Web3 Scam Prevention Guide
There’s no customer support on-chain that can help you reverse a transaction. Most people don’t lose money because their password was cracked, but because they confirmed a transaction themselves, copied the wrong address, or trusted someone they shouldn’t have.
Even experienced users can slip up. The habits below are more useful than memorizing a hundred project names.
Remember these four rules first; everything that follows expands on them:
Never share your recovery phrase or private key with anyone. Not official staff, customer support, your partner, AI, or your boss. Anyone who asks is trying to steal from you.
If you don’t understand a signature request, reject it. Being in a hurry, thinking the page is frozen, or clicking several times are some of the most common ways people slip up.
Check the full address, not just the first and last characters, and not the name. Coin names can be faked, and so can the first and last four characters.
If they're asking you to send money first to get your money back, stop. Whether it's a reward, withdrawal, recovery, upgrade, or unfreezing your account, the rule is the same.
Keep large holdings separate from money you use day to day. Use a small wallet for testing, claiming airdrops, and trying new projects, and replace it every so often. Keep your savings in a hardware wallet or on a major exchange (such as Binance), and don't connect it to websites for everyday use.
1. Check the person first: friends, support agents, dating, and job offers
A friend suddenly asks to borrow money or collaborate: On Telegram or WeChat, a friend may suddenly ask you to send them USDT or mention an urgent project. Their account may be hacked, or the person messaging you may be using an impersonation account. Profile photos, usernames, and writing styles can all be copied. Call them using a number you dial yourself to confirm. If they refuse a voice call, stop. If they urge you to "not tell anyone" or say they "can't talk about it in the group," be even more cautious. Once an account is hacked, scammers may use it to spam everyone, so don't be the person who forwards links before anyone has even contacted you.
Fake support agents: Especially when there's a problem with an exchange or project, someone may proactively message you claiming to be official support and ask for a verification code, recovery phrase, screen sharing, or for you to transfer funds to a supposed "safe address." Real support agents won't contact you out of the blue or ask for your recovery phrase. To reach official support, use the help section in the app or visit the official site from your own bookmark. Don't use links in private messages, comments, or emails.
Pig-butchering scams: They chat with you for weeks on a dating app or Telegram, then steer you to an "investment platform." You can withdraw small amounts, but when you try to withdraw a large amount, they demand taxes or a deposit, and eventually the website disappears. If you're asked to pay more before withdrawing, don't pay. No matter how long you've been talking or how convincing the profit screenshots look, this doesn't change.
Fake giveaways and deepfakes: They steal or impersonate accounts belonging to celebrities or project teams, or use AI video and voice to livestream and promise to send back two coins for every one you transfer. A video or voice that looks or sounds real doesn't prove that the person is actually speaking.
Fake job offers: The job and interview look real, but in the end they ask you to download an "assignment," internal meeting software, or a "test wallet." The download could install a Trojan. Do assignments on a clean computer that you don't use for your wallet or exchange accounts. If they ask you to pay a "training fee" or "equipment deposit," consider the interview over.
Fake recovery services: Just after you've been scammed, someone claims they can recover your assets in exchange for an upfront fee or legal costs. That's a second blow. Treat unsolicited offers of "legal assistance" or "on-chain tracking services" in comments or private messages as scams by default. Legitimate channels won't ask for cryptocurrency upfront or guarantee they'll get your money back. Coins sent on-chain are usually gone for good. First, limit your losses: replace any compromised wallet, revoke approvals, and change your email and exchange passwords. Don't hand over the rest of your money just to "try one more time."
2. Check your devices and files first: Trojans, remote access, and clipboard hijacking
Archives and unfamiliar files: Someone sends you a compressed file to review documents, sign a contract, or look at information, and asks you to open it on your computer. Opening it could let them control your computer remotely, steal your wallet, replace clipboard addresses, and then use your account to spam others. Even if it comes from a friend, call to confirm first. Don't download or forward it. For work documents, ask for a read-only cloud link or use a reputable collaboration tool you're familiar with. Don't double-click unfamiliar archives, macro-enabled documents, or installers.
Software downloads containing Trojans: If you install browser extensions, trading bots, translation software, or meeting apps from search results or ads, remote access to your computer could let someone replace a correct address you copied with a scammer's address when you paste it. Download software only from official websites. When transferring funds, check the full address on your hardware wallet or phone screen, not just the line shown in your computer browser.
