The most common crypto scams in 2026 and how to spot them

The mental picture most people carry of a crypto scam — a hacker cracking a password — is precisely the wrong one. In the overwhelming majority of documented cases nobody breaks anything: the victim presses "confirm" in full possession of their faculties, on their own device, convinced they are doing the right thing.

That shift matters because it changes the defence. Against stolen credentials, a long password works. Against a signature you authorise yourself, the only defence is a procedure: what you check, and in what order, before approving anything.

What follows is the exact mechanism behind the scams that moved the most money in 2025 and 2026, with the figures that are verified and without the ones that are not.

The real size of the problem

In its crypto crime report published in January 2026 covering 2025, Chainalysis put total illicit volume at $154 billion, 162% higher than the previous year, while noting it remains less than 1% of all crypto transaction volume. Of that, roughly $17 billion is scam revenue ($14 billion confirmed on-chain).

But the number that best describes what has changed is not the total, it is the average ticket: the mean scam payment rose from $782 in 2024 to $2,764 in 2025, up 253%. Fewer victims, each one stripped far more thoroughly. Two measured trends sit behind that jump:

• Impersonation scams grew 1,400% year on year, with the average amount up 600%.
• Operations using artificial intelligence take in an average of $3.2 million, against $719,000 for those that do not. That is 4.5 times more, and it explains why cloned voices and synthetic video stopped being a curiosity.

On the US side, the FBI's IC3 report published in April 2026 logged more than $11 billion in cryptocurrency fraud across 181,565 complaints, out of 1,008,597 complaints of all kinds. Investment fraud accounts for around 49% of all scam losses. And one figure worth carrying with you if you have older relatives: people over 60 lost roughly $7.7 billion, 37% more than in 2024.

Taxonomy: the exact mechanism of each

Pig butchering (romance investment fraud)

The name is unpleasant and describes the process: fatten before slaughter. It starts with contact that feels accidental — a "wrong number" WhatsApp, a match on an app, a professional message — and continues for weeks or months without money ever being mentioned. Once the relationship is established, the investment comes up in passing, as something the scammer happens to do themselves and does well from.

The technical component is a fake platform: a site or app with charts, balances, history and a withdrawal button, where your deposit appears to grow. The number corresponds to nothing. The step that turns a victim into a loyal customer is that the first small withdrawal actually works: €200 of "profits" is returned to you, out of the scammer's own pocket. From there the contributions multiply. The ending is always the same: request a large withdrawal and a tax, an unlock fee or a verification appears that must be paid up front.

Fake technical support

This is the fastest-growing category, the one behind that 1,400% figure. The scammer poses as support for your wallet, your exchange or your bank, and appears exactly where you would go looking: replying to your public complaint, in a sponsored ad above the search "[brand] support", or calling from a number that looks legitimate. The full anatomy, message by message, is further down.

Wallet drainers and malicious signatures

This is the mechanic most worth understanding, because it is invisible unless you know how to read it.

On smart-contract chains, before an application can move your tokens you must authorise it with an approve transaction, which specifies who may spend and how much. Many legitimate interfaces fill that "how much" with the maximum possible number so they do not have to bother you again. A malicious interface does exactly the same thing, except the party authorised is the attacker's contract. From that moment on, without you signing anything further, it can drain your balance of that token whenever it likes. With NFTs the equivalent is setApprovalForAll, which authorises an entire collection.

Worse still are off-chain signatures (Permit and Permit2). They cost no gas, never appear as a transaction, and on screen look like a harmless message the site asks you to sign "to verify your account". They grant the same authority. Many victims swear they approved nothing, and technically they believe they are telling the truth.

The best-documented case of this kind is the Ledger Connect Kit incident of 14 December 2023: a former employee's NPM account was phished and a drainer was injected into a library used by thousands of applications. Roughly $484,000 was stolen before it was patched, within hours. The victims were holding hardware wallets and signed the transactions themselves.

