Common crypto scams in 2026, and the real cases behind them

1. Rug pulls

A team launches a new token or NFT project, builds hype, takes the money buyers put in, then walks away. Sometimes the code itself is rigged so buyers can never sell — the price chart looks like it is only going up because selling is blocked.

Nothing has to be hacked. The people who built it simply keep the funds and delete the accounts.

• Anonymous team, or 'doxxed' founders whose identities cannot be checked anywhere independent.
• A roadmap of promises — a game, a metaverse, a staking platform — with nothing shipped yet.
• Buying is easy and heavily promoted; nobody in the chat can show a successful sale.
• Most of the token supply sits in a handful of wallets controlled by the team.

2. Pump and dump

A group quietly buys a thinly traded token, then hypes it hard — coordinated posts, 'signal' groups, fake trading volume that makes it look busy. Outsiders buy in, the organisers sell into that demand, and the price collapses.

In 2024 US prosecutors and the SEC charged firms that sold this as a service: fake trading volume to order, paid for by token issuers.

• A token you have never heard of is suddenly everywhere at once.
• A paid or invite-only group tells you exactly what to buy and when.
• Enormous trading volume but almost no real users, product, or revenue.
• You are told to buy fast, before an announcement, or before 'the listing'.

3. Phishing and fake support

You get a message that looks like it comes from your exchange, your wallet, or a support agent. The link goes to a copy of the real site, or the 'agent' talks you through steps that hand over your account.

The advanced version is pure social engineering: a phone call, a convincing story, and a calm voice walking you into approving something yourself. No malware needed.

• Any request for your seed phrase, recovery words, or private key — there is no legitimate reason for this, ever.
• A link sent to you rather than an address you typed yourself.
• 'Support' that contacted you first, especially on Telegram, WhatsApp, Discord or X.
• Screen-sharing or remote-access software 'so we can help you fix it'.
• A security alert that requires you to move funds to a 'safe wallet'.

4. Airdrop and 'free token' drainers

You are told you have won free tokens or an NFT and just need to connect your wallet to claim them. The claim page asks you to sign or approve something. That approval is not a claim — it is permission for someone else to move your assets out.

The tokens sometimes arrive too, which makes it feel real. The theft happens later, using the permission you gave.

• Unexpected tokens or NFTs appearing in your wallet from nobody you know.
• A claim site that needs a signature or an unlimited spending approval.
• Time pressure: 'claim window closes in 6 hours'.
• The site was reached via a DM, comment reply, or a search advert rather than an official channel.

5. Cloud mining contracts

You pay for a share of a mining operation and are shown a dashboard filling up with daily earnings. In the fraudulent versions there is no mining. The dashboard is a web page, and payouts to early customers come from later customers' deposits — a Ponzi scheme with a technical costume.

It ends the same way every time: withdrawals slow down, then require a fee, then stop.

• A fixed daily or monthly return quoted for something whose profitability changes constantly.
• Referral bonuses for bringing in friends and family.
• No verifiable data centre, no auditor, no named operators.
• Deposits accepted instantly; withdrawals need review, verification, or an extra payment.

6. Fake crypto job adverts

Two versions are common. In the first, you are 'hired' for remote work — completing tasks, reviewing products, boosting listings — and asked to deposit your own crypto to unlock higher-paying task sets. The balance shown is fake and the deposits are gone.

In the second, the target is a person with access. A recruiter sends a job offer with a document or coding test attached, and opening it installs malware. Reporting on the March 2022 theft of about $625 million from the Ronin network used by Axie Infinity says it began exactly this way — a fake job offer to an engineer.

• You must pay, deposit, or buy crypto before you can be paid.
• The recruiter only exists on Telegram or WhatsApp and never video calls.
• The employer's website was registered recently and copies another firm's text.
• Interview 'software' or a 'take-home test' must be downloaded and run.

7. Romance and 'investment coach' scams (pig butchering)

This is the biggest one by money lost, and the slowest. Someone meets you on a dating app, a wrong-number text, or a friendly DM. Weeks of genuine-feeling conversation come first. Investing is mentioned casually, then demonstrated with a small profitable withdrawal, then scaled up.

The platform is controlled by the same people. When you try to take out a large amount, a tax or fee appears. That fee is the last stage of the scam, not an obstacle before the payout.

• The relationship started with a stranger's unsolicited message.
• They will not video call, or the call is short and evasive.
• They introduce a trading app or site you had never heard of.
• A first small withdrawal works perfectly — this is the hook.
• Any fee, tax, or 'verification deposit' demanded before you can withdraw.

8. Fake exchanges and the withdrawal-fee trap

A polished platform, a dashboard, a support chat, sometimes a mobile app. Deposits work. The number on screen goes up. It is all display code.

State regulators publish trackers full of these, name by name, built from complaints by people who found out at the withdrawal stage. If a platform demands money before releasing your own balance, the balance does not exist.

• The site was recommended to you by someone you met online.
• No licence number that appears on a regulator's own register.
• Withdrawals require a fee, tax, upgrade, or anti-money-laundering deposit.
• The name is one letter or one word away from a well-known exchange.

9. Recovery scams (the second hit)

After a loss, new people appear: 'blockchain forensics' firms, 'certified recovery agents', sometimes someone claiming to be from a government agency. They say your funds are traceable and recoverable for an upfront fee.

Many of these are run by, or sold lists by, the original scammers. Treat any unsolicited offer to recover your money as a second attempt on what you have left.

• They contacted you, not the other way round.
• An upfront fee, retainer, or 'unlocking' payment is required.
• They guarantee recovery — no genuine investigator can.
• They ask for wallet access, your seed phrase, or remote access to your computer.

How big is this, actually?

The FBI's Internet Crime Complaint Center recorded a record $16.6 billion in reported internet crime losses for 2024, up 33% on the previous year, with cryptocurrency-related fraud a leading driver. Those are only the losses people reported — most are not.

The practical takeaway is not the number. It is that these are nine repeatable scripts, and once you can name the script you stop being a target.

Before you send anything

Paste the website, phone number, wallet address, or company name into our free check. It searches community reports and thousands of imported regulator warnings from the SEC, CFTC, ASIC and California DFPI.

If it is already flagged, you will know in seconds. If it is not, that is not clearance — work through the red flags above before any money moves.