The rule that catches most scams
Almost every crypto scam needs one of three things from you: your money sent somewhere, your wallet connected and a transaction signed, or your secret recovery phrase. Nobody legitimate ever needs the phrase — not an exchange, not a wallet's support team, not a 'validator'. Anyone who asks for it, or who promises a fixed return, is the warning.
The scams that take the most money
Rug pull
A new token launches, gets hyped, people buy — then the team removes the liquidity or sells its hidden supply and the price goes to zero in minutes. Red flags: anonymous team, liquidity that is not locked, a few wallets holding most of the supply, a launch pushed by paid influencers.
Honeypot token
A token whose contract lets you buy but not sell, or charges a 99% tax on selling. The chart only goes up because nobody can get out. Checkers such as honeypot.is and RugCheck simulate a sell before you buy.
Pump and dump
A group buys a thin, cheap coin, promotes it in chats and on social media, then sells into the buyers they attracted. If a stranger is urgently telling you a coin is about to explode, you are probably the exit.
Fake airdrops and wallet drainers
A site offers free tokens or an NFT mint and asks you to connect your wallet and approve a transaction. The approval gives the site permission to move your tokens, and it empties the wallet. Tokens that appear in your wallet unasked are often bait for this. Revoke old approvals regularly (revoke.cash).
Fake support and phishing
You post a problem and 'support' messages you first, or an email looks exactly like your exchange. Real support never DMs first and never asks for your recovery phrase or remote access to your computer.
Giveaway impersonation
A deepfaked video or a copied account of a famous founder: 'send 1 ETH, get 2 back'. Nobody doubles your money. Every one of these is theft.
Pig butchering (romance and investment scams)
A friendly stranger — often met through a wrong-number message, a dating app or social media — builds trust over weeks, then shows you a trading platform where your deposits appear to grow. Withdrawals are blocked by new 'fees' or 'taxes'. The platform and the profits were never real.
Guaranteed yield (Ponzi schemes)
'1% a day', 'risk-free staking', returns paid from new deposits. It works until new money slows, then it collapses. Real yield comes with real risk and is never guaranteed.
Address poisoning
A scammer sends you a tiny transaction from an address that starts and ends like one you use, hoping you copy it from your history next time. Always copy addresses from the source, and check more than the first and last characters for large amounts.
Recovery scams
After a loss, 'recovery experts' or 'blockchain lawyers' offer to get your money back for an upfront fee. They are almost always the second scam, sometimes run by the same people as the first.
The risks of new projects — even honest ones
- Most new tokens end near zero. Survivorship makes the few winners look normal.
- Unlocks and dilution: a 'low float, high FDV' token has most of its supply locked, and each unlock adds sellers. Check the unlock schedule before buying.
- Thin liquidity: a small pool means a single large sale moves the price a lot — and you may not be able to sell at the price on the screen.
- Smart-contract risk: code can be exploited. Audits help but are not guarantees; audited projects are hacked too.
- Team and treasury risk: founders leave, treasuries are mismanaged, and anonymous teams have nothing to lose.
- Exchange and regulatory risk: delistings, frozen withdrawals and rules that change.
Research methods: how to check a new coin yourself
Do your own research (DYOR) is only useful if you know what to look at. A routine that takes fifteen minutes:
- Find the official contract address from the project's own site and a data site such as CoinGecko — never from a reply or a DM.
- Run the address through a token checker (RugCheck on Solana; honeypot.is, GoPlus or Token Sniffer on Ethereum and similar chains): can you sell, is there a tax, can the owner mint or freeze?
- Look at the holders on a block explorer or Bubblemaps: do a handful of wallets own most of it, and are they connected to each other?
- Check the liquidity on DexScreener: how big is the pool, and is it locked or burned?
- Read the tokenomics and the unlock schedule (Tokenomist): how much is still to be released, and when?
- Look for a public team, a working product and real development activity — not only a website and a countdown.
- Search the name with 'scam', 'rug' and 'exploit', and check hack databases such as DeFiLlama and De.Fi REKT.
- Be suspicious of urgency, guaranteed returns and paid promotion. If it only works if you hurry, don't.
- Test with a small amount first, keep most funds in a wallet that never connects to new sites, and revoke approvals afterwards.
If it has already happened
- Stop sending money — including any 'fee' to unlock a withdrawal.
- Move what is left to a new wallet with a new recovery phrase if your phrase or approvals may be compromised.
- Write down addresses, transaction IDs, usernames and screenshots.
- In Iceland, report it to the police (lögreglan) and tell your bank or exchange straight away. The Central Bank of Iceland (Seðlabanki Íslands) publishes warnings about unauthorised firms.
- Report the addresses on Chainabuse so others are warned.
- Ignore anyone offering to recover the funds for a fee.
Questions people ask
What is a rug pull in crypto?
A rug pull is when the people behind a new token remove its liquidity or sell their hidden supply after others have bought, so the price collapses to near zero. Unlocked liquidity, an anonymous team and a few wallets holding most of the supply are the usual warning signs.
How can I tell if a token is a honeypot?
A honeypot token lets you buy but not sell, or taxes selling heavily. Token checkers such as honeypot.is, GoPlus and RugCheck simulate a sale and read the contract's permissions before you buy.
Will a crypto exchange or wallet ever ask for my recovery phrase?
No. No legitimate exchange, wallet or support team ever needs your secret recovery phrase. Anyone who asks for it is trying to steal your funds.
What is a pig butchering scam?
A long con where a stranger builds a friendship or romance, then introduces a fake trading platform that shows growing profits. Withdrawals are blocked by invented fees, and the money is gone.
Can stolen crypto be recovered?
Rarely. Report it to the police and your exchange quickly, record every address and transaction, and ignore 'recovery services' that ask for an upfront fee — they are usually a second scam.
How do I research a new crypto project?
Get the contract address from official sources, run it through a token checker, look at holder concentration and liquidity, read the unlock schedule, check for a public team and real product, search for scam or exploit reports, and test with a small amount first.