How crypto is stolen without a hack: 8 scam schemes

On 19 December 2025 an investor did everything experienced users recommend. First he sent a 50 USDT test transfer to the right address and confirmed it arrived. A few minutes later he sent the rest: 49,999,950 USDT. He copied the recipient address from his wallet history. It was the scammer’s address.

Nobody hacked his wallet. There was no virus and no stolen keys. He signed the transfer himself. The case was described in the media, and we retell it from those reports. Judging by the Chainalysis and FBI figures below, that is how the most money is lost in crypto: not because someone “hacked” the victim, but because the victim was talked into doing it themselves.

Below are eight schemes used to take crypto from people. Each comes with a step-by-step breakdown: what the victim sees, what is really happening, a real case, warning signs and a way to protect yourself. Data as of 2026-11-10.

Need to vet an address right now? Check the address.

What is in this breakdown

1. Investment schemes (“pig butchering”): a “friend” from a messenger and a platform with a growing balance.
2. Impersonation: “exchange support” that knows your data.
3. “Recovery services”: promises to return what you already lost.
4. Crypto ATMs: cash deposited on someone else’s phone call.
5. Drainers: a signature that hands over the wallet.
6. Address poisoning: the $50M case above.
7. Rug pulls: a token that rises until it vanishes.
8. Lookalike tokens: “flash USDT” and payment with an empty token.

First, the money: which schemes take the most

The structure is clearest in the FBI’s annual report (IC3). These are complaints from Americans, so the picture worldwide may differ.

Investment schemes accounted for $7.2B across 61,559 complaints, about 63% of all reported crypto losses ($11.366B across 181,565 complaints). “Recovery services” brought $1.4B, crypto ATMs $389M. Categories in the report may overlap, so do not add them. Chainalysis puts worldwide scam revenue for 2025 at no less than $14B, possibly up to $17B.

1. Investment schemes (“pig butchering”)

It starts with a “mistake”. A stranger messages you: wrong number, sorry. The chat picks up on its own. Within a week you know everything about them and they know you. Then, casually, they mention that they earn well on crypto and show you a platform.

How the scheme works

This is called pig butchering: the victim is fattened with trust and then everything is taken. The platform is fake and the balance on it is simply drawn. You deposit a small sum, the balance grows, early withdrawals sometimes even go through so that you believe. Then you deposit more. When you try to withdraw a large amount, you must pay a “tax” or “fee”. You can pay as much as you like; there will be no withdrawal. Then the contact vanishes.

1. Contact disguised as a mistake or random encounter.
2. Weeks of conversation and trust.
3. An offer to “try” the platform with a small amount.
4. The balance grows, early withdrawals sometimes go through.
5. You deposit more, and on withdrawal you are asked for a “tax” or “fee”.
6. No withdrawal ever comes, the contact vanishes.

Real case

On 18 June 2025 the US Justice Department filed to seize $225.3M in USDT tied to such schemes. By media reports it is the largest seizure in such cases in US history. More than 400 victims were mentioned, and 144 accounts at one exchange with IP addresses in the Philippines through which, per the filing, about $3B passed in a year. This is only a seizure filing; no final decision had been reported at the time of writing.

Warning signs

• A stranger quickly moves from conversation to money.
• The platform was recommended by someone from a chat.
• Withdrawing requires an extra payment: tax, fee, “deposit”.
• You cannot withdraw even a small amount.

How to protect yourself

Deposit nothing if the platform was recommended by a barely known person from a chat. A balance on a website can be drawn; a withdrawal cannot. If you are asked to pay extra to get your own money, the scheme has already worked.

2. Impersonation: “support” that knows your data

Picture a call “from the exchange”. They address you by name, know your phone number and say there is a suspicious login on your account. The number they call from is almost like the real one. It sounds convincing because the scammer found your data in leaks beforehand.

How the scheme works

Then it follows a script: a spoofed email with a “case number”, a request to urgently move funds to a “safe wallet” or add an address to the whitelist. The “safe wallet” belongs to the scammer and the money spreads across addresses.

1. Collecting personal data from leaks.
2. A call or email: “suspicious activity on your account”.
3. A spoofed email with a “case number”.
4. A request to urgently move funds to a “safe wallet” or whitelist an address.
5. The money goes to the scammer’s wallet.

