Urgent Request from the CEO: Don't fall for the CEO Scam
What are CEO Scams? CEO scams are a form of social engineering where fraudsters impersonate senior executives to manipulate targets into redirecting...
7 min read
What are Crypto Scams?
Crypto scams are a type of investment fraud where criminals use the mechanics and mystique of cryptocurrency to deceive victims into parting with their money.
Like other investment scams, they target a broad profile consisting of people with funds to invest and a willingness to explore opportunities.
What sets these scams apart is the use of blockchain-based currencies and tokens, where transactions are irreversible, identities can be obscured, and stolen funds can be laundered across global networks within minutes.
Tactics range from fake exchanges and fraudulent initial coin offerings (ICOs) to impersonation of legitimate wallet providers, high-yield investment “programs,” and pump-and-dump token schemes. In some cases, scammers pose as legitimate Telegram or Signal group admins to trick victims into handing over their wallet’s mnemonic seed phrase, which gives the fraudster full control of the wallet’s funds.
Whether by persuading a victim to initiate a transfer under false pretenses or by covertly seizing control of their wallet or exchange account, the endgame is the same: move the assets out, beyond recovery.
Steps of a Typical Crypto Scam
Below is a pattern you’ll see across most crypto scam variants. The mechanics differ, but the flow is quite consistent when you look at the crypto-specific touchpoints (wallets, seed phrases, on-chain approvals, etc).
1. Identifying and Profiling Targets
Fraudsters often segment potential victims to focus on those with the highest conversion potential, typically people who already show interest in investing or digital assets. This targeting can be remarkably sophisticated: buying social media ads aimed at people who follow trading influencers, scraping Telegram and Discord membership lists, or using “lookalike” ad tools to reach people with similar behaviours to past victims.
From the outset, they’re playing on two powerful psychological levers: trust in a familiar context (investment communities, known platforms) and confirmation bias (the tendency to engage with offers that align with one’s existing beliefs about profitable opportunities). By combining selective targeting with an understanding of these biases, scammers set the stage for later persuasion tactics to land more effectively.
2. Communication Strategy
Once a target is in their sights, scammers focus on creating the illusion of legitimacy. This can take many forms: cloned websites of trusted exchanges, fraudulent apps on official app stores, or impersonated Telegram/Signal group admins with convincing histories in chat. They might present polished whitepapers, fake trading dashboards, or screenshots of “returns” to project a sense of established success.
Psychologically, this phase leans heavily on authority bias (trusting perceived experts or platforms) and social proof (seeing others appear to profit). Layered on top is urgency from limited-time token sales, airdrops with countdown timers, or “the price is about to spike” messages. All of this is designed to suppress rational scrutiny and push the victim into immediate action.
3. Gaining Access or Commitment
With trust established, scammers move to the pivotal moment: getting the target to part with their funds or give up control. In crypto scams, this can take two primary forms:
- Direct transfer of cryptocurrency: Victims are instructed to send funds to a wallet address controlled by the scammer, often under the guise of buying tokens, participating in a trading scheme, or covering “release” fees for an alleged airdrop or profit.
- Compromise of wallet access: Here, the attacker seeks a victim’s private key, seed phrase, or wallet login credentials. This happens through socially engineered prompts (“verify your wallet to claim rewards”) or malicious forms that mimic legitimate wallet provider interfaces. Once the scammer has those details, they can empty the wallet without further interaction.
Psychologically, this step leverages commitment bias (once a victim has invested time or money, they’re more likely to follow through with the next “requirement”) and reciprocity pressure (“send X to unlock your gains”).
4. Disappearance and Laundering
Fraudsters rapidly move to make the assets unrecoverable. While cryptocurrency offers pseudonymity by default, many scammers still “launder” stolen coins to make blockchain forensics more difficult and to prepare them for eventual conversion to fiat currency. This often involves:
- Chain-hopping (moving funds across different blockchains using cross-chain bridges)
- Mixers/tumblers that break the transaction trail into smaller, obfuscated pieces
- Converting to privacy coins like Monero or Zcash, which are much harder to trace
For some, these steps aren’t strictly necessary to maintain anonymity. A scammer could simply hold the stolen funds indefinitely in a cold wallet. However, laundering becomes essential when they plan to cash out through regulated exchanges, where AML/KYC checks can flag suspicious inflows.