Meetings and remote assistance: Someone proposes a collaboration and asks you to install specific software, or AnyDesk, TeamViewer, or Sunlogin, claiming they'll help you check your wallet remotely. During screen sharing, your recovery phrase and verification codes can be seen. Don't open your wallet during someone else's remote session, log in to an exchange while sharing your screen, or read out verification codes. If they insist that "we can't continue without remote access," walk away from the deal.
Clipboard hijacking: Malware silently replaces the recipient address when you paste it. You copied the right one, but the pasted one is wrong. Before transferring, check the full address, not just the first and last characters. Checking it again on your hardware wallet or phone is more useful than checking it twice on the same infected computer.
Fake hardware wallets: Devices bought through unofficial channels may come with a recovery phrase already set up. You may also get an email asking you to enter your existing recovery phrase for a "firmware update." Buy hardware wallets only from official websites. Anyone asking for a recovery phrase you already have is trying to steal it. If a new device displays a pre-generated recovery phrase the first time you turn it on, don't use it—return it.
3. Signatures and approvals: The easiest way to lose everything with "one click"
Connecting your wallet usually just lets a website see your address. By itself, it doesn't mean you've handed over your coins. The real danger is the signature that comes next, or the approval you grant.
Signature chaining: The first transaction is a normal claim or login. Right after signing, a second and third pop up. You confirm them without thinking, and before you know it, you've granted unlimited approval. Review each pop-up individually, and close the page as soon as another transaction appears. Sometimes we think the page is stuck and click a few more times. It isn't stuck—the other party is waiting for you to slip up.
Confirming signatures you don't understand: The pop-up shows a long string of English text or hexadecimal data, and you're in a hurry, so you click Confirm. The signature you just approved may actually hand control of your wallet to someone else. If you don't understand it, reject it. Legitimate processes can wait while you figure things out. Stop and take a closer look if you see any of these terms:
approve, especially with an unlimited allowance
setApprovalForAll
Permit, Permit2
increaseAllowance
Raw message signatures, such as eth_sign, where the wallet only displays a string of data you can't understand
Signatures like Permit and Permit2 often don't cost Gas and won't immediately show up as an outgoing transaction in your transaction history, so you may think, "I didn't pay anything." The other party can use your signature to pay Gas later and transfer your coins. Some people don't realize their coins have been drained until months later, because nothing seemed to be lost when they signed.
Another kind of signature bundles many steps into one: it looks like you're claiming a reward, but it also changes your account permissions. If your wallet can simulate "what will happen after signing," check the simulation results first. If the simulation is unclear, or the wallet only shows you a hash, reject it.
Revoke approvals when you're done: Unlimited approvals you've granted to decentralized exchanges, old projects, or unfamiliar websites stay active until you revoke them. A project's frontend could be hacked, or you may have clicked a phishing page once—the other party could use the approval much later to transfer your assets. Every so often, use the approval page built into a block explorer or an approval checker you trust to revoke approvals you no longer need. Open these tools only from your own bookmarks, not from links in a group chat that claim to "check your approvals for you." Revoking an approval costs a little Gas; that's normal.
Multisig and account delegation traps: Someone may claim it's "for more security" and ask you to add your wallet to a multisig, or sign an account delegation that includes the other party's address as a signer. Once you sign, they can transfer your assets. A multisig only makes sense if you know every signer and have verified each one offline. Don't sign any "security upgrade," "safer custody," or "I'll add protection for you" offers from strangers.
Fake airdrops: An unfamiliar token suddenly appears in your wallet, or someone sends a link saying you've won a prize or have an unclaimed airdrop. The link leads to a phishing site, and one signature can get your wallet drained. If you didn't sign up for it, don't click or approve anything. Links to claim rewards in tweets that suddenly tag you, pinned comments, and private messages are often scams of this kind.
The same goes for email. It may look like it came from the project, with a subject like "You have an airdrop waiting to be claimed" or "Claim soon before the deadline." Logos and layouts can be copied convincingly. Don't click buttons in the email; go to the project's official account and open the site from your own bookmark. Be careful with "Click Verify first" prompts after joining a Discord server, too. Verification shouldn't send you to an unfamiliar site that asks you to connect your wallet and sign something. Official verification usually happens through Discord's own process.
