Posts

An antique golden key hanging as bait from a steel fishing hook, suspended in dark water with amber light filtering down from the surface.

The crypto scams that still work: signatures, fake support and projects that vanish

/0 Comments/in /by

Hi trader,

remember the fake gas man scam?

He rings the doorbell, he’s got a badge, he’s in a hurry. “I need to check the meter, ma’am, there’s a leak.”

Nobody breaks down the security door. You open it for him.

Well, the crypto scams that still work today are exactly that, with a website instead of the badge.

When you hear “they stole my crypto” you picture a hacker in a hoodie breaking into the blockchain. Nobody breaks into the ledger. Exchanges, bridges, contracts and computers get hacked, and that’s another story. But in the scams we’re talking about today, it’s the victim who signs something or hands over something. And since a confirmed transaction can’t be reversed, afterwards there’s no complaints desk.

It’s the last lesson of the ladder, and it’s the one that saves you the most money.

Ok, vamos.

First understand what you’re signing

When a site asks you for something, your wallet opens a window. They all look the same. They’re not.

Diagram of the three requests a wallet makes. Transaction: you move it, now, you pay the fee, and with a contract a Claim button can be an approval in disguise. Approval: a transaction that lets another address move one of your tokens whenever it wants, up to the set limit, even unlimited, until you revoke it. Message signature: nothing leaves and you pay nothing, but a permit signature works like an approval.
The three requests your wallet shows you and what the other side can do afterwards. Transaction: it goes out now and you pay the network fee; if there’s a contract on the other side, what counts is the function you call, and a “Claim” button can be an approval in disguise. Approval: this is a transaction too, and with it you authorize an address to move one of your tokens whenever it wants, up to the limit shown, which can be unlimited, until you revoke it. Message signature: nothing goes out and you pay nothing, but a “permit” signature (on tokens that support it, or via Permit2) works just like an approval.

The transaction you understand: you send this much, to that address, done. But if there’s a contract on the other side, what counts is the function you call, not the amount you see. And a button that says “Claim” can hide an approval.

The approval is different. Let me explain. To use an app on Ethereum or similar networks with a token (not with the network’s own coin, like ETH), the app first asks you for permission to move it. Many apps ask for an unlimited permission, and it stays valid until you revoke it yourself. Even after you’ve stopped using that app.

Then there’s the message signature, the one that looks like a login. It costs nothing, no transaction goes out, it looks harmless. But there’s a standard, called permit, that exists precisely to give an approval with a simple signature instead of a transaction. And there’s Permit2, a widely used contract: if you’ve approved a token there once, from then on a signature is enough to move it.

You can see where this is going.

One: the signature that drains your address

The script you see most is this one. A clone site, a free airdrop, an exclusive mint, a page asking you to “verify” your wallet. You sign. On the other side there’s a drainer, a kit built specifically to cash in that authorization and move everything you’ve authorized. An open tap.

According to ScamSniffer, which tracks these kits on Ethereum-compatible networks, in 2025 they stole $83.85 million from 106,106 victims. In 2024 it was $494 million. A real drop, but the single biggest case of 2025 was 6.5 million in September, taken with a permit signature. And they say themselves it’s an underestimate.

The defense comes in two stages.

Before: read the window. If a site that should only “let you in” asks you for an approval or a permit, close it.

After: revoke old approvals. Tools like Etherscan’s or Revoke show you who can still move your tokens and let you remove the permission. It costs a small fee. And careful: revoking shuts the tap, it doesn’t give you back what has already gone out. And it doesn’t always stop a permit signature you’ve already given that the other side hasn’t used yet, and it doesn’t save you if they’ve taken your seed. There the only way out is to move everything to a new wallet, with a new seed.

Two: fake support

This one is as old as the telephone, and in crypto complaints to the FBI it’s the most expensive after fake platforms.

“Support” messages you. Polite, well prepared, in a hurry: your account is at risk, there’s been an unauthorized login.