Real case

Researcher ZachXBT estimated that Coinbase users lost more than $65M in December 2024 and January 2025, and by his words the real figure is higher. He described exactly this script: data from private databases, “unauthorized login attempts”, a spoofed email with a made-up case number. On 19 August 2025, per his data, one person lost 783 BTC (about $91M): the attackers posed as exchange and hardware-wallet support, obtained personal data and moved everything in one transaction. No suspects were named and ZachXBT ruled out Lazarus. These are the researcher’s estimates, not court findings.

Chainalysis names impersonation as one of the fastest-growing schemes: by its figures it grew by roughly 1,400% in 2025. The same report gives the average victim loss, up from $782 to $2,764, though it is not entirely clear which sample that average covers.

Warning signs

• The message frightens and rushes.
• You are asked to move money “somewhere safe” or to read out a code, password or seed phrase.
• The call or email came on “support’s” initiative, not yours.
• The sender’s number or address is “almost like the real one”.

How to protect yourself

Hang up and open the exchange’s app yourself from a bookmark. Real support never asks for a seed phrase, password, SMS code or a transfer to another wallet.

3. “Recovery services”

The most cynical scheme: you already lost money, and then “specialists” write to you. They found your funds, they have contacts at exchanges, they will return everything. A small prepayment is needed for “work” or “unlocking”.

How the scheme works

The prepayment goes out and nothing comes back. Often you are asked to pay more: a “tax”, “insurance”. The person loses money a second time. In the FBI’s 2025 report such schemes brought $1.4B across 10,516 complaints. We found no verified individual cases with amounts, so we show only the overall figure.

1. You tell your story of loss or leave contact details.
2. A “recovery specialist” writes to you.
3. They “find” your money and send “proof”.
4. They ask for a prepayment in crypto.
5. After payment they vanish or name new payments.

Warning signs

• They write to you first after you lost money.
• They promise guaranteed recovery.
• They demand prepayment, especially in crypto.
• They press with urgency: “the chance is only today”.

How to protect yourself

Remember that real recovery goes through police, the exchange and the courts, and never pay upfront to anyone who writes to you first after a loss.

4. Crypto ATMs

A “bank employee” or “police officer” calls. Your money is in danger, they say, and explain how to save it: withdraw cash and deposit it in a special ATM. You go, keeping them on the line the whole time. On the ATM screen you select the address you were dictated.

How the scheme works

The cash turns into crypto and goes to the scammer’s wallet. It cannot be returned. The victim stays on the line and the “employee” does not let them stop and think. That is the entire calculation.

1. A call “from the bank” or “from the police”.
2. A story: “your funds are at risk”.
3. An instruction: withdraw cash and deposit it into a crypto ATM.
4. The scammer dictates an address or sends a QR code.
5. The money goes on-chain to the scammer’s wallet.

What is known

Per the FTC (as relayed by media), losses from Bitcoin ATM scams in the first half of 2024 exceeded $65M, against about $114M for all of 2023. That is nearly a tenfold rise from 2020 to 2023. 71% of the first-half 2024 losses came from people over 60, and the median loss was $10,000. Most cases are impersonation of a government agency or a business, and “tech support”. In the FBI’s 2025 report crypto ATMs accounted for $389M across 13,460 complaints.

Warning signs

• You are walked to an ATM over the phone and not allowed to hang up.
• You are asked to deposit cash to “protect” money.
• The recipient address is dictated by the caller.
• A “bank” or “government” asks you to pay through an ATM.

How to protect yourself

Knowing that no bank, police or tax agency ever asks you to deposit money into a crypto ATM. Hang up and call back using the number from the official website. And tell someone close: scammers count on the victim staying alone.

5. Drainers: a signature that hands over the wallet

You see an ad for a “free mint” or a token giveaway. You open the site, click “connect wallet”, then “confirm”. You type nothing, nobody asks for a password. Everything looks usual.

How the scheme works

A drainer is a malicious site or script that empties a wallet. What you “confirmed” is in fact an approval or a permit signature. They give the site the right to spend your tokens without your involvement. The wallet meanwhile shows complicated text or nothing understandable, and within seconds the tokens go to the scammer’s address.

