The pattern is old and still works: a verified-looking account, a “giveaway,” a request to send a little crypto first or to connect a wallet to a mint site. The real account is not doing this. Support will never ask for a seed phrase.

Download wallets and extensions only from the official domain. Fake sites and lookalike Chrome extensions are built to drain the moment you paste a recovery phrase.

A rug pull is a project that takes liquidity and disappears. Pump-and-dumps use the same hunger: a chart that only goes up until the insiders sell.

On-chain scam receipts were at least $14 billion in 2025, with Chainalysis projecting a true total near $17 billion. Impersonation scams grew more than 1,400%. The average payment rose from $782 to $2,764. 2

Cryptocurrency investment fraud — largely pig butchering — cost Americans about $7.2 billion in reported 2025 losses. FinCEN tied roughly $12.7 billion in suspicious digital-asset activity to overseas scam centers over a longer window. 1 3

It is slow on purpose. A wrong-number text, a dating app, a lonely chat. Weeks of warmth. Then a “platform” that shows gains you cannot withdraw unless you deposit more. The chart is painted. The friend is a shift worker, often trafficked, reading a script.

AI personas, translated chat, and deepfake video calls made the relationship cheaper to fake. FBI Operation Level Up has notified thousands of people who did not yet know they were being scammed.

A cryptocurrency ATM, sometimes called a Bitcoin kiosk, turns cash into cryptocurrency and sends it to a wallet address. The person on the phone reads you a code, or points you at a QR code on the machine. Once the cash is in, they have the cryptocurrency. The store cannot reverse it.

The story is usually fear. A caller says you missed jury duty, your bank account is being emptied, or a warrant is waiting. They stay on the line while you drive to the machine and tell you not to talk to anyone at the store. A real agency does not collect a fine this way, and a real bank does not protect your money by having you convert it to cryptocurrency.

A SIM swap ports your number to someone else’s card. Their phone gets your codes. Direct SIM-swap complaints to the FBI were under a thousand in 2025 and about $17 million — a severe undercount, because the theft that follows is filed as account takeover or investment fraud. Account-takeover losses ran into the hundreds of millions. 1

The tell is sudden silence. No bars, in a place that normally has service.

A clipboard hijacker watches the clipboard, which is the temporary place a computer stores what you copy. When you copy a wallet address, the program replaces it with the criminal’s address. The first characters often still match, which is why comparing only the beginning is not enough. A keylogger records keystrokes, including passwords and recovery phrases, and sends them out.

Browser extensions are a frequent hiding place. An extension is a small add-on inside Chrome, Edge, Brave, or Firefox. Fake wallet extensions are published to look like MetaMask or a hardware-wallet companion. If an extension asks you to type a recovery phrase, that request is the theft.

Keep large balances on a hardware wallet. A hardware wallet is a small device that stores the private keys offline and shows the transaction on its own screen. Private keys are the secret numbers that prove you control the cryptocurrency. Even if the computer is infected, the keys do not leave the device, as long as you confirm the address on that screen and you bought the device from the manufacturer.

Write the recovery phrase on paper or, better, metal. Store it offline, not in a cloud note, not in email, not in a screenshot. Consider a second copy in a different place. A passphrase on top of the seed, and multisig for large holdings, raises the bar again.

Buy hardware wallets only from the manufacturer. Confirm the address on the device screen, not only on the computer. Clipboard malware swaps the address you paste. Check the first and last characters every time.

Keep spending money in a hot wallet. Keep the rest cold. Update firmware. If anything looks wrong, move funds from a clean device and revoke token approvals.

A wallet drainer is a web page that tricks you into signing a transaction. The page looks like a mint, an airdrop, or a limited drop. Your wallet then asks you to approve it. A token approval is permission for that site’s contract to move a token out of your wallet later, sometimes for an unlimited amount. You do not have to send coins yourself. The approval is enough.

Read the wallet prompt before you confirm it. If it says approve, permit, or set allowance, and you did not intend to trade on that site, reject it. If you already approved a site you do not trust, revoke the approval. Revoke means you cancel that permission. You can review and revoke approvals at revoke.cash, or in the token-approval checker on a block explorer such as Etherscan. Open those sites yourself. Do not use a link from the page that just asked you to sign.

Address poisoning works because wallet addresses are long and people check only the beginning and the end. An attacker sends you a tiny amount of cryptocurrency from an address that matches yours in the first and last characters. That transfer shows up in your history. Later, when you paste or click a recent address, you may grab theirs instead of the one you meant.

Do not copy a destination from your transaction history. Keep the people you pay in an address book inside the wallet, and compare the full address with the one the recipient gave you on a channel you already trust. A hardware wallet helps only if you read the full address on its screen before you confirm.