Cryptocurrency Scams in 2026: 10 Common Types & What to Do

Cryptocurrency scams in 2026 usually steal money in one of three ways: they persuade you to send crypto, trick you into approving a wallet transaction, or steal access through a seed phrase, fake app, or phishing page. Guaranteed returns, a new online contact promoting an investment, a demand for crypto-only payment, withdrawal “taxes,” and any request for a recovery phrase are stop signs. Do not send another payment to test or unlock the offer. Verify the person, company, domain, and wallet through channels you find yourself.

The FBI’s 2025 Internet Crime Report recorded 181,565 complaints involving cryptocurrency and more than $11.3 billion in reported losses [1]. Investment fraud alone caused $7.2 billion in reported losses. These figures describe complaints, not every crypto transaction, but they show why a polished dashboard or familiar exchange logo is not enough to prove that an offer is legitimate.

How can you spot a cryptocurrency scam?

Most crypto scams reuse the same pressure tactics even when the coin, website, celebrity, job, or story changes. One warning sign deserves a pause; several together are a strong reason to stop.

• Guaranteed profit or “zero risk.” No legitimate investment can guarantee a return, daily percentage, or secret winning signal.
• An unsolicited investment coach. The contact begins with a wrong-number text, dating profile, social message, Telegram group, or unexpected job offer.
• More money is required to withdraw. The platform demands tax, gas, insurance, VIP, audit, security, or verification fees after showing a profit.
• Crypto is the only acceptable payment. A business, government agency, employer, bank, or support agent insists that you buy crypto or use a Bitcoin ATM.
• A seed phrase or private key is requested. Anyone who receives it can control the wallet. Legitimate support does not need it.
• The wallet prompt is unclear. The page requests unlimited token approval, “set approval for all,” or a signature you cannot explain.
• You are isolated or rushed. The person asks for secrecy, discourages advice from family or a bank, or says the opportunity expires immediately.
• Proof exists only inside the same chat. Profit screenshots, IDs, video calls, testimonials, news pages, and support messages can all be staged or AI-generated.

The FTC gives three especially useful rules: only scammers demand cryptocurrency payment in advance, guarantee profits, or turn an online dating contact into an investment adviser [2].

10 common cryptocurrency scams in 2026

1. Fake investment platforms and Ponzi schemes

A fake trading website or app accepts real deposits and displays invented gains. Early withdrawals may even work to build confidence. When the victim tries to withdraw a larger balance, “support” freezes the account and demands another payment. A Ponzi-style scheme may use money from newer victims to pay earlier participants and create convincing testimonials.

Red flags: guaranteed returns, an unknown adviser, a recently registered domain, no independently verifiable company, and tax or unlock fees paid to a wallet. Stop depositing and preserve the dashboard, messages, receiving addresses, and transaction hashes.

2. Pig-butchering and romance investment scams

The scammer builds a friendship or romantic relationship for days, weeks, or months before introducing crypto. They may claim that a relative is a professional trader, guide each deposit, and coach the victim on what to tell a bank. The relationship is part of the fraud; the balance on the recommended platform is not real.

A wrong-number text, rapid move to WhatsApp or Telegram, secrecy, and investment advice from someone known only online fit this pattern. The dedicated pig-butchering scam guide explains the full relationship-to-investment sequence.

3. Phishing pages, fake exchanges, and fake wallet apps

A lookalike exchange, wallet website, browser extension, or mobile app steals login credentials, one-time codes, seed phrases, or keystore files. The URL may differ from the real brand by one character, a subdomain, or an unusual extension. Search ads and fake support replies can place these pages in front of people already looking for help.

Open a known service from a saved bookmark or type its address yourself. Do not sign in through a link from email, chat, an ad, or a search result until you have checked the complete domain. A message asking you to “validate” a wallet should be compared with the crypto wallet validation scam checklist.

4. Wallet-drainer and token-approval scams

A fake airdrop, mint, staking portal, token checker, game, or support page asks you to connect a wallet and sign a transaction. The dangerous step is often not the connection itself but the approval that follows. A malicious contract may receive permission to move tokens without asking again.

Reject vague signatures, unlimited allowances, and unexpected “approval for all” prompts. If you signed, review permissions using a trusted tool reached independently, revoke suspicious approvals, and move remaining assets if the wallet may still be at risk. Fake vote-reward and governance pages are current examples of this pattern.

5. Seed-phrase theft and fake support

A fake wallet representative, moderator, recovery form, or remote-support agent says it needs the 12- or 24-word recovery phrase to synchronize, verify, repair, or unlock a wallet. That phrase is the wallet’s master secret. There is no legitimate troubleshooting reason to send it to another person or type it into an unknown site.

