The crypto scams that still work: signatures, fake support and projects that vanish

Hi trader,

remember the fake gas man scam?

He rings the doorbell, he’s got a badge, he’s in a hurry. “I need to check the meter, ma’am, there’s a leak.”

Nobody breaks down the security door. You open it for him.

Well, the crypto scams that still work today are exactly that, with a website instead of the badge.

When you hear “they stole my crypto” you picture a hacker in a hoodie breaking into the blockchain. Nobody breaks into the ledger. Exchanges, bridges, contracts and computers get hacked, and that’s another story. But in the scams we’re talking about today, it’s the victim who signs something or hands over something. And since a confirmed transaction can’t be reversed, afterwards there’s no complaints desk.

It’s the last lesson of the ladder, and it’s the one that saves you the most money.

Ok, vamos.

First understand what you’re signing

When a site asks you for something, your wallet opens a window. They all look the same. They’re not.

The transaction you understand: you send this much, to that address, done. But if there’s a contract on the other side, what counts is the function you call, not the amount you see. And a button that says “Claim” can hide an approval.

The approval is different. Let me explain. To use an app on Ethereum or similar networks with a token (not with the network’s own coin, like ETH), the app first asks you for permission to move it. Many apps ask for an unlimited permission, and it stays valid until you revoke it yourself. Even after you’ve stopped using that app.

Then there’s the message signature, the one that looks like a login. It costs nothing, no transaction goes out, it looks harmless. But there’s a standard, called permit, that exists precisely to give an approval with a simple signature instead of a transaction. And there’s Permit2, a widely used contract: if you’ve approved a token there once, from then on a signature is enough to move it.

You can see where this is going.

One: the signature that drains your address

The script you see most is this one. A clone site, a free airdrop, an exclusive mint, a page asking you to “verify” your wallet. You sign. On the other side there’s a drainer, a kit built specifically to cash in that authorization and move everything you’ve authorized. An open tap.

According to ScamSniffer, which tracks these kits on Ethereum-compatible networks, in 2025 they stole $83.85 million from 106,106 victims. In 2024 it was $494 million. A real drop, but the single biggest case of 2025 was 6.5 million in September, taken with a permit signature. And they say themselves it’s an underestimate.

The defense comes in two stages.

Before: read the window. If a site that should only “let you in” asks you for an approval or a permit, close it.

After: revoke old approvals. Tools like Etherscan’s or Revoke show you who can still move your tokens and let you remove the permission. It costs a small fee. And careful: revoking shuts the tap, it doesn’t give you back what has already gone out. And it doesn’t always stop a permit signature you’ve already given that the other side hasn’t used yet, and it doesn’t save you if they’ve taken your seed. There the only way out is to move everything to a new wallet, with a new seed.

Two: fake support

This one is as old as the telephone, and in crypto complaints to the FBI it’s the most expensive after fake platforms.

“Support” messages you. Polite, well prepared, in a hurry: your account is at risk, there’s been an unauthorized login.

Chainalysis describes a case that ended in an indictment in the United States: according to the charges, fake support agents of a big exchange who convinced victims to move their crypto to “safe” wallets. Safe for them. And again according to Chainalysis, in 2025 impersonation scams grew by more than 1,400% compared to 2024.

I already gave you the rule in the lesson on keys and I’ll repeat it: nobody legitimate will ever ask you for your seed. I’ll add: nobody legitimate asks you to move your funds to a “safe” wallet, and nobody asks you to “validate” your wallet on a website.

And watch out for the second round. People who’ve been scammed can get a call from someone promising to recover the money. For a fee, obviously. In 2025 the FBI counted more than 10,500 complaints about fake recoveries. It’s the same scam, coming back to collect.

Three: the fake platform and the project that vanishes

The most expensive version of all is the fake investment platform.

The contact comes by text message, on social media, on a dating app. Then the chat moves to a messaging app, the group of “experts” shows up, the platform shows you fake profits. When you try to withdraw, they ask you for taxes and fees. Then they vanish. That’s not me saying it, it’s the FBI’s description, and it adds that behind it are largely criminal organizations from Southeast Asia.

Look at the first bar. More than 7.2 billion in one year, just in the complaints that reached the FBI. Second is fake support, with 1.23 billion.

And in Italy? As of 9 October 2026, Consob, the Italian market regulator, has had 1,838 illegal websites blocked since July 2019, and 235 of them involved crypto-assets. The first check is the most boring one: is the platform authorized or not?

Then there’s the rug pull, the rug pulled out from under you. A textbook case, from the court papers of the federal prosecutors in New York: an NFT project called Frosties, January 2022. Promises of rewards and access to a game, sold out, and within a few hours the website was down and about 1.1 million dollars had been moved to wallets controlled by the creators, according to the charges.

The detail you need to remember: the money leaving was in plain sight, because on the ledger everything is public. Seen, yes. Stopped, no.

Bonus: the poisoned address

Remember that many addresses have a check against typos? Useful. But it doesn’t protect you from the wrong address copied correctly.

The trick: the scammer creates an address with the same start and end as one you use, and sends you a zero-value transaction, or close to it. That way it ends up in your history. Next time you copy from there, and if your wallet or the block explorer shows you the shortened address, the start and end match and you send it to him.

A Carnegie Mellon study on Ethereum and BSC, from July 2022 to June 2024, counted 270 million attempts against 17 million targeted addresses, and 6,633 successful hits for at least 83.8 million dollars. It rarely works. But with numbers like these, that’s more than enough.

What you do starting tomorrow morning

The seed never gets typed into a website, a chat, a form. Never. Anyone asking you for it is trying to rob you.

Read what you sign, and clean up every now and then. If you don’t understand the window, you don’t sign. Approvals you no longer use, you revoke.

Urgency is the signal. The frozen account, the offer that’s expiring, the return that won’t wait. Whoever is in a hurry to make you sign is in a hurry for themselves. Close it, breathe, verify through a channel you found yourself.

End of the ladder

We started from the ledger, then the keys, the exchange, stablecoins, leverage and how much to buy. Today the last piece: keeping away the people who want your money without going through the market.

Thanks for climbing all of it.

Back to the gas man.

He didn’t get in because he was good at picking locks. He got in because he was in a hurry, and he rushed you too.

In these scams nobody picks any lock. You give them the permission yourself, one click at a time.

And that’s a click you can always choose not to make.

Suerte Amigo!

Tiziano Brunno

Tradingblog

---

Disclaimer: purely informational and educational content. It does not constitute financial advice or an invitation to trade. Trading involves the risk of capital loss.