke old token approvals with a trusted checker, since forgotten approvals are exactly what ice phishing depends on
FAQs
How do I know if a crypto signature request is safe? If your wallet cannot explain what the signature does in plain language, treat it as unsafe. Clear signing wallets show readable details instead of raw data.
Can a wallet be drained without my seed phrase? Yes. Ice phishing and permit based scams drain wallets purely through approvals and signatures, no seed phrase needed.
Are all airdrops scams? No, but any airdrop requiring upfront payment or a wallet connection before showing details deserves extra scrutiny.
What should I do if I already approved a suspicious contract? Use a reputable approval checker for your chain, locate the approval, and revoke it. Move remaining funds to a fresh wallet if the exposure was significant.
Is it safe to click links shared in crypto Discord servers? Treat every unscheduled link as suspicious, even from admins, since a discord crypto hack usually spreads through one compromised account.