If the phrase was exposed, changing a website password is not enough. Create a new wallet on a clean device and move remaining assets before the attacker does. Do not continue using the compromised recovery phrase.

6. Address poisoning and clipboard substitution

In an address-poisoning scam, an attacker creates a wallet address that resembles one you used and sends a tiny transaction so it appears in your history. The attacker hopes you will later copy the wrong address from that history. Clipboard-stealing malware can make a similar substitution after you copy a wallet address.

Compare the full destination, network, and recipient through a separate channel; do not rely only on the first and last characters. For a new recipient or a large transfer, follow the crypto wallet verification checklist and use a small test transfer only after the recipient is independently verified.

7. Rug pulls, fake tokens, presales, and airdrops

Promoters create a token or project, manufacture excitement, collect liquidity or presale funds, and then disappear or sell their holdings. Other lures advertise a free airdrop but direct users to a drainer or seed-phrase page. A token appearing in a wallet or price tracker does not prove that it can be sold safely.

Anonymous founders, copied documentation, concentrated token ownership, locked selling, guaranteed price growth, and pressure to buy before a deadline are serious warnings. Do not connect a savings wallet to an unknown claim page. See the Solana giveaway scam example for the send-SOL, seed-phrase, and approval variants.

8. Impersonation, giveaways, and AI deepfakes

Scammers impersonate an exchange, government official, celebrity, employer, bank, or family member. They may use hacked verified accounts, copied livestreams, synthetic voice, or AI video to announce a giveaway, emergency, “safe wallet,” or investment opportunity. A familiar face or realistic voice is not independent verification.

Do not send a test payment to a “send one, get two” promotion. Contact the person or organization through a phone number, app, or website you already trust. Our crypto giveaway analysis shows how fake livestreams and doubling promises work.

9. Job, task, and crypto ATM payment scams

A fake employer asks for a training deposit, pays with a bad check, or tells a worker to buy cryptocurrency for a client. Task scams show small earnings for rating products or boosting posts, then require deposits to unlock better tasks or withdraw a balance. Government, bank, marketplace, and tech-support impostors may keep the victim on the phone while directing a Bitcoin ATM or QR-code payment.

Real employers do not require employees to send crypto to start work. A legitimate agency or bank does not protect money by moving it to a stranger’s wallet. Stop the transaction and contact the claimed organization using independently found details.

10. Cryptocurrency recovery scams

After a loss, fake investigators, law firms, blockchain experts, or “ethical hackers” promise guaranteed recovery for an upfront fee. Some already know the original scam details because the same group retained the victim’s data. Others find victims through public posts and replies.

No private stranger can guarantee that an irreversible transfer will be returned. Do not share wallet credentials, install remote-access software, or pay a retainer in crypto. Use the crypto recovery scam guide before responding to anyone who contacts you first.

How a fake crypto investment usually unfolds

The FBI describes cryptocurrency investment fraud as a process rather than a single suspicious message [3]. Recognizing the stage you are in can prevent the next loss.

1. Contact: a wrong-number text, dating match, social ad, job post, group invitation, or direct message starts the conversation.
2. Trust: the person mirrors your interests, shares photos, calls, or personal stories, and may warn you about other scams.
3. Pitch: they introduce a trading expert, private group, AI bot, liquidity pool, gold/crypto strategy, or limited opportunity.
4. First deposit: you buy crypto through a real exchange, then send it to the platform or wallet controlled by the scammer.
5. Fake growth: the dashboard shows profit, support answers quickly, and a small withdrawal may be allowed.
6. Escalation: the scammer adds matching funds, a loan, a deadline, or a larger target to encourage more deposits.
7. Blocked withdrawal: the account is frozen until you pay tax, gas, insurance, audit, or verification fees; recovery scammers may appear after you stop.

Paying the new fee does not release the balance. It only proves that another demand may work.

How to check a crypto website before depositing

1. Search the exact domain and company. Add terms such as “scam,” “withdrawal,” “complaint,” and “pig butchering.” Check whether the history matches the site’s claims.
2. Verify registration independently. If a platform claims regulation or a money-services registration, use the regulator’s own database. A registration is not an investment guarantee, but a fake or unverifiable claim is a warning.
3. Compare the complete URL. Look for misspellings, extra words, misleading subdomains, and a domain that was created far more recently than the business claims.
4. Check the company behind the page. Verify its address, phone number, legal name, and support route outside the website. A chat box and copied certificate are not enough.
5. Read the withdrawal rules before paying. Legitimate platforms disclose fees; they do not invent a new tax or VIP payment after a withdrawal request.
6. Check suspicious URLs and downloads. Use the Gridinsoft Online Virus Scanner before opening an unknown installer or returning to a suspicious page on your main device.

