Recognise account takeovers, malicious approvals, impersonation, device compromise, and the physical risks created by public transaction history.
Start hereA crypto scam is a fraud that manipulates a person into authorising the loss of their own cryptocurrency, whether by sending funds to a criminal, revealing a seed phrase or login code, or signing a transaction that hands over spending power. Scams attack judgement rather than cryptography, which is why the defences are habits rather than software.
Part 2Address poisoning is a payment-redirection attack that plants attacker-controlled lookalike addresses in a victim's transaction history, using zero-value token events, counterfeit tokens or tiny transfers, so that a later copy from that history selects the attacker's address.
Part 3AI voice-clone and deepfake crypto scams are a form of impersonation fraud that uses generative models to copy the voice, face or writing of someone the target trusts, such as a relative, executive, support agent or celebrity, to press for an urgent crypto transfer or login codes.
Part 4Chainalysis identified at least 14 billion US dollars of 2025 on-chain inflows to addresses classified as scams or fraud according to on-chain analysis, with the full total projected to exceed 17 billion as more illicit addresses are identified.
Part 5A guaranteed-return offer is an investment pitch promising a fixed, above-market return with little or no claimed risk. The SEC lists "high returns with little or no risk" first among its Ponzi scheme warning signs.
Part 6Crypto incident response is the sequence of actions that limits damage after assets or access are compromised: diagnose the type of breach, evacuate remaining funds from a clean device, revoke or freeze what the attacker can still use, secure surrounding accounts, report to platforms and law enforcement, and rebuild in a safer structure.
Part 7A wallet drainer is criminal infrastructure, typically rented as a service, that steals through usable authority: a new authorisation the owner is deceived into signing, a signature made with an already-stolen key, or a permission granted long ago to a spender that later turns hostile.
Part 8On-chain privacy is the degree to which blockchain activity can be linked to a real-world identity. Transparent blockchains publish every transaction, amount, address and timestamp forever, so privacy rests entirely on unlinkability: keeping addresses unconnected to each other and to a name.
Part 9A wrench attack is a physical attack on a crypto holder that replaces hacking with force: robbery, home invasion, kidnapping or extortion aimed at making the victim hand over keys or authorise transfers. The name comes from a security comic's observation that a five-dollar wrench beats expensive cryptography by hitting the person instead of the maths.
Part 10A relationship investment scam is investment fraud that begins with a relationship. A scammer, usually making contact out of the blue online, builds trust and then steers the person into depositing money, often crypto, on a counterfeit trading platform. It shows invented gains and may pay out a small early withdrawal.
Part 11The Crypto Loss Report is a periodically updated taxonomy of the ways crypto holders actually lose assets, ordered by evidence rather than by fear.
Part 12Two-factor authentication is an account security method that requires two independent proofs of identity before granting access: typically something you know, such as a password, plus something you have, such as a phone, an authenticator app or a hardware key. It protects an account even when the password leaks.
Part 13Blind signing is a way of approving a crypto transaction or message that commits the signer's key to data the signer cannot read or check. It happens when a wallet cannot decode the request and shows raw data, or when compromised software describes the request as something it is not. The approval then depends on trusting whoever built the request.
Part 14Know-your-customer (KYC) is an anti-money-laundering control that requires regulated financial businesses to identify and verify their customers; where a jurisdiction's law covers crypto businesses, it applies to exchanges alongside record-keeping, transaction monitoring and suspicious-activity reporting. Each jurisdiction sets its own duties, thresholds and start dates.
10 Most Common Crypto Scams and How to Spot Them. Start with the first guide. It introduces the vocabulary used by every later guide in this learning path.
No. Follow the sequence for a structured introduction, or open the guide that answers your current question and return to earlier material when a concept is unfamiliar.
Continue with one of the related clusters below. Each path approaches the same systems from a different angle.
Recognise account takeovers, malicious approvals, impersonation, device compromise, and the physical risks created by public transaction history. Keep the glossary open alongside the articles and use each knowledge check to identify concepts worth revisiting.
Recognise how people actually get hit—account takeovers, scams, and malicious approvals—and the habits that keep you safe. The guides separate protocol behaviour from the operational, market, custody, and human risks that surround it.