Dust tokens and NFT ads: Anyone can send you a token or NFT, with a website address hidden in its name to lure you into claiming, selling, or bridging it. Don't swap unfamiliar tokens, approve them, or click URLs in their names. If a balance suddenly appears in your wallet, assume it's bait, not luck. Just hide it; you don't need to interact with it.
4. Addresses and fake coins: Names can deceive you, and so can the first and last characters
Fake tokens: On chains like Ethereum and BSC, anyone can create a token named BTC, ETH, or USDT. Some are counterfeit coins; others are honeypots that you can buy but not sell. Many people see a high price and try to sell, only to get scammed. The name can be fake, and so can the price. Check the contract address, not the name. Copy the address from the project's official website or a token page on a block explorer you trust—not from chat history, candlestick-chart screenshots, or forwarded messages.
Honeypots: The contract lets you buy but not sell, or charges such a high sell tax that all your money is effectively taken. Before buying, test a sale with a tiny amount. If you can't sell, stop. Don't add to your position just because you've "already bought in."
Address poisoning: An attacker creates an address that looks like one you use, matching the first and last characters, then sends a tiny amount to put it in your transaction history. If you copy an address from your history, your money goes to the wrong place. Don't copy addresses from transaction history. For a large transfer, send a small amount first and send the rest only after it arrives. Check the entire address every time, including the long string in the middle. Save frequently used addresses in your address book and select them from there when sending, rather than from recent transactions. If someone sends you a new address, confirm it again using a method you've previously agreed on. Don't trust a single message.
The last thing to check is the complete string of characters about to be sent—ideally on your hardware wallet's screen.
Fake website phishing: The domain may differ by one letter or use foreign characters that look identical. Links often come from search ads, tweet replies, Discord announcements, or emails, and are used to trick you into logging in, connecting your wallet, or entering your recovery phrase. Don't assume the first search result—or one labeled "Ad"—is the official site. Even for official sites in your bookmarks, occasionally check that the domain is still the right one.
Fake bridges, fake exchanges, fake mainnets: A page can be made to look almost exactly like a real bridge or exchange. One click to swap or approve, and your assets are transferred away. There's also a subtler trick: an attacker sets up a fake network with a Chain ID and name that look official, then creates a fake bridge to get you to bridge your coins over. Once bridged, your coins are on their chain, not the real mainnet. Before adding a new network to your wallet, check the Chain ID and RPC against the official documentation—not against a message in a group chat.
5. Projects and returns: If it seems too steady for the market, assume there's a problem
Rug pulls: After a project pumps its price, the team pulls the liquidity and the price crashes to zero. Or the team's own tokens are gradually dumped on the market. Check whether liquidity is locked, for how long, and whether the contract can mint more tokens, blacklist addresses, or change the tax rate. If the project team controls all these permissions, a good-looking price doesn't mean you'll be able to sell. If you don't understand the contract, keep your position small and assume it could go to zero.
High-yield Ponzi schemes: Quantitative trading, nodes, mining pools, staking—anything promising fixed daily or weekly profits. Early withdrawals are often paid with money from later investors. If returns are more stable than the market, assume it's a Ponzi scheme. Real trading and mining can lose money and fluctuate. If entry is easy but withdrawals get blocked and you're asked to recruit others, the structure tells you all you need to know.
Over-the-counter trading scams: The other party takes your fiat and doesn't release the coins, or releases the coins and then freezes your fiat. Informal escrow in group chats offers no protection, and in-person trades can put your safety at risk. Use a reputable exchange whenever possible. If you must trade over the counter, start with a small amount. Don't send coins to a private address belonging to a supposed "escrow support agent," and don't meet strangers in remote places. The other party's escrow account may be run by the same people as the seller.
6. Your accounts: Recovery phrases, APIs, phone numbers
Storing your recovery phrase in the wrong place: A screenshot in your photo library, a copy synced to cloud storage, a note in an app or text file, or sending it to someone else—if your device gets infected with malware, your entire wallet could be drained. The result is the same if your cloud account is hacked. Write your recovery phrase down by hand and store it offline. If you need a backup, make another handwritten copy and store it separately. Don't photograph it or send it in any chat, including your own "File Transfer Assistant."
Giving your private key to AI or uploading it to GitHub: Pasting a private key into a chatbot or putting it in a configuration file and pushing it to a code repository—bots specifically scan repositories for newly committed keys. Treat any recovery phrase you've pasted as compromised immediately and move your assets to a new wallet. It's also a good idea to use a small wallet for testing and replace it every so often. AI can help you inspect a public contract address or explain what a transaction does, but it can't "store," "verify," or "recover" your recovery phrase. If a tool asks you to enter your recovery phrase to continue, close it.
