Common Crypto Scams Explained — How Each One Actually Works

Direct answer

Most cryptocurrency fraud reduces to five mechanisms: impersonation (a token, site, or person pretending to be another), approval abuse (obtaining permission to move your tokens rather than stealing keys), social engineering (persuading you to act against your interest), irreversibility exploitation (relying on the fact that crypto payments cannot be recalled), and advance-fee fraud (payment for something that will never be delivered). Recognising the mechanism defeats variants you have never seen before.

Why appearance-based warnings fail

The usual advice — watch for bad grammar, urgency, too-good-to-be-true returns — describes the surface of frauds that existed when the advice was written. Attackers iterate on the surface constantly and cheaply.

The mechanisms below change far more slowly, because they are constrained by how blockchains actually work. A check aimed at a mechanism keeps working after the surface changes.

1. Impersonator tokens

The mechanism. Token names and ticker symbols are just strings stored inside a contract. Nothing prevents deploying a second contract that calls itself by the same name and symbol as a real project. Buyers acquire the impersonator believing it is the original.

Why it works. Interfaces display names prominently and contract addresses barely at all, so the only unique identifier is the one nobody looks at.

The check. Obtain the contract address from a source the project controls — its own domain or its own verified account — and compare it against what you are about to buy. Never from a search result, an advertisement, or a message you received.

Note that the same project may deploy on several chains with different addresses. An address valid on one chain is meaningless on another.

2. Approval draining

The mechanism. Token standards let you grant a contract permission to move tokens on your behalf. Sign an approval to a malicious contract and it can transfer your tokens whenever it likes — no key theft required, and often long after the interaction you have forgotten about.

Why it works. The approval prompt looks like a routine step in an ordinary transaction, and unlimited-amount approvals are common practice, so an unlimited request does not stand out.

The check. Read what you are signing: which contract, which token, what amount. Prefer finite approvals over unlimited ones. Review and revoke existing approvals periodically. A wallet that holds nothing valuable cannot be drained, which is the strongest argument for keeping a separate wallet for interacting with unfamiliar contracts.

3. Honeypot contracts

The mechanism. A contract that permits buying and blocks selling — through a blacklist, an asymmetric transfer fee, or a transfer restriction that only triggers on sale. The order book looks normal because the restriction is at the contract level.

Why it works. The market appears healthy. Early buyers may even see the price rise as others buy in and none can exit.

The check. Before buying an unfamiliar token, look at the contract: is source verified, and does it contain blacklist, pause, or asymmetric fee logic? Unverified source on an unfamiliar token is reason enough to decline. See how to verify a smart contract.

4. Fake support and impersonated staff

The mechanism. Someone contacts you claiming to represent an exchange, wallet, or project — often immediately after you post publicly about a problem — and walks you toward revealing a seed phrase, approving a transaction, or installing software.

Why it works. It arrives exactly when you want help, and the impersonator is frequently well-researched: they may know your project name, ticker, or application status.

The check. Support never contacts you first, and no legitimate service ever needs your seed phrase. Initiate contact yourself, through the organisation's published channels, reached by typing its domain rather than following a link.

5. Advance-fee and listing fraud

The mechanism. Payment is demanded for something that will never be delivered: a listing, a partnership, a release of funds, an unlock. Once paid, a further fee is usually requested.

Why it works. It targets people who are already expecting to pay for something — a project that knows a listing fee exists is primed to accept an invoice.

The check. Applications and payments proceed only through the organisation's own authenticated flow, reached by navigating there yourself. On CoinDock a listing invoice is tied to your application and visible in your account — never sent as an address in a message.

One claim is diagnostic on its own: no exchange can guarantee a price after listing. Any offer containing such a guarantee is fraudulent regardless of how the rest reads. See how to pay listing fees.

6. Recovery fraud

The mechanism. Someone approaches a person who has just been defrauded, offering to recover the lost funds for an upfront fee.

Why it works. It targets people at their most motivated and least sceptical, and victim lists circulate — including publicly, whenever a loss is discussed in the open.

The check. Treat any unsolicited recovery offer as a second fraud. Recovering on-chain funds is generally not possible, and anyone claiming otherwise for a fee is selling that impossibility.

7. Address substitution

The mechanism. Malware or a compromised interface swaps a destination address at the moment you copy or paste it. A related variant seeds your transaction history with an address whose first and last characters match one you have used, hoping you will copy the wrong one later.

Why it works. Nobody reads 42 hexadecimal characters. Most people check the first four and last four — which is exactly what the attack anticipates.

The check. Verify the middle of the address, not only the ends. Send a small test amount first for any significant transfer. Use a saved, labelled address rather than pasting each time — CoinDock supports a withdrawal address allowlist with a cooldown period for this reason.

The pattern underneath

Nearly every case above is defeated by one of two habits:

Initiate contact yourself. Type the domain. Do not follow links or respond to approaches. This alone defeats fake support, phishing, listing fraud, and recovery fraud.
Verify the identifier, not the label. Contract addresses, not token names. Destination addresses in full, not the first four characters.

Neither requires you to judge whether something looks legitimate — which is fortunate, because that judgement is exactly what attackers spend their effort defeating.

What CoinDock will never do

Ask for your seed phrase or private keys. No legitimate service has any use for them.
Contact you first to request a payment, an approval, or a credential.
Send a listing invoice as an address in a message. Invoices appear in your authenticated account.
Guarantee a price, a return, or a performance outcome.

Common Cryptocurrency Scams and How They Work