Crypto Scams 101: How to Spot Red Flags—and What to Do if You’ve Been Scammed

Introduction

Wherever money moves fast, scammers follow — and crypto is no exception. The technology promises financial freedom, but for beginners it can feel like walking into a gold mine with landmines hidden everywhere. Worse, crypto fraud is getting smarter every year: scammers now use AI-generated websites, deepfake videos and near-perfect impersonations that are far harder to spot than the clumsy fakes of a few years ago.

The numbers show how serious this has become. The FBI’s Internet Crime Complaint Center (IC3) reported that Americans lost a record US$9.3 billion to crypto-related crime in 2024 — up 66% in a single year — with investment fraud (so-called “pig butchering”) alone accounting for US$5.8 billion across more than 41,000 complaints. Blockchain analytics firm Chainalysis estimates global on-chain scam revenue reached roughly US$10 billion+ in 2024, noting that impersonation scams surged around 1,400% year-on-year as AI made fakes cheaper and more convincing.

When you are investing, exploring NFT projects, or trading, a single wrong click can drain your entire wallet. This guide will help you identify the red flags and know exactly what to do if you’ve been scammed — including how to report it fast in Malaysia and Singapore. It’s not about fear; it’s about being smart in an industry where trust is hard-earned.

Common Types of Crypto Scams (2026)

You won’t find scammers in black hoodies on suspicious websites. Most hide behind polished, professionally coded fake sites, “giveaways”, paid reviews and glamorous-looking projects. Here’s an at-a-glance summary of the most common scams, followed by how each one works.

Phishing Scams

You receive a message that looks like it’s from Binance, Coinbase or MetaMask: “It’s urgent! Your account has been compromised. Click here to secure it now.” The link leads to a fake login page. Once you enter your details — especially your wallet seed phrase — your wallet is emptied within seconds.

Phishing is one of the most common and effective techniques used against beginners. According to security firm Kaspersky, these scams rely on fake websites, apps, login portals and social media messages. In 2025, sophisticated ready-made phishing kits reportedly cost criminals under US$500 — which is why the volume keeps rising.

Pig Butchering (Investment Romance Scams)

This is now the single most damaging category. A scammer connects with you on WhatsApp, Telegram, a dating app or even a “wrong number” text, and slowly builds trust over days or weeks. Eventually they introduce a “can’t-miss” trading platform or crypto opportunity. The platform is fake — it shows fake gains to encourage you to deposit more, then blocks withdrawals when you try to cash out.

The FBI attributes US$5.8 billion of 2024 losses to this scam alone, with an average loss of nearly US$122,000 per victim. If someone you met online steers the conversation toward crypto profits, treat it as a red flag no matter how genuine they seem.

Fake Crypto Giveaways & Impersonation

You’ve probably seen a post claiming to be from Elon Musk or a major exchange: “Send me 0.1 BTC and I’ll send back 0.5 BTC!” No legitimate person or company gives away crypto for free. These scams use verified-looking accounts, hijacked profiles and paid ads to appear credible — and AI-cloned voices and videos have made them far more convincing. Chainalysis found impersonation-based scam inflows grew roughly 1,400% in a single year, so scrutinise every “official” giveaway.

Rug Pulls in Crypto Projects

Scammers announce a shiny new token with a cool name and manufactured hype. They spin up a Telegram group, quickly grow a community of thousands, and share charts showing the coin “mooning”. Once enough people buy in, the team pulls the liquidity, deletes the website and disappears — a classic rug pull. Rug pulls have historically accounted for billions in losses, and because the teams are anonymous, recovery is rare. Before buying any new token, check whether liquidity is locked, whether the contract has been audited, and whether the team is publicly identifiable.

Approval Phishing (Wallet-Drainer Scams)

This newer, technical scam has cost victims hundreds of millions. Instead of stealing your seed phrase, the attacker tricks you into signing a token approval on a malicious dApp. That approval quietly grants their smart contract permission to move your tokens — so the wallet drains days or weeks later, long after you’ve forgotten the interaction. Approvals don’t expire on their own; they persist on-chain until you revoke them. We cover how to revoke them below.

Fake NFT Collections

Scammers create counterfeit NFT collections that copy a top project’s art style, name and even “verified-looking” marketplace links. Buyers expecting growth discover the NFTs are worthless.

[su_note note_color=”#ffffff” text_color=”#000000″ radius=”10″]Tip: Always confirm the official collection through the project’s own channels and compare the smart-contract address on-chain with the real one before buying.[/su_note]

Pump-and-Dump Schemes

A group manufactures hype for a low-value coin in Telegram or Discord, posting fake “proof” that prices are spiking to lure new buyers. Insiders sell at the peak, leaving everyone else holding worthless tokens. If a coin you’ve never heard of is suddenly “pumping”, stay alert and do your own research.

How to Spot a Crypto Scam

With a little research — and by asking trusted, experienced investors — most scams are easy to spot. Here’s what they tend to have in common:

• Guaranteed profits: No legitimate crypto investment promises fixed or “risk-free” returns.
• “Act fast” pressure: Real opportunities don’t expire in 10 minutes; urgency is a manipulation tactic.
• No real team: Anonymous founders with no verifiable LinkedIn presence or project history are a warning sign.
• No clear use case: If nobody can explain in plain words what the token or project actually does, walk away.
• Requests for private keys or seed phrases: No genuine platform or “support team” will ever ask for these.
• Requests to “connect wallet” and sign: Be cautious of approval or signature requests you don’t fully understand.
• Low-quality sites or typos: Trustworthy projects invest in proper branding, copy and UX.

