An old friend messages you about an incredible crypto opportunity they’ve been using, showing screenshots of impressive returns. The platform looks professional and the interface is slick, so you decide to invest a few thousand dollars to test it. Seeing your money grow daily encourages you to add more. Just when you want to withdraw your funds, the platform vanishes overnight, your friend stops responding, and you realize the entire thing was an elaborate hoax designed to separate you from your savings.

Incidents like these don’t only target tech enthusiasts or risk-seeking traders. The victims also included retirees, first-time investors, and everyday people trying to build financial security who are systematically targeted by criminal operations.

If you are considering investing in cryptocurrency, this guide will help you learn about common types of crypto fraud, recognize their warning signs, and adopt strategies to avoid falling victim to crypto-related cyber threats.

Key Takeaways

• The 66% increase in crypto-related fraud over the previous year makes investment scams the costliest fraud category the country faces today.
• From early, short-lived crypto scams to today’s organized criminals, months of relationship-building, professional marketing, fake trading platforms, and smart-contract manipulation are used to appear legitimate.
• Individuals aged 60+ lost more than $2.8 billion in crypto-related scams in 2024, while people of all ages are targeted in social media, dating apps, and fake brokerage sites.
• You can dramatically reduce your risk in crypto investments by understanding how these scams work, recognizing red flags, and following essential security practices.

What Are Crypto and NFT Scams?

Crypto and NFT scams are fraudulent schemes that exploit the unique characteristics of blockchain-based digital assets to deceive victims and steal their money or tokens. Unlike traditional financial fraud, these scams leverage the irreversible and complex nature of blockchain transactions, the lack of consumer protection mechanisms in an unregulated sector, and the fear of missing out on the next big opportunity.

Cryptocurrency is digital money that uses cryptography for security and is traded on decentralized networks called blockchains. It is digital cash that no single bank or government regulates. On the other hand, non-fungible tokens (NFTs) are unique digital certificates of ownership recorded on a blockchain, commonly used to represent digital art, collectibles, or membership rights. Being non-fungible means each token is one-of-a-kind and can’t be exchanged one-to-one like currency.

The scams targeting these assets take many forms, including fake investment platforms that display fabricated profits, fraudulent token projects where creators disappear with investors’ money, phishing websites that steal your digital wallet credentials, and long-con relationship scams. Unfortunately, transactions related to these scams cannot be reversed by calling your bank or credit card company. Once your crypto or NFTs are gone, they’re almost always gone for good.

Why Scammers Prefer Cryptocurrency and NFTs as a Payment Method

In 2024, the Federal Bureau of Investigation’s Internet Crime Complaint Center recorded 859,000+ cybercrime complaints, with total losses of $16.6 billion, a 33% increase over 2023. Of that total, approximately $9.3 billion involved crypto investments or payments, spread across roughly 150,000 complaints.

Losses from global rug-pull scams, which are phony crypto offerings that quickly skyrocket and then plunge to near worthlessness, reached nearly $6 billion in early 2025, despite a decline in incidents.

Scammers now prefer cryptocurrency as the payment method for all kinds of fraud, whether it’s for tech support, romance, phishing, or extortion scams, because it’s difficult to trace and impossible to reverse. The moment someone tells you to download a crypto wallet app or send payment via Bitcoin, Ethereum, or any other digital currency, you’re likely dealing with a criminal.

Everyone Is a Target, But Some Groups Face Higher Risk

Because of the decentralized, borderless nature of cryptocurrency, international criminal syndicates are able to operate from jurisdictions with weak enforcement while targeting victims worldwide. This problem isn’t just affecting young, tech-savvy early adopters or risk-seeking day traders. It is also affecting ordinary people worldwide, including first-time investors and victims of other types of scams across all age groups.

Individuals aged 60 and over, who lost a total of $2.8 billion in 33,000 crypto fraud incidents in 2024, face particularly severe financial impact as this amount represents their life savings, retirement funds, or money earmarked for healthcare, housing, or supporting family members. The emotional and financial devastation extends far beyond the dollar figures.

Older adults are so heavily targeted because they’re more likely to have substantial savings available to invest, may be less familiar with how cryptocurrency works, and often have more time to engage with scammers. In some cases, individuals were seeking to financially recover after recent market downturns, making high-return crypto promises particularly appealing.