Address poisoning, step by step

This one deserves the full breakdown because it is purely psychological:

1. The attacker watches the chain and sees that you have sent funds to 0x7f3a...9c2d.
2. They brute-force a vanity address whose first and last characters match that one: 0x7f3a...9c2d, with a completely different middle. Matching four or five characters is cheap.
3. They send you a zero-value or dust transaction from it. No permission from you is required, and in many cases they use a zero-value transfer event that moves nothing at all.
4. That transaction now sits in your history, visually identical to the one you made.
5. Next time you want to repeat the transfer, you copy the address from your history rather than from the original source. You check the beginning and the end, as everyone does. They match.
6. You send. The money is the attacker's, and it does not come back.

Rug pulls, fake airdrops and Ponzis dressed as platforms

In a rug pull, promoters launch a token, attract buyers and then pull the liquidity, leaving an asset that can no longer be sold. Variants include contracts with hidden minting that dilutes everyone, or a sell tax that is raised to 100% after launch. You detect them by checking whether liquidity is locked and whether the contract retains administrator functions.

In a fake airdrop, a token simply appears in your wallet with a name suggesting a prize. Its only purpose is to make you search for somewhere to redeem it and end up on a site asking for a signature. Nobody gives anything to people who have done nothing; if the subject interests you, start by understanding how a real airdrop works.

In a Ponzi dressed as a platform, a fixed return is sold — 1% daily, 8% monthly — paid out of new entrants' money, plus a referral structure that turns victims into salespeople. The tell is arithmetic: no real strategy produces returns that are both constant and independent of the market.

Warning signs common to all of them

• Artificial urgency: a window that is closing, an account about to be locked, an opportunity that expires today.
• Guaranteed or constant returns. They do not exist.
• Any request for your seed phrase or private keys, from anyone at all.
• Being asked to install AnyDesk, TeamViewer or similar so someone can "help you".
• A platform you have only ever heard of from the person recommending it.
• Paying up front to unlock a payout: taxes, fees, insurance, verifications.
• Pressure not to discuss it with anyone, or to keep it private.
• Any unsolicited inbound contact, whether a call, email, message or social media comment.

Worked example: the anatomy of a support impersonation

Marta holds €6,200 in a phone wallet. An update leaves the app showing a zero balance — a sync bug, nothing more — and she posts on X asking the brand's official account for help. Eleven minutes later she gets a reply.

"@WalletSupport_Help" — Hi Marta, sorry for the trouble. We're the assistance team. To speed this up, continue on our secure Telegram channel: t.me/walletsupport_help

What happened: the account carries the brand's name and logo, with one extra underscore. Real support at a serious company never pulls you off the official platform and never contacts you first.

Agent — Good afternoon. First off, which app version is this happening on? We're seeing issues on 4.2.1 relating to the derivation index.

What happened: credible technical competence and correct vocabulary. This builds trust deliberately. In 2026 this script is usually AI-assisted, which explains both the quality of the writing and the speed of the replies.

Agent — It's a known issue. We can resynchronise your wallet from the server. I need you to run the validation tool on our portal: wallet-recovery-help.app

What happened: a domain containing the brand name, registered eleven days ago. Marta does not check it: she arrived from a conversation, not from a search.

Portal — Enter your 12-word recovery phrase to rebuild the index.

What happened: technically, this is where it ends. With the seed, the attacker reconstructs the wallet on their own device. Many victims stop here, which is why the modern script offers a gentler alternative: if you hesitate, the agent suggests you "connect the wallet and sign a verification", producing an unlimited approval instead of handing over the seed. The outcome for you is identical.

Agent — Perfect, it's queued. Synchronisation takes 30 to 60 minutes. Don't close the app.

What happened: the wait serves a purpose. It buys time to move the funds and delays the moment Marta asks anyone else for help.

Fifty minutes later the wallet is empty. Cost: €6,200, about 2.2 times the 2025 average scam payment of $2,764, in a conversation lasting under an hour. Weeks later a message will arrive from a supposed asset recovery firm promising to trace the money in exchange for a retainer. That is the second scam, and it is usually run by the same group.

