Recognizing a crypto scam

The world of cryptocurrency draws a lot of scams, largely because transactions, once made, can't be reversed (see the article on blockchain to understand why). The techniques used almost always come down to the same recipes.

Guaranteed returns: a Ponzi scheme that won't say its name

No legitimate investment, crypto or otherwise, can guarantee a fixed, high return with no risk. An offer promising "10% guaranteed per month" or "double your crypto in a week" almost always runs on a principle over a century old, the Ponzi scheme: early investors are paid with later investors' money, never with any profit actually generated. This mechanism works for a while, as long as new investors keep coming in, then collapses mathematically the moment new contributions no longer cover the earlier ones, often taking most of the funds down with it.

The rug pull, sometimes coded in from the start

A rug pull means creating a new cryptocurrency, drawing in as many investors as possible by promising a promising project, then suddenly withdrawing all available value and disappearing. The name comes from the image of the rug being yanked out from under investors' feet.

Two quite different versions exist. A "soft" rug pull involves no technical cheating at all: the project team simply sells off its entire token reserve all at once, crashing the price for everyone. A "hard" rug pull is sneakier, since it's coded directly into the project's smart contract (see the article on blockchain to understand what a smart contract is): a hidden function, invisible to anyone who can't read the code, lets its creator drain the funds at will, or technically prevents other investors from reselling their tokens once bought. Very new projects, with no track record, an anonymous team, and code never audited by an independent third party, are the most exposed to this risk.

The pump and dump, the group scam

An organized group, often gathered on social media or a messaging app like Telegram, picks a little-known, low-value cryptocurrency, then actively promotes it to draw in as many new buyers as possible in a short time. Once the price is inflated enough by this rush of purchases, the organizers, who bought in before the public announcement, sell off massively all at once, crashing the price and leaving latecomers with heavy losses. A sudden, coordinated promotion of an obscure cryptocurrency, especially by accounts showing over-the-top enthusiasm, is the most reliable signal of this kind of manipulation.

Approval theft: the wallet's back door

Using a cryptocurrency on a site or app often requires connecting your wallet and granting a spending approval, a legitimate mechanism in itself. The trap hides in the details of that approval: a fraudulent site can request, in the same confirmation window that looks harmless, unlimited access to every token in the wallet rather than the specific amount needed for the current operation. Once that approval is granted, often without the victim noticing its real scope, the attacker can drain the wallet at any point afterward, sometimes weeks after the initial signature.

A fake airdrop (a fraudulent free token distribution) or a fake support account posing as a well-known service's official help desk often pursue this same goal: getting the wallet connected to a booby-trapped site, or directly obtaining the recovery phrase (see the article on wallets to understand why it should never be shared). No legitimate support ever asks for a private key or a recovery phrase, whatever reason is given, and a spending approval should always be checked before being signed, never accepted by reflex.

Signals to watch for, overall

• Pressure to act fast, before the "offer" disappears
• An anonymous team, with no verifiable track record, or code never audited
• A request for a recovery phrase, a private key, or an unlimited spending approval
• An advertised return that's fixed and guaranteed
• A sudden, coordinated promotion of a little-known cryptocurrency
• Unsolicited contact offering an investment opportunity

The reflex that protects best

Before investing in a project, look up who's actually behind it, how long it's existed, and what other people say about it independently of its own official messaging. Before signing a wallet approval, check the amount actually requested rather than confirming by reflex. This simple pause to verify eliminates the vast majority of scams, nearly all of which rely on the victim's rush to act.