Crypto scams are now the most expensive form of online fraud. To avoid crypto scams in 2026, you do not need to be a security expert: you need to recognise a handful of scripts that criminals reuse over and over, and to know the few rules that break them. This guide describes the main scam types seen in 2025 and 2026, the red flags they share, and where to report a scam in the United States, the United Kingdom, France, Italy and the rest of Europe.
How big is the problem?
The FBI’s 2025 Internet Crime Report counted 181,565 complaints involving cryptocurrency, with more than $11.3 billion in reported losses, the highest of any category. Crypto investment fraud alone accounted for $7.2 billion. The report also recorded 10,516 complaints about “recovery” scams targeting people who had already lost money, for about $1.4 billion.
On-chain data tells the same story. In its 2026 Crypto Crime Report, Chainalysis says scams received at least $14 billion in 2025 and projects that the final figure could exceed $17 billion. It measured a rise of more than 1,400% in impersonation scams compared with 2024, helped by AI tools that make fake voices, videos and messages cheap to produce.
These are reported losses only. Many victims never file a complaint.
The main crypto scam types in 2025–2026
Phishing: fake sites, fake apps, fake ads
Phishing remains the entry point of most thefts. Criminals buy search ads that lead to copies of wallet, exchange or DeFi sites, publish fake wallet apps, or send emails and text messages claiming a “suspicious login” or a “required wallet update”. The goal is always the same: get your password, your 2FA code or, worse, your seed phrase.
In 2025 and again in early 2026, owners of Ledger and Trezor hardware wallets even received paper letters with a QR code asking them to “validate” their wallet by entering their recovery phrase. Ledger confirmed the letters were a scam. No legitimate company will ever ask for it.
Fake customer support
Scammers watch social networks for people complaining about a stuck withdrawal, then reply as “support” and invite them to a private chat, a phone call or a fake ticket page. Others call first. In May 2025, Coinbase disclosed that criminals had bribed overseas support contractors to copy customer data and then contacted customers while posing as Coinbase to make them move their funds. Coinbase said it would reimburse customers tricked in this way.
Real support teams do not contact you first through direct messages, never ask you to move funds to a “safe wallet”, and never need your seed phrase.
Address poisoning
The attacker sends you a tiny transaction, or a zero-value token transfer, from an address that starts and ends with the same characters as an address you use often. Later, when you copy an address from your transaction history, you may pick the fake one. The transfer is irreversible.
The defence is simple: never copy an address from your history. Use your address book or whitelist, and check the full address, not just the first and last characters. For large amounts, send a small test first.
Wallet drainers and malicious signatures
A drainer is a kit sold to scammers that empties a wallet as soon as the victim signs a malicious message, usually on a fake mint, airdrop or “claim” page. The victim never types a seed phrase: one signature granting a token allowance (a “permit”) is enough. According to ScamSniffer, drainer phishing stole about $83.85 million from 106,106 victims in 2025, down 83% from 2024, but the techniques keep evolving, including malicious EIP-7702 signatures after Ethereum’s Pectra upgrade.
Read every signature request. If your wallet cannot show you clearly what you are approving, reject it.
Pig butchering and fake investment platforms
This is the costliest category. The FBI describes long-term schemes, often run by organised groups in Southeast Asia using victims of human trafficking as forced labour. The contact starts with a wrong-number text, a dating app or a social network, moves to a messaging app, and leads to a trading platform that shows growing fake profits. When the victim tries to withdraw, “taxes” or “fees” are demanded, and then the scammers disappear.
Fake airdrops and token giveaways
Fake airdrop sites copy the branding of a real project and ask you to connect your wallet to “check eligibility”. Others send worthless tokens to your wallet whose name contains a website address: visiting it leads to a drainer. Genuine airdrops are announced on the project’s official site and accounts, and never require a payment or your recovery phrase.
Impersonation: celebrities, regulators and “recovery” firms
Deepfake videos of founders and celebrities promoting a “giveaway” that doubles your crypto, fake regulators announcing that your funds are frozen, fake law firms promising to recover stolen money: impersonation is booming. The FBI warns that scammers impersonate the IC3 itself; the IC3 never contacts victims to ask for money and does not work with private recovery companies.
Red flags: how to spot a crypto scam
- Guaranteed or very high returns, “risk-free” trading, or a bot that “never loses”.
- Urgency: an offer that expires in minutes, an account “about to be closed”.
- Someone you met online who steers the conversation towards investing.
- A request for your seed phrase, private key, 2FA code or remote access to your computer.
- Payment to unlock a withdrawal (“tax”, “fee”, “anti-money laundering deposit”).
- A platform you cannot find on any regulator’s register.
- A link received in a direct message, an ad or an unexpected email.
- A wallet signature you do not understand.
How to protect yourself
- Bookmark the sites you use and never reach them through ads or links.
- Use a hardware wallet for long-term savings and keep your recovery phrase offline (see crypto wallets explained).
- Enable an authenticator app or a security key for exchange accounts, not SMS.
- Use withdrawal address whitelists on exchanges.
- Revoke old token approvals regularly with a reputable revocation tool.
- Before using a platform, check that it is licensed. In the EU, a crypto provider must now hold a MiCA authorisation: see our guide to MiCA regulation explained.
You have been scammed: what to do now
- Stop all payments. Do not send more money, even to “unlock” a withdrawal.
- If your wallet is compromised, move the remaining funds to a new wallet with a new seed phrase, from a clean device.
- Contact the exchange or service you used to send the funds. It may freeze the receiving account if it is still on its platform.
- Gather evidence: transaction hashes, addresses, screenshots, website addresses, usernames and messages.
- Report the scam to the authorities listed below. Reports help investigators link cases and sometimes seize funds.
- Beware of anyone who contacts you offering to recover your crypto for an upfront fee: it is a second scam.
Where to report a crypto scam
| Country | Where to report | Useful checks |
|---|---|---|
| United States | FBI IC3 (ic3.gov) and the FTC at ReportFraud.ftc.gov | State regulator, SEC and CFTC alerts |
| United Kingdom | Report Fraud (reportfraud.police.uk, 0300 123 2040), which replaced Action Fraud on 4 December 2025 in England, Wales and Northern Ireland; Police Scotland on 101 | FCA Warning List and ScamSmart |
| France | Online complaint via the THESEE service on service-public.fr, 17Cyber (17cyber.gouv.fr), Info Escroqueries 0805 805 817 | AMF blacklists and the AMF register of authorised providers |
| Italy | Polizia Postale, Commissariato di PS Online (commissariatodips.it) | CONSOB warnings and blocked websites |
| Other EU countries | National police cybercrime unit | National regulator and the ESMA MiCA register |
Suspicious emails received in the UK can also be forwarded to [email protected], and scam text messages to 7726.
Key takeaways
Every crypto scam ends with the same request: send funds, sign something or reveal your recovery phrase. Slow down whenever a stranger, an ad or an urgent message pushes you toward one of those actions. Verify the platform, keep your seed offline, read what you sign, and report what happens to you: it protects the next victim.