Younger investors are targeted through different channels, such as social media, but the fundamental vulnerability remains the same: the promise of quick wealth and sophisticated social engineering.

The Most Common Crypto and NFT Scam Types

Pig-Butchering Investment Schemes 

Considered the most devastating category, pig-butchering scams originate from the farming practice of fattening a pig before slaughter, chillingly describing the scammer’s approach. These long cons run for months as criminals build relationships with victims through dating apps, social media, or wrong-number texts that turn into friendly conversations.

Gradually, the scammer will introduce the topic of cryptocurrency, positioning themselves as either a successful investor or someone learning from a knowledgeable mentor. Patiently, they guide the victim onto a fake but professionally designed, fully functional trading platform that shows real-time market data and walk them through making initial deposits and trades. On screen, the victim sees their account balance grow, which encourages them to deposit increasingly larger sums. Many even liquidate retirement accounts, take out loans, or sell property to invest more.

When the victim attempts to withdraw funds, the platform suddenly requires tax payments or verification fees, or threatens frozen accounts unless more money is deposited. 

If victims refuse to send additional funds, the scammer ghosts them, the platform shuts down, and they discover that no trading ever occurred. Every dollar they sent went directly into criminal wallets.

Rug Pulls in Memecoins and DeFi Projects 

Modern rug pull schemes are named for the action of pulling the rug out from under someone and leaving them shocked or helpless. One popular rug-pull method involves memecoins such as Dogecoin and Shiba Inu, which were hype-driven cryptocurrencies inspired by internet trends. Another involves DeFi (decentralized finance) projects, which offer financial services such as trading, lending, and investing outside of traditional banks. 

Both can be legitimate, but their fast-moving, lightly regulated nature also makes them prime targets for scams, especially rug pulls where creators suddenly drain funds and disappear. However, these schemes do not offer a clear utility or roadmap, relying entirely on hype, memes, and community without articulating a specific use case, technical innovation, or development path.

To build credibility before they exit, scammers might:

1. Launch a crypto campaign with seeming transparency, using identities that are often stolen or fabricated
2. Seed a liquidity pool that is locked for a period to demonstrate their commitment
3. Employ obscure auditing firms that merely rubber-stamp the project without a genuine security review
4. Coordinate with influencer networks to create viral social media buzz around the fake crypto project
5. Use bot networks to simulate active trading and enthusiastic community discussion
6. Gradually siphon the funds through complex smart-contract functions while maintaining the appearance of locked liquidity
7. Finally drain the remaining funds and disappear, often blaming hackers or claiming the project was itself compromised

Phishing and Wallet-Draining Attacks

Targeting NFT holders and crypto traders, this evolving scam includes:

• Fake mint sites and marketplace clones: Scammers create websites that look identical to legitimate NFT platforms. Victims who connect their wallets to these phishing sites and approve transactions inadvertently sign malicious contracts that drain their assets.
• Discord and social media impersonation: Criminals compromise or imitate official project Discord servers, Twitter accounts, and Telegram groups, posting fake announcements about NFT drops or security updates that link to phishing sites.
• Malicious wallet updates: These involve fake browser extensions, mobile apps, or email warnings claiming your wallet software needs an urgent security patch. Once you install the malicious version, attackers access your private keys or seed phrases.
• Customer support impersonation: Scammers pose as support staff from crypto exchanges, wallet providers, or NFT platforms, asking victims to share security information or provide remote access to their computers to resolve fabricated issues.

The common thread across all these attacks is social engineering combined with the irreversible nature of blockchain transactions. Your confusion, an urgent email, one click, and your assets are gone with no way to reverse the transaction.

Crypto and NFT Scams Still Evolving

From 2020 to 2022, many of these early crypto and NFT scams consisted of poorly designed websites, unrealistic promises, and little effort to hide criminal intentions. Today, crypto criminals have become more efficient and effective. As an example, the number of rug-pull incidents declined by about 66% in early 2025, yet the total value stolen still exploded to $6 billion, up from roughly $90 million the year before. 

Organized crypto scam operations are characterized by:

• Multi-wallet structures where funds might pass through dozens of addresses across different blockchains before disappearing into mixers that blend transactions to hide their origin or are cashed out through unregulated exchanges.
• Honeypot smart contracts, which are seemingly legitimate tokens that can be purchased normally, but the underlying code contains hidden functions that prevent buyers from selling when they want to cash out. The contract is designed to trap liquidity, hence the name.
• Professional marketing and community-building, where scammers may hire website designers, influencers, and individuals to post fake positive reviews on social media. They could also deploy bots to simulate active trading and enthusiastic community discussion, and create fabricated LinkedIn accounts with AI-generated profile photos.

