How to Spot Crypto Scams and Protect Your Wallet

Most crypto scams need one of three things from you: a payment, a secret that controls your wallet, or permission to move your assets. The safest first response to an unexpected offer is to pause before doing any of those things. Check the person, website and requested action through a route you found independently.

A polished app, a convincing video and a successful small withdrawal can all be part of a fraud. Protection depends on understanding what you are authorizing, especially when a familiar-looking button opens an unfamiliar wallet request.

Keep recovery phrases and private keys private

A recovery phrase, also called a seed phrase, can restore the accounts derived from it. A private key controls its associated account. Neither is an ordinary login detail that support staff need to fix a problem. Anyone who obtains these secrets may be able to transfer assets without your permission.

Never give a phrase or key to a support agent, investment adviser, chat contact or website promising to validate, synchronize or unlock a wallet. MetaMask's security guidance says legitimate phrase entry is limited to wallet setup and restoration situations, which scammers also imitate. Use only independently verified wallet software for those operations. For a hardware wallet, follow the manufacturer's recovery procedure.

Keep backups secure and out of messages, shared documents and screenshots sent for troubleshooting. Changing a wallet's local password does not invalidate a stolen private key. The distinction between controlling keys and holding an exchange account is explained in the crypto wallets guide.

Reach support yourself and check the actual destination

Phishing sites copy legitimate services to collect credentials or trigger harmful wallet actions. An urgent message about account suspension, a security update or an expiring reward is a reason to stop and check independently. Inspect the complete domain, including subtle spelling changes. Do not rely on its logo or a search advertisement.

Open the service through a previously checked bookmark or its verified app, then find support there. MetaMask specifically warns that its representatives do not send unsolicited direct messages offering help and never request recovery phrases. Other services have different contact procedures; confirm theirs through the service itself.

Social-media impersonation extends beyond support. A celebrity image, familiar company name or professional-looking profile does not establish who is communicating. The SEC warns that investment-group leaders may impersonate real experts or use AI-generated videos. Confirm an offer outside the post, private message or group promoting it.

Understand what a wallet drainer asks you to sign

A wallet drainer is malicious software or a deceptive service designed to obtain authorization to take assets. Some theft starts with a token approval rather than disclosure of a secret. On Ethereum-style networks, an approval can permit a particular smart contract to spend a token from your address, sometimes up to an effectively unlimited amount.

Legitimate applications also use approvals. When using a decentralized exchange, check the network, token, spending limit and contract receiving permission against the action you intended. A harmless-looking page cannot make an unrelated permission safe. Reject a request you cannot explain.

MetaMask also documents signature phishing: an attacker obtains an off-chain signature and uses it later. A request without a network fee can still authorize valuable actions. Signing a permit or an NFT listing is not equivalent to merely reading a page. Hardware wallets protect keys, but approving a malicious request on the device can still authorize a loss.

Revoke approvals, not just the website connection

Disconnecting a site from your wallet does not cancel existing token approvals recorded on the blockchain. MetaMask distinguishes these operations explicitly. Revocation removes a specific spending permission; it does not reverse earlier transfers or secure a stolen recovery phrase.

For an ordinary token approval on a supported Ethereum-style network:

1. Reach an approval checker through your wallet's official guidance or the network's established block explorer. Avoid a revocation link sent by an unsolicited helper.
2. Select the correct network and address. Review the token, approved spender and allowance, including permissions you no longer use.
3. Choose the unwanted permission and submit its revocation. Check the wallet's confirmation details before signing.
4. Wait for the transaction to confirm and check that the allowance has been removed or reduced as intended.

Revocations generally require a network transaction and gas. Different permission systems, including signed permits, can need additional steps, so follow the relevant wallet documentation. Do not assume one check clears every chain or signature. If incoming gas funds disappear immediately, stop funding the account and use the compromised-wallet guidance below.

Leave unexpected airdrops and claim tools alone

An unfamiliar token or NFT appearing in your wallet is not proof that its project knows you or owes you a reward. MetaMask describes NFT airdrop scams that place a malicious destination inside an asset's image or description. The promised claim then leads to phrase theft or a harmful signature.

Simply receiving an unsolicited asset does not mean that your keys have been stolen. Do not follow its instructions, visit its embedded address or interact with an unknown contract to remove it. Use the wallet's hide or spam controls where available.

Verify any genuine distribution through the project's independently located announcements. A deadline, eligibility checker or request to pay before receiving a prize should not bypass the same checks you would apply to any other transaction.

Check the whole address before sending

Address poisoning puts a lookalike address into transaction history, often through tiny or zero-value transfers. The aim is to make you copy that address for a later payment. The first and last characters can resemble a familiar destination while the middle differs.

MetaMask recommends checking the entire destination and avoiding addresses copied from transaction history. Obtain payment details directly from the intended recipient through a trusted channel. Save checked addresses, confirm the network and compare the final destination shown by your signing device when available. An unsolicited incoming transfer alone is not evidence that someone controls your wallet.

Question the investment relationship, not just the returns

Relationship investment scams, often called pig-butchering scams, can develop over weeks or months. The SEC describes fraudsters building friendship or romantic trust before introducing a supposed opportunity. A wrong-number message, dating conversation or professional introduction may eventually lead to a recommended trading platform.

Investment groups use a similar mechanism. The FBI warns that apparent fellow investors may actually be scammers posing as satisfied clients. Screenshots of profits and enthusiastic comments are not independent evidence. Step outside the conversation and discuss the request with someone who has no connection to it.

Fake exchanges can display balances that exist only on their screens. The FBI notes that scammers may allow early withdrawals to encourage larger deposits. A small payout therefore does not establish that a platform is genuine.

Check an app's developer and obtain downloads through the service's independently verified channels. The FBI has warned about fraudulent beta-testing investment apps, and the SEC cautions that availability in a well-known app store does not establish legitimacy. If a purported platform demands another deposit, tax or clearance payment before releasing funds, stop rather than paying to test its promise.

Watch for a second scam promising recovery

After a loss, unsolicited recovery offers can feel like the first useful response. The FBI warns that fraudsters advertise tracing services, claim ties to law enforcement and demand advance fees or repeated payments. A transaction trace does not give a private company authority to seize funds.

Independently verify any professional you contact. Do not pay an unknown person to release supposedly recovered crypto or provide a recovery phrase to prove ownership. The FBI says law enforcement does not charge victims a fee to investigate crimes. No one can promise that reporting will produce repayment.

If something already went wrong, stop and secure what remains

Stop sending money and signing requests. Preserve messages and transaction details, then report the account or post through the platform's own reporting process. If an exchange account is affected, contact its verified support promptly and secure the account and linked email from a clean device.

If only a token approval is suspect, revoke that permission through a checked tool. If a phrase or key was exposed, treat the associated accounts as compromised. Create a genuinely new wallet with a new recovery phrase on a clean device and, where safely possible, move remaining assets to it. Adding another account under the old phrase does not solve the problem.

MetaMask warns that automated sweepers can steal newly deposited funds. If that appears to be happening, do not repeatedly add gas or try to race the attacker. Seek help through independently verified wallet support.

Report the incident to your local police or cybercrime authority and the relevant financial regulator. In the United States, report crypto fraud to the FBI's Internet Crime Complaint Center and the FTC; investment-related fraud can also be reported to the SEC. Keep addresses, networks, transaction hashes, amounts, dates, screenshots and communication records. Reporting may help an investigation, but it does not reverse a blockchain transfer or ensure recovery.