Crypto Scam Field Guide — Six Patterns to Recognize.

The irreversibility frame

Every credit-card transaction in the world can be reversed if it is fraudulent. Every wire transfer can be clawed back if it is caught quickly. Every PayPal or Venmo transfer can be disputed.

A crypto transaction cannot. Once a wallet signs and the transaction confirms, the asset moved is gone. There is no chargeback. There is no customer service line at Bitcoin or Ethereum. The recovery mechanism is voluntary — the recipient choosing to return the funds — and the recipient is, by definition, the person who just stole them.

Every pattern below exploits the gap between how people think about money and how crypto actually behaves. The defense is to slow down — every irreversible action should pass through a five-second pause. If you cannot articulate why the action is correct in those five seconds, do not take the action.

Pattern 1 — Wallet drain

An attacker tricks a user into connecting their wallet to a malicious smart contract — often via a fake airdrop site, a fake mint page, or a fake "claim" link. The user clicks "approve" thinking they are claiming a token. The approval grants unlimited spending authority over a specific asset. Within minutes, the attacker drains the wallet.

Detection cues: Unsolicited DMs with links to "claim" or "mint." URLs that look almost-right but are subtly wrong (e.g., openseaa.io, uniswpa.exchange). Sites that ask for token approval on the first interaction. Browser extensions or wallet popups asking for "unlimited" or "infinite" approval.

Defense: Never click claim links from DMs or notifications. Use revoke.cash or a similar token-approval revoker monthly to clean up old approvals. Verify URLs by typing them directly. Treat every approval prompt with suspicion until proven necessary.

Pattern 2 — Fake support

A user has a problem — a transaction stuck, a wallet locked, a Discord question. The attacker, monitoring public channels, DMs the user pretending to be customer service from Coinbase, MetaMask, Trezor, or another familiar brand. The attacker walks the user through "verifying" their seed phrase or "syncing" their wallet via a malicious site. The seed phrase or the signed transaction transfers all assets to the attacker.

Detection cues: Unsolicited DMs claiming to be support. Anyone asking for a seed phrase, ever. Anyone asking to "verify" a wallet by signing a transaction. Discord, Telegram, or X (Twitter) DMs from accounts that look like brand support but are not the verified handle.

Defense: Real customer service does not DM users. Real customer service does not ask for seed phrases. Close every unsolicited support DM. Reach support only through the brand's official site, verified by typing the URL directly.

Pattern 3 — Romance / pig-butchering

An attacker builds a relationship with the target over weeks or months — through dating apps, social platforms, or unsolicited "wrong number" texts that drift into conversation. The relationship feels authentic. Eventually the attacker introduces a "trading platform" they use, often with screenshots of impressive gains. The target deposits, sees fabricated gains, deposits more, and ultimately cannot withdraw. The platform is a complete fabrication.

Detection cues: Relationships that move emotionally fast but always avoid in-person meetings. Photographs that feel polished or professional. Conversations that drift toward investment opportunities. Platforms with no verifiable presence outside the attacker's introduction.

Defense: Never invest based on a recommendation from someone you have not met. Verify any trading platform's existence, regulatory status, and reviews — independently, not through links the contact sends. The IC3 reports that this pattern has overtaken every other crypto fraud category by dollar volume.

Pattern 4 — Fake investment platform

A polished-looking platform offers high-yield returns — staking, "DeFi" yield, or AI-trading bots. Deposits credit immediately. The dashboard shows steady gains. Some early withdrawals succeed (to build credibility). At a certain deposit threshold or duration, withdrawals freeze, fees are demanded, accounts are locked, or the platform disappears entirely.

Detection cues: Yield rates that exceed every legitimate benchmark (above ~10% annualized USD-denominated, generally suspect). Platforms without identifiable founders, registered entities, or regulatory disclosures. Affiliate or referral programs that pay aggressive commissions. Marketing through social media celebrity endorsements that the celebrities do not, in fact, endorse.

Defense: If you cannot identify the legal entity, the regulator, the auditor, and the custody architecture, do not deposit. "Decentralized" is not a substitute for any of those four. The most expensive lesson in crypto is learning the difference between yield and "yield."

Pattern 5 — Job offer / employer impersonation

An attacker poses as a recruiter, often for a real company. The interview process is real-feeling — multiple rounds, technical assessments, signed offer letters. Onboarding requires the candidate to install a "company wallet" or "treasury management tool" or to send a deposit for "equipment" that will be reimbursed in the first paycheck. The wallet drains. The reimbursement never comes.

Detection cues: Recruiter outreach for senior roles that the candidate did not apply for. Interview processes conducted entirely on platforms (Telegram, Signal, encrypted Discord) the company would not normally use. Onboarding that requires installing unsigned software or making any payment to the employer.

Defense: Verify the recruiter through LinkedIn against the company's actual employee roster. Verify the company's domain. Never install software an employer asks you to install during onboarding without verification through an officially-published IT contact. Never pay an employer.

Pattern 6 — Sextortion / extortion

An attacker claims to have compromising material — explicit photographs, browsing history, "evidence" of misconduct — and demands payment in Bitcoin or another cryptocurrency to prevent disclosure. Most variants involve no actual compromising material; the threat is the entire product. The Bitcoin payment is the only ask because it is irreversible and difficult to trace.

Detection cues: Email or message demanding crypto payment with a deadline. References to leaked passwords (often from public breach databases, not from any compromise of the target). Threats that escalate if engaged with.

Defense: Do not pay. Paying confirms the channel is open for further demands. Save the message as evidence. Report to local law enforcement and to IC3.gov. Change any password referenced in the message immediately.

The first-hour response checklist

If a wallet, exchange, or account has been compromised, the first hour determines what is recoverable. Run this checklist in order.

1. Disconnect the device. If the compromise involved a connected wallet or browser extension, the device cannot be trusted. Power it down or disconnect from the internet.
2. Move remaining assets. If any funds remain in the compromised wallet, transfer them immediately to a new wallet generated on a clean device. Speed matters.
3. Revoke approvals. Use revoke.cash or your wallet's native approval-management to revoke any malicious token approvals. Do this from a clean device.
4. Change exchange passwords. Reset Coinbase, Kraken, Binance, and any other exchange account immediately. Enable hardware-key 2FA (not SMS).
5. Notify the bank. If a bank account fed the compromise, alert the bank. Recent wire transfers may still be reversible if caught within 24 hours.
6. Document everything. Screenshots, transaction hashes, attacker addresses, communications. This becomes the evidence packet.
7. Report. File with IC3.gov (FBI) and FTC (ReportFraud.ftc.gov). For exchanges, file with their security team directly. For amounts above ~$10,000, contact local FBI field office.
8. Inform anyone connected. If the compromised account is a business account, notify partners, controllers, and any vendor that might be impersonated. Most secondary fraud comes from the address book of a compromised contact.

Where to report

• IC3.gov — FBI Internet Crime Complaint Center. The primary federal channel.
• ReportFraud.ftc.gov — Federal Trade Commission, useful for pattern-tracking and consumer protection cases.
• Local FBI field office — for losses above approximately $10,000.
• Exchange security teams — direct reporting to Coinbase, Kraken, Binance, etc. for account-specific issues.
• Cincinnati-area: FBI Cincinnati Field Office (513-421-4310 for non-emergencies). Local police for cases involving immediate personal threat.