Chainalysis describes a case that ended in an indictment in the United States: according to the charges, fake support agents of a big exchange who convinced victims to move their crypto to “safe” wallets. Safe for them. And again according to Chainalysis, in 2025 impersonation scams grew by more than 1,400% compared to 2024.

I already gave you the rule in the lesson on keys and I’ll repeat it: nobody legitimate will ever ask you for your seed. I’ll add: nobody legitimate asks you to move your funds to a “safe” wallet, and nobody asks you to “validate” your wallet on a website.

And watch out for the second round. People who’ve been scammed can get a call from someone promising to recover the money. For a fee, obviously. In 2025 the FBI counted more than 10,500 complaints about fake recoveries. It’s the same scam, coming back to collect.

Three: the fake platform and the project that vanishes

The most expensive version of all is the fake investment platform.

The contact comes by text message, on social media, on a dating app. Then the chat moves to a messaging app, the group of “experts” shows up, the platform shows you fake profits. When you try to withdraw, they ask you for taxes and fees. Then they vanish. That’s not me saying it, it’s the FBI’s description, and it adds that behind it are largely criminal organizations from Southeast Asia.

Bar chart of losses reported to the FBI in 2025 in complaints involving crypto, by type of scam: fake investment 7.28 billion dollars, fake tech or customer support 1.23, personal data breach 0.94, romance scam 0.39, fake job 0.29, government impersonation 0.28. Total 11.37 billion.
Losses reported to the FBI in 2025 in complaints involving crypto, by type of scam. Complaints overwhelmingly from the United States. Investment 7.28 billion dollars, fake tech or customer support 1.23, personal data breach 0.94, romance scam 0.39, fake job 0.29, government impersonation 0.28. Crypto total 11.37 billion. Source: FBI IC3, Internet Crime Report 2025, table of crimes involving crypto.

Look at the first bar. More than 7.2 billion in one year, just in the complaints that reached the FBI. Second is fake support, with 1.23 billion.

And in Italy? As of 9 October 2026, Consob, the Italian market regulator, has had 1,838 illegal websites blocked since July 2019, and 235 of them involved crypto-assets. The first check is the most boring one: is the platform authorized or not?

Then there’s the rug pull, the rug pulled out from under you. A textbook case, from the court papers of the federal prosecutors in New York: an NFT project called Frosties, January 2022. Promises of rewards and access to a game, sold out, and within a few hours the website was down and about 1.1 million dollars had been moved to wallets controlled by the creators, according to the charges.

The detail you need to remember: the money leaving was in plain sight, because on the ledger everything is public. Seen, yes. Stopped, no.

Bonus: the poisoned address

Remember that many addresses have a check against typos? Useful. But it doesn’t protect you from the wrong address copied correctly.

The trick: the scammer creates an address with the same start and end as one you use, and sends you a zero-value transaction, or close to it. That way it ends up in your history. Next time you copy from there, and if your wallet or the block explorer shows you the shortened address, the start and end match and you send it to him.

A Carnegie Mellon study on Ethereum and BSC, from July 2022 to June 2024, counted 270 million attempts against 17 million targeted addresses, and 6,633 successful hits for at least 83.8 million dollars. It rarely works. But with numbers like these, that’s more than enough.

What you do starting tomorrow morning

The seed never gets typed into a website, a chat, a form. Never. Anyone asking you for it is trying to rob you.

Read what you sign, and clean up every now and then. If you don’t understand the window, you don’t sign. Approvals you no longer use, you revoke.

Urgency is the signal. The frozen account, the offer that’s expiring, the return that won’t wait. Whoever is in a hurry to make you sign is in a hurry for themselves. Close it, breathe, verify through a channel you found yourself.

End of the ladder

We started from the ledger, then the keys, the exchange, stablecoins, leverage and how much to buy. Today the last piece: keeping away the people who want your money without going through the market.

Thanks for climbing all of it.

In crypto scams nobody hacks the blockchain. You’re the one who signs. If someone is in a hurry for you to sign, that hurry is the signal.

— tradingblog.itPosta su X

Back to the gas man.

He didn’t get in because he was good at picking locks. He got in because he was in a hurry, and he rushed you too.

