Main Takeaways

  • Everything in crypto moves fast, including scammers, who never stop developing new schemes and tactics to exploit blockchain users.

  • Criminals’ deceitful tactics range from phishing and malware to social engineering and technical exploitation, with various types under each category.

  • By staying cautious and aware, you can protect your funds from falling into scammers’ hands.

The long game of crypto isn’t just about holding — it’s about actively protecting what’s yours. With crypto summer in full swing, there's been an influx of new users and a surge in on-chain activity. While the excitement is palpable, it also creates favorable conditions for scammers looking to take advantage of those who are new to the space.

Whether you're sending your first transaction or exploring decentralized apps, it's essential to stay aware of common scams that could catch you off guard. In this guide, we’ll build on our previous discussion about the importance of security awareness and practices in the long game by walking you through the most common crypto scams and how to recognize and avoid them, helping you safeguard your funds and navigate the digital-asset space with confidence.

Phishing Scams

Phishing scams exploit trust, often by mimicking legitimate platforms or entities. Scammers use sneaky tactics to trick you into sharing sensitive information or giving them unauthorized access to your accounts. These scams can take many forms, but the goal is always the same: to steal your money or personal details. Here are a few common examples to watch out for.

QR Code Scams

You’re asked to scan a QR code as part of a peer-to-peer (P2P) crypto transaction – seems harmless, right? Unfortunately, scammers have been known to present Binance login QR codes as P2P order codes. When the victim scans the code and authorizes login, it gives scammers full access to their accounts, which they are happy to drain.

Impersonation on Messaging Apps

Scammers may impersonate Binance representatives on messaging apps like WhatsApp or Telegram. They might use fake profiles, create a sense of urgency, and ask for sensitive information like your login credentials or two-factor authentication codes. While Binance does have an official WhatsApp channel, we will never contact users on WhatsApp proactively. All user communication takes place strictly on our platform, not via direct outreach on third-party apps.

Exploiting Signing of Blockchain Messages

Some phishing attempts happen on fake platforms and apps that look just like the real thing. These sites might prompt you to sign a blockchain message, which might seem innocent. However, the signature could grant scammers access to your Web3 wallet or authorize transactions without your knowledge.

Malware and Technical Exploitation Scams

Some scams go beyond interpersonal deception, relying on malicious software or technical vulnerabilities to target unsuspecting users. Attackers can thus manipulate your devices or steal your funds without your knowledge.

Clipper Malware

Clipper malware is designed to intercept clipboard data, such as cryptocurrency wallet addresses that you copy and paste. When you copy a wallet address to send funds to, the malware substitutes it with the hacker’s wallet address. If you unknowingly paste this manipulated address and complete the transaction, your funds are sent straight to the scammer.

While it initially operated mainly through fake exchange apps, it has since evolved. Scammers may distribute fake Telegram and WhatsApp apps via unofficial channels to carry out these attacks. These apps mimic legitimate ones but do harm in the background, scanning messages for wallet addresses and replacing them with the hacker’s. 

Furthermore, some PC versions of these apps are bundled with Remote Access Trojans (RATs), which can steal wallet credentials, monitor activities, and reroute funds without your knowledge.

Exploiting Smart Contract Approvals

When using Web3 platforms, approving smart contracts is a common step to interact with decentralized applications (DApps). For example, you might approve a contract to trade tokens on a decentralized exchange or to interact with an NFT marketplace. These approvals grant the smart contract permission to access your wallet and execute specific actions. While convenient, they can open the door to significant risks if not managed carefully.

The issue arises with unlimited approvals, where users grant a smart contract unrestricted access to specific tokens in their wallet. This means the contract can interact with your tokens as often and as much as it wants, without requiring additional approval for each transaction. Scammers exploit this by creating malicious contracts designed to drain your funds.

Peer-to-Peer Scams

Peer-to-peer (P2P) transactions allow individuals to trade directly without going through an exchange's order book. While this can be convenient and flexible, especially in regions without easy access to fiat on- and off-ramps, scammers may exploit the lack of built-in protections to deceive unsuspecting users.

Off-Exchange P2P Transactions

When P2P trades happen off regulated platforms, they lack safeguards like escrow services or user verification. This makes it easier for bad actors to scam their counterparts. For example, a scammer might fail to transfer the agreed funds or provide counterfeit payment receipts, leaving the other party without recourse.

Paid-But-Canceled Scams

In this deceptive scheme, scammers pose as sellers and convince buyers to cancel their orders after payment, such as claiming there was a transaction error. Once the order is canceled, they disappear with the payment, leaving the buyer empty-handed.

How to Avoid Becoming a Victim

While the world of blockchain and digital assets offers incredible opportunities, it's important to approach it with a healthy dose of caution and a safety-first mindset. Here are some tips and behaviors that you should incorporate into your crypto practices to minimize the chances of getting scammed.

1. Use Reputable Platforms: As a general rule, you are safer on well-known and trusted exchanges and marketplaces. Reading this on the Binance blog, you already seem to be doing well on this score!

2. Enable Two-Factor Authentication (2FA): Add an extra layer of security to your accounts by enabling 2FA.

3. Verify URLs: Always double-check the website URLs to ensure you are on the legitimate site, especially before entering sensitive information.

4. Learn to Spot Phishing Attempts: Avoid clicking on links or downloading attachments from unsolicited emails or messages.

5. Never Share Private Keys: Keep your private keys, seed phrases, and passwords confidential and never share them with anyone.

6. Research Thoroughly: Investigate projects, offers, and sellers before making any transactions. Look for reviews and community feedback.

7. Be Skeptical of Unrealistic Offers: If an offer sounds too good to be true, it probably is. Be cautious of high-return promises.

8. Educate Yourself: Stay informed about common scams and new fraud tactics by following reputable sources and communities in the crypto space.

Take your time and don’t rush into transactions, especially when you’re unfamiliar with the process. Protect your personal information, verify the sources of messages and apps, and be mindful of unexpected requests for wallet credentials. 

Final Thoughts

Although the Web3 space comes with its share of risks, staying vigilant and mindful of potential threats can significantly reduce your chances of falling victim. To gain a better understanding of these threats, explore our Know Your Scam series. Stay informed and up-to-date on the latest threats with Binance Academy, which offers deeper insights into these scams and resources to help you spot others you may encounter. Choose trusted platforms like Binance with in-built safety features like P2P escrow services to ensure secure transactions and AI-powered tools to detect suspicious activity. Stay informed, stay cautious, and navigate the blockchain with confidence.

Further Readings

  • How to Avoid and Report Fake Service Scams

  • Mastering Crypto Purchase With Local Currency

  • The Binance Antidote: Protecting Users From Address Poisoning Attacks