
A scammer is someone who uses deception to obtain your assets or sensitive information.
In the crypto space, scammers typically rely more on social engineering and fabricated scenarios rather than direct technical attacks. Their goal is to persuade you to willingly transfer funds, reveal account details, or click “sign/authorize” in your wallet—effectively gaining control over your tokens. Unlike hackers who “break in,” scammers are more like people convincing you to “open the door yourself.”
Here, “sign/authorize” refers to granting a website or smart contract permission to operate on your tokens. If you grant overly broad permissions (such as “unlimited approval”), the other party can move your assets at any time.
Because once funds are lost to a scam, recovery is extremely difficult.
On-chain transactions are irreversible: once assets are sent, it is nearly impossible to retrieve them. Scammers often quickly split assets, move them across chains, or use mixing services, making tracking even harder. Even if you file a report, if the amount is small or clues are scattered, gathering evidence and recovering funds can be extremely time-consuming.
Most scams focus on urgency: limited-time airdrops, risk alerts, fee discounts, and other tactics pressure you to act quickly. Recognizing these common schemes helps you pause at critical moments and avoid significant one-off or repeated small losses.
They build trust, fabricate scenarios, create urgency, and ultimately steal assets.
Step 1: Identifying targets. Common entry points include online communities and search results, such as Telegram groups, X (Twitter) comment sections, fake official websites, and phishing ads. Scammers often pose as customer support agents, project teams, or “helpful veterans.”
Step 2: Building trust. They may use fake profile pictures, lookalike domains, forged chat records or transaction receipts, and even mimic voices or screen recordings. The aim is to convince you that “this is an official channel.”
Step 3: Creating urgency. Tactics include claims of account risk control, requests for additional deposits, expiring qualifications, or limited-time whitelists—pushing you to skip verification steps and transfer funds or sign approvals immediately.
Step 4: The critical action. This could involve asking you to transfer USDT to a specified address; click “approve” or “sign” in your wallet; download malicious plugins; or submit your mnemonic phrase (a set of words for wallet recovery that should never be shared).
Finally: Laundering and moving funds. Scammers will rapidly distribute funds to multiple addresses, bridge them to other networks, or use mixing services before cashing out in small amounts off-platform—making tracking extremely difficult.
These generally fall into three categories: impersonation, phishing signatures, and fake investment schemes.
For exchanges, the most common scams involve fake customer support and announcements. Scammers will claim to be “official support” in community groups, message you privately about deposit issues, and send links nearly identical to official sites (for example, swapping “i” with “l” in domain names). Always access support through the exchange app’s Help Center or support tickets—never click links shared in groups. Major platforms like Gate offer anti-phishing codes: official emails will include your unique code—if it’s missing, be cautious.
For wallets and DeFi, phishing signatures and excessive approvals are prevalent. Fake airdrop pages may prompt you to “approve all tokens” or show seemingly legitimate airdrop signature requests that actually grant contracts access to your assets. If unsure about an approval request, simply close the page; revoke unused contract approvals via your wallet or block explorer tools.
In project investment scenarios, beware of “rug pulls”—where a project team entices users to buy or provide liquidity and then suddenly shuts down trading, withdraws the liquidity pool, or dumps tokens, causing prices to collapse. Risks are higher with new projects whose smart contracts are not open source, have centralized private keys, or have liquidity controlled by a single party.
In OTC and social settings, watch for low-price offers and fake proofs of payment. Scammers may promise coins below market price in exchange for fiat transfers or bank details—then block you after receiving payment—or send forged transaction screenshots to trick you into releasing coins. Always use platform escrow services and avoid private transfers.
Make anti-scam practices a routine habit.
Step 1: Layer your assets and test with small amounts. Separate long-term holdings from frequent transactions—use cold wallets for long-term storage and hot wallets for small amounts only. Test new sites/contracts with minimal funds first.