In these scams nobody picks any lock. You give them the permission yourself, one click at a time.

And that’s a click you can always choose not to make.

Suerte Amigo!

Tiziano Brunno

Tradingblog

Want to put your market reading to the test?

Compete and challenge other traders inside an Arena in a demo environment, with no real capital at risk. Discover the Performance Arena Events by The Thunder Trader.

Discover The Thunder Trader →

Disclaimer: purely informational and educational content. It does not constitute financial advice or an invitation to trade. Trading involves the risk of capital loss.

Large ornate key made of amber light dissolving at one end into twelve small carved luminous tiles, floating above an open iron chest that is completely empty, on dark stone

Keys and wallets: what you actually own

/0 Comments/in /by

Hi trader,

for more than a year I kept my crypto on an exchange and I was convinced I owned it.

I did not.

I had a number on a screen, which is a different thing, and I only realised it when I tried to work out what happens to that number if the company showing it to me shuts down.

This is the lesson that explained it to me. It is the second in the series, and if you missed the first one, what a blockchain is, read that first: here I take for granted that the ledger is made of rows and not of coins.

Ok, vamos.

The question nobody asks

If there are no coins on the ledger, only rows, and the rows are written by the network, then what exactly do you own?

Not an object. Not a file. Not a token inside an app.

You own the ability to sign. Meaning the ability to prove to the network that those rows can be moved by you and by nobody else.

That ability is a secret number, and it is called a private key.

What is inside a wallet

Here is the first misunderstanding to clear out, and the name itself does not help: wallet means wallet, but there is no money inside it.

There are keys.

The mechanism runs one way, and this is the beautiful part. From the private key you derive the public key. From the public key you derive the address, the one you give to other people so they can send you things.

Every arrow works in one direction only. From the address you do not get back to the key, and it is not a question of how clever you are: with today’s computers the age of the universe would not be enough.

Four step chain starting from the twelve seed words and leading to the private key, then the public key and finally the address, with arrows running one way only and a warning that there is no going back, plus the note that the coins are not in the wallet but on the ledger
From the twelve word phrase you derive the private keys, from each of those the public key, and from that the address. The arrows run one way only: there is no going back. The coins are not inside the wallet, they are on the ledger.

So when you say “I moved my bitcoin into the wallet” you are saying something imprecise. The bitcoin did not move anywhere: they are still rows on the ledger. What changed is which key can move them.

The twelve words

Now the part that really counts.

When you open a new wallet, the first thing it makes you do is write down twelve words (sometimes twenty four). It is called the seed, or recovery phrase.

Those words are not a reminder of your password. They are the wallet.

From those twelve words the software derives, with a calculation that is always the same, all of your private keys. All of them. The ones you have now and the ones you will generate in two years.

Which means something very practical: the phone is irrelevant. If it gets stolen, you get another one, you type in the twelve words and you find everything exactly as it was. But if you lose the words and the phone breaks, there is no “I forgot my password” button. There is nobody to call. It is over, full stop.

One detail that shows how well designed this is: the words come from a fixed list of 2,048, and the last one is not free, it carries a check code calculated from the previous ones. Twelve words are worth 128 bits of real randomness, a number with thirty nine digits of possible combinations.

Guessing it is not hard. It is out of the question.

Get one thing into your head though: the words have to be generated by the device, not by your brain. The check on the last word rejects almost every invented phrase, but not all of them, and that is not the point anyway. A phrase thought up by a human being is guessable, because our imagination is far poorer than randomness, and over the years the people who tried it found their wallets emptied.

Two clarifications that are worth real money.

The first. Some wallets let you add a passphrase to the twelve words, an extra word of your own, what some people call the twenty fifth word. If you use it, the twelve words on their own no longer open anything, so it has to be kept as carefully as the rest. And be careful, because if you get it wrong it does not say “error”: it opens an empty wallet, which is the best possible way to give yourself a heart attack.

The second. If you restore your words into a different app from the one you started with and you see zero, almost always you have lost nothing: it is the app looking at a different branch of the same tree of keys. Before you panic, try again in the app you started from.