How to Protect Yourself from Crypto and NFT Scams Today

Protecting yourself from modern crypto scams requires more than awareness; it demands consistent habits, smart decision-making, and the right tools. As threats continue to evolve, building strong security practices today is the best way to stay ahead of increasingly sophisticated attacks.

Step 1: Decide If Crypto and NFTs Fit Your Risk Profile

Given that investment fraud is now the top fraud category by value in the U.S. and crypto-enabled fraud accounts for the majority of those losses, you will need to critically evaluate whether investing in cryptocurrency or NFTs aligns with your financial goals and risk tolerance.

This space combines extreme price volatility, complex technical requirements, irreversible transactions, minimal consumer protection, and a target-rich environment for criminals. If any of the following apply to you, your wisest choice is to proceed with extreme caution or avoid crypto investment entirely:

• You’re investing money you can’t afford to lose.
• You feel time pressure or fear of missing out, driving your decisions.
• You don’t fully understand cryptocurrency wallets, private keys, and blockchain transactions.
• You’re being introduced to the opportunity by someone you met only online.
• The promised returns seem unusually high compared to traditional investments.
• If something goes wrong, you likely have no way to recover your funds.

Choosing not to invest in crypto isn’t missing out, but making a risk-aware decision. Traditional, regulated investment vehicles may offer lower potential returns, but they come with legal protections, regulatory oversight, and mechanisms for recovering from fraud.

Step 2: Adopt Essential Anti-Scam Rules

If you decide to invest in cryptocurrency or NFTs anyway, adopt these fundamental security practices to dramatically reduce your vulnerability:

Never Send Crypto Based on Unsolicited Contact

If someone reaches out to you through any medium who steers the conversation to cryptocurrency investment opportunities, you’re almost certainly being targeted for fraud. Legitimate investment opportunities don’t find you this way.

Similarly, any communication that promises guaranteed returns, uses urgency, or pressures you before you can independently verify information is a red flag.

Verify Platforms Independently and Exhaustively

Before depositing funds anywhere, verify the platform’s legitimacy through multiple independent sources. Look for:

• Regulatory registration: Many scam platforms falsely claim regulatory compliance, so verify directly with your country’s regulator. In the U.S., check the websites of the Securities and Exchange Commission and the Commodity Futures Trading Commission for registered entities. 
• Independent reviews: Beyond testimonials or reviews on the platform, look for experiences on Reddit, Twitter, and crypto community forums. Scammers might seed fake positive reviews, so look for detailed negative experiences rather than just star ratings.
• Team transparency: Legitimate projects are run by real people whose professional backgrounds can be verified through LinkedIn, academic publications, or previous work. Note that AI-generated faces and bios are common in scams.
• Active audit reports: If a DeFi project claims to be audited, verify that the audit was performed by a reputable firm and read the report, not just the passed audit badge.
• Domain age and history: Use WHOIS lookup tools to check when a website’s domain was registered. Scam sites are often brand new, while legitimate platforms have longer operational histories.

Master Wallet Security Fundamentals

If you’re holding cryptocurrency or NFTs yourself rather than on an exchange, you’re personally responsible for security. Essential practices include:

• Use hardware wallets: These are physical devices such as Ledger or Trezor for significant holdings rather than software wallets on your computer or phone. Hardware wallets keep your private keys isolated from internet-connected devices, dramatically reducing risk.
• Store your seed phrase offline in multiple secure locations: This is the 12- to 24-word recovery phrase for your wallet. Write it on paper or stamp it on metal plates, never store it digitally in photos, cloud storage, or password managers.
• Never share your seed phrase or private keys: No legitimate support person will ever ask for these. If someone does, they’re attempting theft.
• Verify transaction details carefully before approving: Check that the recipient address, amount, and token type are exactly what you intend. Malware can change clipboard contents, so compare addresses character by character.
• Use a separate email account: Create a separate email address for your crypto activities, distinct from your day-to-day credentials, and enable two-factor authentication, preferably via authenticator apps rather than SMS.
• Be extremely skeptical: In the current environment, you should assume any new cryptocurrency token or NFT project is a scam until you’ve verified otherwise through sustained, careful research. 