Step 2: Always use official entry points. Bookmark trusted official websites and access them via apps or saved bookmarks only. Never click links from group chats or DMs; for customer support, use the platform’s Help Center/tickets rather than private chats in communities.
Step 3: Minimize approvals and signatures. Carefully review contract addresses and permission scopes in wallet pop-ups—prefer one-time approvals over “unlimited approvals.” Regularly revoke unused approvals using wallet tools or block explorer utilities to prevent old authorizations from being abused.
Step 4: Enhance exchange security settings. On major platforms (like Gate), enable two-factor authentication, set withdrawal whitelists, activate anti-phishing codes, and review logged-in devices. For large withdrawals, always test with a small amount first and double-check addresses and memos/tags.
Step 5: Establish safe communication norms in communities. Remember: no one—including “customer support”—should ever ask for your password, SMS codes, or mnemonic phrases. If anyone mentions terms like “risk control freeze,” “security deposit,” or “internal quota,” be extra vigilant and verify via official support tickets.
Step 6: Responding to suspicious situations. Disconnect your wallet from suspicious sites immediately and revoke related approvals ASAP; if assets are already stolen, report the address as suspicious to the platform for flagging and risk marking, save all transaction hashes and chat records, and contact local cyber police promptly.
Over the past year, social engineering combined with on-chain authorization scams has become more active.
According to several publicly released security reports in 2024, total on-chain losses from security incidents remain in the billions of dollars annually—with quarterly losses ranging from several hundred million to over a billion dollars depending on reporting methodology. Small-scale incidents are increasing while mega-sized individual cases ($100M+) have become less common.
Tactics such as fake airdrops and phishing signatures continue to evolve—with more pages prompting users for “unlimited approvals” or using more covert authorization standards; impersonation of customer support and official sites is becoming more sophisticated with highly similar domains and visuals; “bot funnel links” on social platforms and messaging apps are now widespread entry points.
In terms of scenarios, new blockchain ecosystems and popular cross-chain bridges see denser fake bridge/staking pages during their launch phases; OTC trading becomes riskier during market volatility due to increased baiting with low-priced coins and requests for payment before delivery. It’s recommended to keep up with exchange security bulletins and quarterly reports from security firms—paying attention to metrics like the percentage of phishing-related incidents and loss ranges per quarter as specified by the reports’ time frames and methodologies.
Look for key warning signs such as promises of unusually high returns, requests for upfront payments, claims of “insider information” or “exclusive access.” In crypto specifically, be wary of anyone pushing you to transfer funds quickly, hiding project details, or unable to provide a clear whitepaper. Always verify backgrounds before any transaction by checking official project channels and community feedback.
Recovery depends on the scam type and how quickly you act. If funds haven’t been moved yet, contact the platform (like Gate) immediately to request an account freeze. For on-chain transactions, recovery is difficult but you should report the incident to law enforcement with all available evidence. In most cases prevention is far more practical than recovery—stop all contact with the scammer immediately, collect evidence, and file a report with local police.
Exercise caution. Genuine professionals usually have verifiable backgrounds and long-term public records—they rarely DM strangers with investment tips. Scammers often pose as experts and create urgency for quick decisions. If someone randomly messages you promising high returns, it’s typically a red flag. Only trust officially verified accounts or professionals validated by independent third parties.
Common patterns include: fake airdrops (requiring ETH payment for free tokens), impostor project teams (posing as official communities to solicit transfers), “signal groups” (mentors who disappear after collecting fees), phishing links (stealing private keys or mnemonic phrases). These all exploit greed or lack of information among newcomers. Stay safe by avoiding unverified links, never sending funds to strangers, and never entering private keys outside official channels.
Because blockchain’s anonymity and cross-border nature make enforcement difficult. A single address can represent multiple identities; once a transaction is confirmed it cannot be reversed; assets are hard to trace once moved. Scammers exploit these traits by quickly transferring assets through mixers or exchanges. That’s why self-protection is crucial in crypto—choose reputable platforms like Gate, enable two-factor authentication, and store assets in cold wallets.