Checklist before signing anything

• Read the destination address and the amount on the device screen, not the browser. The website can lie; the device cannot.
• Identify what kind of operation it is: if it is an approval, check which contract is being authorised and for how much. If the amount is unlimited and you do not need that, reduce it.
• If you are asked to sign a gas-free message to "verify" or "connect", stop: it may be a Permit authorisation.
• Check the URL character by character, and always arrive from your own bookmark, never from a link or an advert.
• Copy the destination address from the original source and verify characters in the middle, not only the start and end.
• Send a small test transfer on any significant operation or to any new address.
• Review and revoke your active approvals every few months, using the chain's block explorer or a well-known revocation tool.
• Use a separate wallet holding minimal funds when connecting to new applications. Never the one holding your savings.

If it has already happened: what to do, in this order

Be realistic from the outset. A confirmed transaction cannot be reversed, and most victims recover nothing. Even so, the order of these steps changes a great deal about what can be salvaged.

1. Disconnect and isolate. Stop interacting with the site, the app or the person. Sign nothing further, including anything presented to you as a "cancellation".
2. Revoke approvals on the affected wallet using the chain's explorer or a recognised revocation tool. This is urgent: while an approval lives, the attacker can come back.
3. Move what is left to a new wallet generated on a clean device, ideally self-custody with hardware. If the seed was exposed, the old wallet is dead permanently: do not reuse it and do not send funds back to it, not even to cover the gas for a rescue.
4. Document everything. Transaction hashes, destination addresses, screenshots of the conversation, URLs, profiles, phone numbers, amounts and dates. Without this there is no useful report.
5. Notify the exchanges involved. If funds land at a regulated platform, tell them through their official channel with the hashes. It is the only realistic route to a freeze, and it depends entirely on speed.
6. Report it to the authorities.
7. Do not hire anyone who promises to recover the money.

Where to report

Reporting routes are national, so use the ones for the country you live in. As a general pattern:

• File a formal report with your national or local police, ideally through the cybercrime unit. This is the channel with legal standing, and it is what generates a case reference you will need for everything else.
• United States: file with the FBI's Internet Crime Complaint Center at ic3.gov. It is the source behind the IC3 statistics cited above and feeds federal investigations directly.
• United Kingdom: report to Action Fraud, the national reporting centre for fraud and cybercrime (Police Scotland takes reports directly).
• European Union: report to your national police cybercrime unit. Most member states also run a national cybersecurity agency with a free helpline that will walk you through the steps, even though it does not process criminal complaints itself.
• If the platform advertised itself as licensed, check the register of the relevant financial supervisor — such as the Spanish CNMV register of crypto-asset service providers — and report the case to that authority. Supervisors also publish warning lists of unauthorised firms.
• If a bank transfer was involved at any point, tell your bank immediately: it is the only link in the chain that sometimes allows a reversal.

What changed in 2026

Three things, none of them good. The first is AI industrialisation: when an operation that uses it earns 4.5 times more, adoption is inevitable. In practical terms, the classic tells — spelling mistakes, odd translations, implausible accents — are no longer reliable, and a video call is no longer proof of identity.

The second is the shift towards fewer victims and more money per victim, with the average payment multiplying by 3.5 in a year. Groups invest more time per target, leaning on leaked data: the Ledger breach of December 2020, which exposed around 270,000 records including home addresses of people known to hold crypto, is still fuelling targeted campaigns six years later.

The third does work in your favour: regulation has handed you a verification tool that did not exist before. Within the European Union, MiCA now requires any firm serving EU customers to be authorised, and national supervisors publish searchable registers of who is. In the United States the picture is less consolidated — a joint SEC and CFTC interpretation clarified the token taxonomy in March 2026, but federal market-structure legislation was still pending as of August 2026 — so the practical check there remains the state and federal licences of the specific entity, plus the regulators' own investor alerts. Either way, checking the register is the fastest filter you have, and the natural first step before choosing where to trade. If the firm is not listed, the conversation is over.

Frequently asked questions

Sources and references

1. Chainalysis — 2026 Crypto Crime Report
2. Chainalysis — Crypto scams 2026
3. Chainalysis — Crypto hacking and stolen funds 2026
4. FBI — Cryptocurrency and AI scams bilk Americans of billions (IC3 2025)
5. FBI Internet Crime Complaint Center (IC3) — report a crime
6. Action Fraud — UK national reporting centre for fraud and cybercrime
7. CoinDesk — Ledger exploit drained $484K
8. CNMV — Register of crypto-asset service providers (example national register)

Related guides