Crypto scams: how people actually lose their coins
Not hackers. Salesmen. Pig butchering, rug pulls, fake giveaways, wallet-draining airdrops, and the recovery scam that bleeds victims twice. The warning signs of each, in plain words.
Most people do not lose crypto to hackers. They lose it to salesmen. The technology gets blamed, but the classic cons run the show: fake investments, fake romance, fake urgency, fake support. Crypto just made the getaway car faster, because a crypto transfer is irreversible and crosses borders in minutes. Know the shapes of the five big scams and you are safer than most of the market.
The losses are not small. Investment fraud involving crypto costs victims billions every year, and the average victim is not a gullible teenager. It is a working adult, often financially comfortable, walked patiently into a hole by a professional.
What is pig butchering?
The dominant crypto scam of this decade, and the name is the scammers' own term. A stranger opens friendly contact, often a wrong number text or a match on a dating app, and builds a real-feeling relationship over weeks. No money is mentioned for a long time. That is the fattening.
Eventually they share how well their investments are doing and offer to show you, on a polished trading site. The site is theirs. Your first small deposit grows, and a test withdrawal works, which is the hook. Then you invest seriously, the balance chart climbs, and when you try to cash out there are suddenly taxes and fees to pay first. Every fee you pay vanishes too. The balance was always a number in a scammer's database. Many of the people running these chats are themselves trafficked workers locked in compounds in Southeast Asia, which is the grimmest fact in the whole subject.
The tell is simple: anyone you have never met who steers a warm conversation toward an investment platform is reading from this script. There are no exceptions worth betting on.
What is a rug pull?
A team launches a new token, markets it loudly, watches the price inflate, then sells everything or drains the trading pool and disappears. The token chart goes to zero in minutes. The Squid Game token in 2021 did exactly this in full public view, with code that literally blocked buyers from selling while the creators cashed out.
Warning signs repeat: anonymous teams, promised returns, a token whose only story is that it will go up, and pressure to buy before some deadline. Real projects survive your week of thinking. Scams cannot afford to.
Are giveaway and airdrop scams still a thing?
Constantly. Send one coin, receive two back, promoted by a hacked or impersonated celebrity account. When Twitter was breached in 2020, the accounts of Obama, Musk, and Apple all posted the same doubling scam, and people paid within minutes. Nobody doubles money. That has never once been real.
Airdrop scams work on wallet owners instead: a free token appears, and claiming it on the linked site asks for wallet approvals that hand a contract the right to empty you. New tokens you never asked for are not gifts. Do not touch them.
Can I get my stolen crypto back?
Almost never, and the attempt spawns the follow-up scam. Recovery services find hack victims in comment sections and promise to retrieve funds for an upfront fee, and that fee is the second theft. Some victims get bled three and four times this way.
What actually helps: report to police and national fraud portals quickly, tell the exchange you paid from, and keep every receipt and chat log. If the coins land on a regulated exchange, freezes occasionally happen. Occasionally. The realistic plan is not recovery. It is making sure there is no second act.
How do I check if a crypto site is fake?
Slowly and before money moves. Type exchange addresses yourself instead of clicking ads, because scammers buy search ads above the real site. Check the domain spelling character by character. Look for the company in regulator registers, and search the platform name plus the word scam before depositing. Fresh domains with countdown timers, guaranteed daily returns, and a support agent who found you first are three strikes in one. Your public IP, your passwords, and your seed phrase share a rule: the person asking for them is the reason to say no.