1. An ad for a “mint” or token giveaway.
2. You connect your wallet to the site.
3. The site asks you to sign a “confirmation”.
4. The signature gives the right to spend your tokens.
5. The tokens go to the scammer’s address.

What is known

Per Scam Sniffer’s report, in 2025 website phishing on EVM chains hit 106,106 people, losses were $83.85M and the average loss was $790. A year earlier there were 332,000 victims, $494M in losses and a $1,488 average. The largest 2025 theft, $6.5M, happened in September via a Permit signature. The largest of 2024 was $55.48M. The data excludes exchange hacks and contract exploits. Scam Sniffer says the drainer ecosystem stays active: as some exit, new ones take their place.

Warning signs

• A “free mint” or giveaway from a link in a chat.
• The site immediately asks you to connect a wallet and sign.
• The wallet window shows an “unlimited” permission for a token.
• The signature is requested blind: the text is unclear or absent.

How to protect yourself

Reading what exactly you are signing. If the wallet asks for permission to spend a token and you are buying nothing, close the page. Use a separate wallet with a small balance for risky sites. Granted permissions can be revoked in services that list approvals.

6. Address poisoning

You often send money to one recipient. Next time you open the wallet history, see the familiar address and copy it. The first and last characters match. Everything as usual, and that is the trap.

How the scheme works

The scammer generates an address whose start and end match your real recipient and sends a tiny transfer from it. Wallets show addresses abbreviated, so the fake cannot be told apart by eye, and in history it looks like a known recipient.

1. The scammer watches your transfers.
2. Generates an address with the same first and last characters.
3. Sends a tiny transfer from it, and the fake lands in history.
4. You copy the address from history.
5. The money goes to the fake.

Real cases

We started with December 2025 and the 49,999,950 USDT. Here are the details from media reports. The first three and last four characters of the fake address matched the real one. The 50 USDT test transfer did not help: the fake appeared in history only after it, via a 0.005 USDT transfer.

Earlier, in May 2024, per media reports, a user sent 1,155 WBTC (about $68M) to an address matching the first and last six characters. It was later reported that the attacker returned nearly all the money after negotiations, but other sources do not confirm a full return.

Per an academic study of address poisoning (Ethereum and BSC over two years), there were 270 million such attacks on 17 million victims, and 6,633 cases led to losses of at least $83.8M.

Warning signs

• A transfer appeared in history from an address you did not expect.
• A tiny amount (such as 0.005 USDT) from a “familiar” address.
• You copy an address from history rather than a trusted source.

How to protect yourself

Comparing the full address, not the edges. Do not copy an address from transfer history; use the wallet’s address book or copy the address directly from the recipient’s site. A test transfer does not protect against this scheme.

7. Rug pull: a token rises until it vanishes

A new token that everyone talks about. The price rises every day, chats say “everyone is buying”. You buy. A couple of days later you want to sell to lock in profit and cannot.

How the scheme works

A rug pull (exit scam) works like this: the creators raise money, then block selling or pull the liquidity and leave. The price falls almost to zero, the site and chat vanish.

1. The creators launch a token and put a small amount into a liquidity pool.
2. Ads, chats, promises of “x” returns.
3. The price rises and buyers invest more.
4. The creators block selling or pull the liquidity.
5. The price falls almost to zero, the site and chat vanish.

Real case

The best-known example is the SQUID token, November 2021, styled after a popular TV series. Trading began on 26 October at about a cent per token. By 1 November the price, per market aggregators, reached $2,861: from a cent to thousands of dollars in a week. Then the project’s site vanished, the creators stopped responding and holders could not sell on PancakeSwap. More than 43,000 people bought the token and the creators, by media estimates, got between $2M and $3.4M. The site claimed part of the money was locked by an “anti-dump” feature. PancakeSwap labelled it a rug pull.

There is no reliable overall figure for rug pulls: researchers count by different rules. DappRadar counted about $6B from the start of 2025 to April, but 92% of that is a single case, the collapse of the OM token, which the founders say was not a rug pull. The number of incidents is more telling: 7 versus 21 a year earlier. Fewer, but bigger.

Warning signs

• An anonymous team and promised returns.
• Advertising built on “everyone is buying” rather than a product.
• You cannot sell even a small amount.
• Liquidity is not locked and the coins sit in a few wallets.