Fake wallets and extensions: Counterfeit versions of Binance Wallet, MetaMask, and other wallets may be installed from ads or links outside official app stores. Once installed, they ask you to import your recovery phrase. Install wallets only from their official websites. For browser extensions, check the developer's name and official domain; don't rely on whether the icon looks right. If you've already entered your recovery phrase into a fake extension, consider it compromised and move your assets immediately.
API permissions that are too broad: You give an unfamiliar program an API key that can trade and withdraw funds to use a copy-trading service or bot. If the key is leaked, someone can place orders or take your funds. API keys should be read-only by default. If you really need trading access, create a separate key with no withdrawal permissions and bind it to an IP address. Don't share your key in group chats, support tickets, or screenshots. Don't use copy-trading bots that require withdrawal permissions.
SIM swapping: Your phone number is transferred to someone else's SIM card, your email and exchange accounts are reset, and verification codes go to the other person. Use an authenticator app or hardware security key for two-factor authentication; don't rely on SMS as your only layer of security. Enable extra protections with your carrier against number porting and SIM replacement. Turn on withdrawal address whitelisting at your exchange, with a waiting period before new addresses become active. Use a strong, unique password for your email—don't reuse your exchange password.
7. A few other common scams
QR codes: Payment QR codes can be swapped out, and login QR codes can take you to phishing sites. Check the domain before scanning, then check what the wallet is asking you to sign. For in-person payments, verify the complete address, not the shortened string shown on screen.
Group announcements and pinned posts: Group owner or admin accounts can be hacked, and changing a pinned link once can send an entire group to sign a malicious approval. Treat announcements only as clues; still access the site through your official bookmark.
Comment sections and hacked high-profile accounts: People specifically reply to popular posts with "Claim from the official account." A hacked high-profile account may also post something that looks just like its usual content. A verification badge isn't enough. Open the profile and check the link's domain. Never sign anything through a comment.
Trading signals, tips, and gurus: Screenshots of guaranteed profits are easy to fake. If someone asks you to give them API withdrawal permissions or deposit money on a platform they specify, go back to the two rules above: grant minimal permissions, and stop if you're asked to pay more before withdrawing.
Using the same computer for work and storing large amounts: Unfamiliar installers, cracked software, and shady "multi-accounting scripts" may be designed just to replace your clipboard contents. Keep your large-value wallet away from these things.
8. Take 30 seconds to check before transferring or signing
Did I get to this page from my bookmark? If not, close it first.
Are they asking for my recovery phrase, verification code, remote access, or an upfront transfer? If so, stop.
Can I explain this signature in one sentence? If not, reject it.
Did another transaction pop up right after I signed? If so, close the page.
Have I checked the full address? Matching first and last characters isn't enough.
Is the amount large? If so, send a small amount first, then send the rest after it arrives.
Is this an unlimited approval? If so, change it to the exact amount you need and revoke it when you're done.
Are they rushing me? The more they rush you, the slower you should go. Legitimate money won't disappear because you took 30 seconds to check.
9. If you've already clicked, take these steps in order
Don't start by contacting someone in a private message who claims they can "recover" your funds. Do this first:
Disconnect from the internet: If your computer is infected, you've installed unfamiliar software, or you've used remote access, don't enter any recovery phrases on that device again.
Use another clean device or a hardware wallet to move any remaining assets to a completely new wallet. If your old recovery phrase has ever been entered on a website, shared with someone, or stored in the cloud, don't use it again.
Revoke token approvals for the old address from a clean device. Revoking requires a signature from the old wallet, so make sure you open the approval checker from your bookmark.
Exchange: Change your password immediately, log out of all sessions, reset your API keys, and check your withdrawal whitelist and recent withdrawals. If your authenticator may be compromised, replace it.
Change your email and phone account passwords too, and check for unfamiliar forwarding rules. If SMS isn't your only verification method, remove it from important accounts.
Treat this address as compromised. Don't send any more money to it.
Keep the transaction hashes and timestamps so you can provide them to an exchange or law enforcement later. The chance of freezing funds is small, but it's still more sensible than paying what's left to a "recovery service."
I hope this article helps you avoid some common pitfalls. Feel free to share it with friends, and thanks for reading!