“Not your keys, not your coins”

You will hear this repeated like a prayer. Now you have what you need to understand it, and it takes two lines.

When you buy on an exchange, the keys are theirs. The number you see in your account area is not a row on the ledger: it is a row in the exchange’s database, saying how much they owe you.

You do not own bitcoin. You own a claim against a company.

As long as that company works, the two things look identical, which is why nobody thinks about it. The day it stops working, it turns out they were not identical at all.

I am not telling you exchanges are evil: you go through them to buy, it is normal, I use them too. The problem is not buying there. It is leaving there what you cannot afford to lose.

The three ways people lose everything

There are not a hundred of them. There are three, and they all look like a custody mistake, not a market one.

The three cards of the ways people lose everything: losing the seed, giving it away to whoever asks, and trusting a third party that goes down. For each one how it really happens, how to avoid it, and the blunt consequence
The three ways people lose everything, side by side: you lose the seed, you give the seed away, you trust a third party that goes down. For each one, what actually happens and the rule that avoids it.

One. You lose it. You never wrote it down, or you wrote it on a scrap of paper that got wet, or it lived in a phone note that died with the phone. No recovery possible. It is the stupidest way and also the most common.

Two. You give it away. And here you carve one rule into your head, and it holds forever: nobody legitimate will ever ask you for your seed. Not support, not a site that needs to “validate” your wallet, not a helpful person messaging you, not an app you have to unlock. Nobody. If somebody asks you for it, that person is robbing you, with no exceptions and no special cases.

Three. You trust a third party. The crypto sits on an exchange, or on a platform promising yield, and that one goes down. You did not lose your keys: you never had them.

There is a fourth way, subtler, which is signing without reading and authorising a contract to drain your wallet. We will cover it in the lesson on scams, because it deserves its own space.

What you do from tomorrow morning

Four things, in order, and the third one is the one almost nobody does.

Write the seed on paper. Not a photo, not the cloud, not your phone notes, not a message to yourself. Paper, somewhere that survives a distracted version of you.

And get clear on what you have just created: that piece of paper works like cash. Whoever finds it does not have to guess a password and does not have to break anything, they type in the words and take everything in two minutes, from anywhere in the world. So “somewhere safe” means actually safe, not the top drawer of your desk.

Do not tell it to anybody and do not type it anywhere, other than into the wallet itself when you are restoring.

Test the restore before you put anything serious in there. Put in pocket change, delete the app, install it again, restore with the words and see whether you find everything. It is the only way to know you wrote them down correctly, and finding out afterwards is too late.

If the amount starts to matter, get a dedicated device. The kind where the key never leaves the object and you confirm operations with a physical button. The right question is not “how much does it cost” but “how much am I keeping on it”.

On this one a hard rule though: buy it only from the manufacturer’s site. Never used, never from a marketplace, never from some guy online because it was cheaper. A tampered device arrives with the seed already written down by somebody else, and you pour your money onto it convinced you are safe. It is a scam that exists and that works.

Where we go next time

If the exchange’s keys are its own, then it is time to understand properly what an exchange is, how it really works and what happens if it fails. That is next week’s lesson, and anybody who lived through certain stories already knows why it matters.

A wallet does not hold coins. It holds the ability to sign, and either you have it or somebody else has it in your place.

— tradingblog.itPosta su X

Let me close with the thing that sorted my head out on this subject.

In trading we spend our days worrying about market risk: the stop, the size, the drawdown. Then somebody keeps everything on an exchange and never thinks about it, because that risk does not flash on the screen.

But it is a risk like any other, and it has one nasty feature: it does not make you lose a percentage.

It makes you lose everything, all at once.

Suerte Amigo!

Tiziano Brunno

Tradingblog

Want to put your market reading to the test?

Compete and challenge other traders inside an Arena in a demo environment, with no real capital at risk. Discover the Performance Arena Events by The Thunder Trader.

Discover The Thunder Trader →

Disclaimer: purely informational and educational content. It does not constitute financial advice or an invitation to trade. Trading involves the risk of capital loss.