How to protect yourself

Before buying, checking that the token can be sold, whether liquidity is locked and who holds most of the coins. Buy the minimum and try to sell it right away.

8. Payment in a lookalike token (“flash USDT”)

You sell an account or an item. The buyer sends a transfer and the wallet shows “+500 USDT” with a dollar price. You hand over the goods.

How the scheme works

USDT is just a token name; anyone can deploy one. The real USDT is identified by the contract address. If the address is different, it is a copy. Per Binance as relayed by media, the scammer launches a token, seeds a liquidity pool with $2,000–5,000, “pays” with it, then sells the tokens into the pool and takes the real money.

1. The buyer sends a token named USDT.
2. The wallet shows a dollar price.
3. You hand over the goods.
4. The scammer sells the tokens into the liquidity pool.
5. The real money is theirs; you hold a token with no buyers.

Real cases

In Venezuela, per media reports from September 2026, buyers paid shops with a zero-value copy of USDT, and in one case goods worth more than $5,500 went out for such a token. It is one person’s account. In Binance’s warning of 2026-10-27 a TikTok account was sold for 0.9 BNB and paid for with a fake BNB token that could be neither withdrawn nor swapped.

Warning signs

• You are asked to release goods before the money is in your wallet or exchange account.
• A screenshot arrives instead of a transaction hash.
• A token has a dollar price but cannot be withdrawn.
• The contract address does not match real USDT.

How to protect yourself

Compare the token’s contract address with real USDT and release goods only once the money is confirmed on-chain and sitting in your wallet.

A detailed breakdown with illustrations and a two-minute check: Flash USDT: what it is and how to spot fake USDT.

What all eight schemes have in common

Look closely: each scheme makes the same three moves. Haste: you are rushed (“today”, “urgent”, “before it’s too late”). Trust: in a stranger, “support”, a “specialist” or simply a wallet screen. Bypassing the usual order: you are asked to pay upfront, read out a code, sign, copy an address from history or move money “somewhere safe”.

If all three moves appear in one conversation, stop. Leave the chat, hang up, wait an hour. No real deal disappears in that hour.

Early warning signs: a quick checklist

• A stranger quickly moves from conversation to money or a “platform”.
• Withdrawing requires an extra payment: tax, fee, “deposit”.
• You are asked for a seed phrase, password or SMS code.
• Someone writes to you first after you lost money and promises recovery.
• You are walked to an ATM over the phone.
• A site asks for an unlimited token permission or a blind signature.
• You copy the recipient address from history rather than a trusted source.
• A token cannot be sold and the project promises a fixed return.
• A token in your wallet has a price but a contract address that does not match the real one.

What to do if you already sent money

1. Do not send more. Scammers ask for a “tax” or “fee” for as long as there is something to take.
2. Keep everything. Chat history, transaction hashes, addresses, screenshots.
3. Contact support of the exchange or wallet if the money passed through them. A fast report sometimes helps stop a withdrawal.
4. File a police report with hashes and addresses.
5. Revoke permissions and move the balance to a new wallet if you signed something dubious. If a seed phrase became known, treat the wallet as compromised.
6. Do not pay “recovery services” upfront.

FAQ

Which crypto scams are the most common? In FBI complaints the most money goes to investment schemes. Impersonation is one of the fastest-growing schemes, per Chainalysis.

Can money sent to scammers be recovered? A blockchain transfer cannot be reversed. A fast report to an exchange sometimes helps if the funds are still there, but there are no guarantees. In rare cases funds are returned after negotiations, but you cannot count on it.

How do I tell a scam project from a normal one? Check whether you can withdraw money and sell the token, who is behind the project and whether you are asked to pay upfront. Buy the minimum and try to sell it right away.

What is a drainer? A site or script that gains the right to spend your tokens after you sign a “confirmation”.

Can a scammer be recognised by an address? Sometimes. An address can be checked: if it appeared in sources as linked to fraud, you will see the reason. A clean result is not a guarantee: it only means our sources hold no signals.

Informational material, not legal or financial advice. SpiderAML shows risk signals with sources; they are not proof of wrongdoing. Information may change.

Check an address on SpiderAML