Common Scams, Part 1: Phishing and Impersonation

10.1 Everyone is a target

After Mint's permit signature loss in Chapter 7, Mint felt embarrassed. "I should have known better."

"Some of the most experienced people in crypto have been caught by scams," said Hash. "Founders, developers, security researchers. Scammers are professionals. They test what works, copy what succeeds, and target everyone. The goal isn't to feel ashamed. It's to recognise the patterns."

Crypto scams fall into two broad groups. This chapter covers phishing and impersonation: tricks that get you to reveal your seed phrase or sign something harmful. Chapter 11 covers investment and social engineering scams: tricks that get you to send money willingly.

10.2 What a drainer is

Many modern phishing attacks use a wallet drainer: malicious code on a fake or compromised website. When you connect your wallet, the drainer checks what you hold and then requests the signatures or approvals most likely to let it take your most valuable assets, often disguised as a claim, mint, or verification step.

Drainers are sold as ready-made kits to scammers, sometimes in exchange for a share of the stolen funds. That's why so many fake sites appear so quickly: building one requires little skill.

Everything in Chapter 7 is your defence against drainers. This chapter is about how people end up on those sites in the first place.

10.3 Fake websites

Fake sites copy real applications, exchanges, and wallets pixel for pixel. They reach you through several routes:

Search ads placed above the real result. Lookalike domains with a small change, like an extra letter, a swapped character, or a different ending. Links in replies to a real project's social media posts, often from accounts that copy the project's name and profile picture. Compromised legitimate sites, where attackers hijack a real project's website or domain settings, or inject malicious code through a third-party service the site uses.

The last one is the hardest to detect, because you're on the correct domain. This is why transaction simulation and reading every signature request matter even on sites you trust.

10.4 Fake support

Mint posted a question in a project's community chat about a stuck transaction. Within a minute, three "support agents" sent direct messages offering help. One asked Mint to visit a "wallet validation" site. Another asked Mint to share the seed phrase to "resync" the wallet. The third asked for a screen-share.

All three were scammers.

Fake support tactic	Why it's a scam
Messaging you first, privately	Real support teams rarely message first, especially through social media or community DMs
Asking for your seed phrase or private key	No legitimate support ever needs it
Sending you to a "validation," "sync," or "rectification" site	These sites exist to steal seed phrases or request malicious signatures
Asking you to screen-share or install remote access software	Lets them watch you enter secrets or control your device
Saying your wallet will be "suspended" or "locked"	Self-custody wallets can't be suspended by anyone

The safe rule: get support only through official channels you navigate to yourself, such as the official website's help page. And in public chats, disable direct messages from people you don't know if the platform allows it.

10.5 Impersonation on social media

Scammers impersonate famous people, crypto founders, and projects. Common forms include:

Giveaway scams: "Send 1 ETH and receive 2 ETH back." No legitimate person or company does this. Ever. Hacked accounts: real, verified accounts of projects or public figures are taken over and used to post fake announcements, airdrops, or token launches. Because the account is genuine, many people trust the post. Deepfakes: AI-generated videos or livestreams showing a well-known person promoting a scam. As AI tools improve, these are becoming more convincing.

Node frowned. "So I can't trust a verified account?"

"You can't trust a single post," said Hash. "If an official account suddenly announces a surprise airdrop with a link, check the project's website and other official channels before clicking anything. Real announcements appear in several places. Hijacked posts usually don't."

10.6 Fake airdrops and claims

An airdrop is when a project distributes free tokens to users, often to reward early adopters. Real airdrops exist and have sometimes been valuable. That's exactly why fake ones work.

Signs of a fake airdrop include unexpected tokens in your wallet with a website in the name (Chapter 9), urgent claim deadlines, claim sites found through replies, ads, or direct messages, and claim processes asking for approvals or signatures unrelated to receiving tokens.

A real claim typically only needs a transaction that calls the project's claim function. If a claim asks for permission to spend tokens you already hold, stop.

10.7 Malware

Some attacks don't need you to visit a site at all. They target your device directly.

Clipboard hijackers replace crypto addresses you copy with the attacker's address. Always check the pasted address against the original.

Fake wallet apps and browser extensions steal seed phrases when you enter them, as Chapter 5 warned.

Malicious downloads, including pirated software, game cheats, fake productivity tools, and files sent through messages, can install software that searches your device for seed phrases, wallet files, and saved passwords.

Fake job interviews have become a common tactic, particularly against people working in crypto. Victims are asked to download and run a coding test or meeting app that contains malware. Some of the most damaging thefts in recent years started this way.

Chapter 12 covers device hygiene to reduce these risks.

10.8 Emails and texts

Phishing emails and text messages imitate exchanges, wallet providers, and hardware wallet manufacturers. They often claim there's a security issue, a required update, or a pending withdrawal. When customer databases leak, scammers use real names, addresses, and purchase details to make messages more convincing.

Never act on a link in an unexpected email or text. If you're concerned, open the service directly through your bookmark and check there.

10.9 The common thread

Looking at all these scams together, Mint noticed a pattern. "They all try to get me to do one of three things: tell them my seed phrase, sign something, or install something."

"And they all try to make you do it quickly," said Hash.

What the scammer wants	Your defence
Your seed phrase	Never share it, never type it into a website, never give it to support
A harmful signature	Ask the five questions from Chapter 7; use a burner wallet for unknown sites
Software on your device	Only install from official sources; never run files from strangers
Speed	Slow down. Close the tab. Check official channels

10.10 Try it yourself

Search for the name of a popular crypto application in your search engine. Look at the results, including any ads. Can you identify the official site? Compare the domain carefully to the one listed on the project's official social accounts and documentation.

Then go through your bookmarks and make sure you have saved, verified links for every exchange, wallet, and application you use regularly.

Key takeaways from this chapter

1. Scammers are professionals, and everyone is a target. Recognising patterns matters more than feeling confident.
2. Wallet drainers on fake or compromised sites request signatures and approvals designed to steal your assets.
3. Fake sites arrive through search ads, lookalike domains, social media replies, and compromised legitimate sites.
4. Real support never messages first, never asks for your seed phrase, and never sends you to validation sites.
5. Giveaways are always scams. Verified accounts can be hacked, and deepfakes are increasingly convincing.
6. Fake airdrops ask for permissions unrelated to receiving tokens.
7. Malware arrives through fake apps, pirated software, clipboard hijackers, and fake job tasks.
8. Every scam aims for your seed phrase, a signature, or your device, and relies on urgency. Slow down.