If you see any of these signs, stop and step away. When in doubt, verify the platform against your regulator’s alert list — see the Malaysia and Singapore section below.

How to Protect Yourself from Crypto Scams

You don’t need fancy tools to stay safe. These simple habits do most of the work:

• Never share your private keys or seed phrases with anyone — not even “support”. It’s like handing over the key to your safe.
• Bookmark the real, official sites and always double-check the URL (for example metamask.io, not metamask-support.xyz).
• Stick to well-known, regulated wallets and exchanges. See our guide to the best crypto trading platforms in Malaysia.
• Move large holdings into a reputable cold wallet and learn the difference between hot and cold wallet security.
• Ask questions in established communities. If people are complaining about blocked withdrawals, that’s a red flag.
• Slow down. FOMO kills logic — research every project before you invest, and never act on a stranger’s “tip”.

What to Do if You’ve Been Scammed

Don’t freeze up — every second counts. Here’s what to do, in order.

1. Don’t Panic — Act Quickly

If your wallet is compromised, you may still have time to save some funds by moving them to a new, secure wallet and changing the credentials on any linked accounts.

2. Stop Further Losses & Revoke Approvals

Move your remaining assets to a fresh wallet, then revoke any suspicious token approvals so a malicious contract can’t drain more later. The most widely used tool is Revoke.cash, which covers 100+ networks; Etherscan and BscScan also have a built-in “Token Approvals” page.

[su_note note_color=”#ffffff” text_color=”#000000″ radius=”10″]Warning: Fake “revocation” and “recovery” sites are themselves scams designed to catch you at your most anxious. Type the address yourself or use a saved bookmark — never a link someone sends you.[/su_note]

3. Gather Evidence

Collect everything you’ll need to report and (possibly) recover: transaction IDs/hashes, wallet addresses, screenshots of messages and websites, and links to the fake profiles or platforms.

4. Report the Scam

Report it as soon as possible with all the evidence you’ve gathered. General options include:

• Chainabuse: reports a scam address to multiple crypto companies and investigators at once.
• The exchange involved: if the scam ran through a platform like Binance, contact their support with evidence — they may be able to freeze funds.
• Your local police / cybercrime unit and financial regulator (see the Malaysia and Singapore steps below).

5. Warn Others

Share your experience (anonymously if you prefer). Reporting publicly helps others avoid the same trap and can surface more victims for investigators.

6. Understand the Limits of Recovery

Here’s the hard truth: on-chain crypto transactions are irreversible. Many “crypto recovery services” are simply a second scam. If anyone asks for an upfront fee or promises guaranteed recovery, walk away.

Reporting a Crypto Scam in Malaysia & Singapore

Local reporting channels have improved a lot, and speed matters — funds are easiest to freeze within the first 24 hours (the “golden period”).

Malaysia

Malaysians lost roughly RM2.97 billion to online scams in 2025, with non-existent investment schemes the single biggest category (about RM1.46 billion). If you’re hit:

• Call 997 — the National Scam Response Centre (NSRC) hotline operates 24/7 and, since September 2024, calls are treated as official police reports. Call immediately to improve the chance of tracing and freezing funds.
• Check Semak Mule (semakmule.rmp.gov.my) to verify bank accounts, phone numbers and URLs linked to scams — ideally before you ever transfer money.
• Verify platforms against the Securities Commission Malaysia (SC) investor alert list and Bank Negara Malaysia’s alerts. Only five SC-registered Digital Asset Exchanges are legal in Malaysia (Luno, HATA, MX Global, SINEGY and Kinetic DAX, as of mid-2026); if a “broker” isn’t on that list, it’s not authorised.

Singapore

Singapore victims lost over S$180 million in crypto to scams in 2025. If you’re targeted:

• Call the ScamShield Helpline at 1799 (24/7) to check if something is a scam or report one, and make a police report. The Anti-Scam Centre’s Crypto Tracing Team has been operational since March 2025.
• Use the ScamShield app to block and report scam calls and messages.
• Check regulation: confirm any provider is licensed by the Monetary Authority of Singapore (MAS) before investing, and review MAS’s Investor Alert List for unregulated entities.

How to Avoid Being Scammed Again

“Once burned, twice wiser.” Here’s how to stay safe going forward:

• Use a hardware wallet (Ledger or Trezor) for large holdings, and keep your seed phrase offline.
• Stay updated — scam tactics evolve every month, especially with AI.
• Search the project name + “scam” before investing, and check regulator alert lists.
• Only invest what you can afford to lose, keep backups, and start small.
• Keep learning. Free resources like Binance Academy and the Kaspersky Resource Center are a good start; for the bigger picture, read our take on whether cryptocurrency is a good investment.

Frequently Asked Questions

Final Thoughts

Crypto investing can be exciting, but scams don’t only hit newbies — even experienced traders fall victim to sophisticated, AI-powered fraud. The goal isn’t to be fearful or embarrassed; it’s to be prepared, alert and research-driven. Your best defence is education, awareness and caution. And if you ever do get scammed, don’t freeze — act fast, revoke approvals, report it through the right channels, and turn your mistake into someone else’s warning.

Figures verified August 2026 from the FBI IC3, Chainalysis, Malaysia’s NSRC/Securities Commission and Singapore’s ScamShield/Police; scam tactics and regulator lists change often, so always confirm current details with the official source before acting.

Disclaimer: This article is provided by KayaToday for informational purposes only and does not constitute financial advice. Always do your own research and consult a qualified professional before making any investment decisions. Crypto investments carry significant risk, and you should only invest what you can afford to lose.