The CFTC’s fake-platform checklist highlights unverifiable registration, new domains, missing addresses, and withdrawal pressure as practical warning signs [4].

Recent fake-platform examples

Scam domains rotate quickly, so exact names are examples of a pattern, not a complete blocklist. The Gridinsoft Website Reputation Checker currently reports Bitonax.com and Jagotrack.com as cryptocurrency scams with 1/100 trust scores. It flags Tronking.net as a suspicious new-domain site with an 11/100 trust score.

Do not deposit more money to unlock a withdrawal from any suspicious platform. Save the domain, dashboard, chat, receiving wallet, and transaction details. If the site requested a wallet approval, seed phrase, browser extension, or desktop app, follow the matching wallet or device response below.

What to do if you sent crypto to a scammer

1. Stop every payment. Do not pay tax, gas, insurance, security, verification, or recovery fees.
2. Preserve evidence. Save transaction hashes, wallet addresses, the asset and network used, amount, date and time, exchange receipts, domains, app names, emails, phone numbers, usernames, screenshots, and the complete conversation.
3. Contact the exchange or wallet provider. Use its official app or website. Ask it to flag the destination and preserve account records. A transfer is usually irreversible, but rapid reporting can help an investigation or a freeze at a cooperating service.
4. Report quickly. In the United States, file with IC3 and the FTC. Outside the U.S., contact the relevant national cybercrime, police, and financial-fraud authority. Include the transaction details even if some other information is missing.
5. Secure accounts. Change email and exchange passwords from a trusted device, enable phishing-resistant MFA where available, remove unknown sessions and API keys, and contact your mobile carrier if a SIM swap is possible.
6. Handle wallet exposure separately. An exposed seed phrase requires a new wallet. A suspicious approval requires permission review and possible asset movement. A wrong transfer does not automatically mean the seed phrase is exposed.
7. Check the device when software was involved. Remove an unknown wallet app, browser extension, or remote-support tool; then run a full Gridinsoft Anti-Malware scan before signing back into financial accounts.
8. Expect a second scam. Ignore unsolicited recovery messages, refund promises, and people claiming to be law enforcement who ask for money or credentials.

Can stolen cryptocurrency be recovered?

Sometimes an exchange or law-enforcement investigation can trace funds and freeze assets that reach a cooperating service. Recovery is not guaranteed, and a private person cannot create a chargeback on an irreversible blockchain transfer. The realistic priorities are to stop further loss, preserve evidence, report promptly, secure exposed accounts or wallets, and avoid paying a recovery scammer.

How to avoid most crypto scams

• Do not take investment advice from a stranger, dating contact, wrong-number text, or private messaging group.
• Never send crypto to “protect” money, unlock a job, pay a government agency, or receive a larger giveaway.
• Never share a seed phrase, private key, keystore file, one-time code, or screen-control session.
• Use a separate low-value wallet for unfamiliar sites; keep long-term holdings away from experimental dApps and claim pages.
• Verify the full recipient address and network through a second channel before a large transfer.
• Bookmark trusted exchange and wallet sites instead of signing in through ads, email, or chat links.
• Ask a trusted person to review a large or urgent crypto payment. Isolation is part of the scam.
• Keep wallet and exchange apps official and updated. Compare hot and cold wallet security before choosing where to keep spending and long-term funds.

FAQ

Current exchange impersonation also blends email with phone pressure. If a message claims a bank account was added, use this Crypto.com phishing email and call verification checklist before responding or moving funds.

References

1. Federal Bureau of Investigation. “Cryptocurrency and AI Scams Bilk Americans of Billions.” FBI National Press Office, April 6, 2026. FBI press release and 2025 IC3 report summary.
2. Federal Trade Commission. “What To Know About Cryptocurrency and Scams.” Consumer Advice, May 2022, accessed July 25, 2026. FTC cryptocurrency scam guidance.
3. Federal Bureau of Investigation. “Cryptocurrency Investment Fraud.” National Crimes and Victim Resources, accessed July 25, 2026. FBI fraud process and reporting guidance.
4. Commodity Futures Trading Commission. “10 Signs of a Scam Crypto or Forex Trading Website.” Office of Customer Education and Outreach, accessed July 25, 2026. CFTC fake-platform checklist.