Step 3: Respond Immediately If You’ve Been Scammed by Crypto and NFTs

Discovering you’ve been scammed is devastating, but taking immediate action could limit the damage and help law enforcement track and stop criminal operations:

Stop All Further Payments Immediately

Scammers often follow successful scams with additional pitches: recovery services usually run by the same criminals, tax payments supposedly required to unlock frozen funds, or claims that you’re so close to breaking even if you just invest a bit more. Every additional dollar you send is stolen money. Stop entirely.

Document Everything Comprehensively

Before anything disappears or times out, make sure to save:

• Screenshots of all conversations, transactions, and account dashboards
• Email messages, text messages, and voice messages
• Wallet addresses, transaction hashes, and blockchain records
• Platform URLs and any documents or contracts you signed
• Names, social media profiles, and phone numbers used by the scammers

This documentation is essential for law enforcement investigations and any potential recovery efforts.

Report to Multiple Authorities

While full recovery is rare, rapid reporting has occasionally allowed exchanges to freeze funds or helped international task forces seize assets before they’re fully laundered. Don’t expect miracles, but don’t assume recovery is impossible either.

Make formal reports to the:

• FBI Internet Crime Complaint Center (IC3): Even if your loss seems small compared to the billions reported annually, your complaint adds to the IC3 pattern analysis that helps identify and dismantle criminal networks.
• Federal Trade Commission: Complaints made to ReportFraud.ftc.gov feed into consumer protection initiatives and help identify trending scam tactics.
• Your exchange or wallet provider’s fraud team: If you used a legitimate platform for any part of the transaction, reporting the incident will enable your exchange or wallet to flag addresses or provide transaction data to investigators.
• Your local or state law enforcement: These agencies work with federal law enforcement, particularly if losses are substantial. 

Consider Professional Help for Significant Losses

If you’ve lost large sums, consider consulting with lawyers who specialize in cryptocurrency fraud or employing blockchain forensics firms that can trace funds across chains. 

Protect Yourself from Recovery Scams

After a crypto scam, many victims are approached by fake recovery specialists who claim they can get your money back for an upfront fee in, you guessed it, cryptocurrency. These are almost always the same criminals or their associates running a second scam. Legitimate legal professionals work on contingency or retainer, and will not ask victims to send cryptocurrency for recovery services.

Step 4: Install a Trusted Security Solution

Comprehensive cybersecurity solutions may not be a guaranteed shield against all fraud, but they serve as a critical layer that catches threats you might not spot in that moment. Solutions such as McAfee+ help block known phishing sites and warn you before you enter credentials or connect wallets to fraudulent platforms. They also help detect malware and keyloggers that capture your password and seed phrase keystrokes, take screenshots when you open wallet applications, or even replace destination addresses in your clipboard when you copy-paste. Antivirus and anti-malware tools continuously monitor for threats and help remove them before they can compromise your security.

A secure virtual private network (VPN) can protect your connection on public Wi-Fi networks or compromised routers, preventing man-in-the-middle attacks that might intercept your login credentials or transaction data.

Since many crypto scams begin with or lead to broader identity theft, identity monitoring services can alert you if your personal information, passwords, or financial details appear in data breaches or on dark web marketplaces. This early warning allows you to change compromised credentials before they’re exploited.

Final Thoughts

The rising number of crypto-related fraud incidents and losses represents a grim milestone. As long as these scams promise high returns and operate with minimal oversight, criminal organizations will continue developing new tactics to steal from investors. 

Going forward, your effective defense strategy will combine healthy skepticism, technical hygiene, continuous education, and practical tools. Approach any crypto investment opportunity with a questioning eye until you’ve independently verified that it is legitimate.

Maintain strong security practices, including using hardware wallets for significant holdings, storing seed phrases offline, enabling two-factor authentication everywhere, and carefully verifying transactions before approving.

Most importantly, build a network of trusted advisors, such as family members, friends, or financial professionals, who can offer guidance when you’re evaluating opportunities. Share what you’ve learned from this article and other McAfee guides with people in your life who might be exploring crypto investments, especially those who may be more vulnerable to relationship-based scams.

The post How to Spot a Crypto Scam: The Top Red Flags to Watch For appeared first on McAfee Blog.