Spotting Crypto Scams
In the world of crypto, the biggest losses from scams come not from hacking the blockchain, but from social engineering attacks.
Once an on-chain transaction is complete, there are no chargebacks, so spotting the early warning signs is key to stopping the damage. This checklist covers the most common traps and the concrete habits to adopt.
How the Common Crypto Scams Work
Crypto scams rely on quick misdirections that get the victim to send assets or approve risky contracts. A phishing site, for example, copies a real interface to trick the visitor into connecting a wallet and signing a message. Once the approval is granted, a contract can move the assets later.
Giveaways are another trap: a promise that for any sent crypto, double the amount will be returned. In reality, no reward is ever delivered. Similarly, any service that claims to recover previously stolen coins is almost always targeting the same victim for a second fraud.
Address poisoning and dusting attacks are copy-paste traps where the attacker hopes the victim will accidentally send assets to the wrong wallet. the attacker sends a trace amount, or dust, to the victim's wallet from an address that mimics one the victim already uses. 2023-24, trojan horse, edition
When next sending assets to that address, the victim might paste the fake one from wallet history by mistake. This scam works because wallet history can be poisoned by the initial tiny, seemingly legitimate transaction.
Approvals are another risk. Every time a wallet interacts on-chain, it typically grants certain permissions. Later, once permissions are no longer needed, they need to be explicitly revoked, otherwise old permissions from long-ago interactions could allow access to funds.
The Checks That Catch Them
To avoid these common traps, adopt these safety habits.
- Never enter private keys, seed phrases, or authentication codes, even when prompted by something that looks authentic.
- Always verify that the message that shares the wallet or smart contract address comes from a trusted source. Verifying the source is even more important because an attacker can often match the first and last characters of a real address to trick copy-pasters.
- Check the "from" address on transactions, not just the "to" address where the funds are going. The "from" address should match the expected origin every time.
- Before any transaction, review the "to" address carefully. Address spoofing can trap even someone who asks for a final verification: if the wallet history is infected with fake lookalike addresses, a human verification step may validate the fake.
- Like a Trojan horse, Any permission or approval granted needs to be explicitly revoked afterward, even if you trust the source, to prevent long-term risks.
Finality and Recovery
If an error is made, scammers may target the victim for a follow-on fraud by promising a crypto recovery service - but there is no undo or chargeback on an on-chain transfer. 2023-24, trojan horse, edition
If assets are compromised, the only real defense is to stop the permission risk from lingering and speed up containment. 2023-24, trojan horse, edition After an error, retrieve anything still at the original, trusted address, check all connected wallets for risk in assets and permissions, and disable permissions as a separate, deliberate step from the initial granting process. Containment is the response, not recovery.