What’s in it for the scammer?
From a fraudster’s perspective, crypto scams tick many of the boxes that make an operation attractive: low upfront cost, a global pool of potential victims, and a payout method that’s inherently hard to trace or reverse. While the sophistication of some tactics requires more planning, many scams can be launched with nothing more than a convincing web template and stolen images.
Here’s how the typical crypto scam rates across four dimensions:
| Category | Score (/10) | Key Insights | |
| 1 | Initial Investment (Scammer Setup Cost) |
 Low to Moderate · 3/10 |
A fake exchange site, cloned wallet app, or impersonation profile can be set up cheaply with off-the-shelf kits or open-source code. More elaborate operations (deepfake endorsements, large bot networks) raise costs but are still low compared to potential returns |
| 2 | Exposure Risk (Likelihood of Getting Caught) |
|
The risk of exposure is minimal. Crypto transactions can be anonymized or obfuscated through mixers, cross-chain swaps, or privacy coins, making attribution extremely difficult. |
| 3 | Success Rate (Likelihood of Scamming a Victim) |  Moderate · 5/10 |
Mass-market tactics (giveaways, fake ads) rely on volume, while targeted social engineering in investment groups or DMs boosts hit rates. The success rate can spike when urgency and perceived legitimacy are combined. |
| 4 | Return on Investment (ROI) |  Moderate to High · 8/10 |
With minimal cost and high-value potential per victim, crypto scams can yield outsized returns. A single compromised wallet mnemonic or successful rug pull can generate six or seven figures in profit. |
Protecting Against Crypto Scams
Money lost in cryptocurrency scams amounted to almost $10 billion in 2024 alone. Here are some protection tips to consider when using crypto as an investment vehicle.
- Verify the source – Never act on investment offers from unsolicited messages, ads, or group invites; confirm identities through official channels.
- Protect wallet credentials – Treat seed phrases and private keys like the keys to your bank; never share them, even with “support staff” or supposed admins.
- Use hardware wallets – Keep long-term holdings offline to remove them from the reach of online compromises.
- Beware of urgency and pressure – Scammers often demand immediate action; legitimate opportunities withstand scrutiny.
- Double-check URLs and apps – Download wallets, exchanges, and tools only from official sites or verified app stores.
- Validate endorsements – Cross-check “celebrity” or influencer promotions against media coverage.
- Limit personal info exposure – Reduce the data available for targeting by reviewing your public social media footprint.
What does this mean for Financial Institutions?
Today, most banks operate strictly within the fiat domain of deposits, payments, and lending, with no direct liability for losses suffered in a customer’s private crypto wallet. However, an increasing number of banks are launching crypto services that offer customers the ability to buy, sell, and sometimes even store digital assets through bank-hosted wallets or integrated third-party platforms.
In July 2025, Standard Chartered announced the launch of Bitcoin and ether spot trading. In the same month, BBVA also unveiled a crypto trading and custody service in Spain.
This shift raises a looming question: at what point does customer protection in crypto become the bank’s problem?
If a bank facilitates the purchase, provides the wallet, or directly custodies the crypto, expectations of safeguarding will inevitably rise. And with those expectations could come regulatory mandates similar to how chargeback rules or reimbursement schemes work for fiat fraud.
Crypto’s irreversible nature, combined with the sophisticated social engineering used in scams, means that banks entering the space risk becoming the de facto last line of defense. Even if regulation hasn’t caught up yet, public perception moves faster: customers may still blame the bank for “failing” to prevent a scam. The potential reputational, legal, and operational costs make it critical for any bank exploring crypto services to start thinking now about account monitoring, detection, and proactive fraud prevention capabilities.
Real Life Examples
Some real-life Crypto scams that have been made public through traditional media.
North Korean $1.5B Exchange Hack
A 2025 public service announcement attributed the theft of approximately $1.5 billion in virtual assets from crypto exchange Bybit to North Korean “TraderTraitor” actors. They quickly converted the loot into Bitcoin and dispersed it across thousands of addresses for laundering.
Retired Aussie Cop Scammed out of $1.2M
In Thailand, a retired Australian police officer lost about AUD 1.8 million after being duped by a scammer posing as a crypto entrepreneur. The scam was carefully cultivated over more than a year via social channels before the fraudster disappeared with his savings.
YouTube Trading Bot Scam Steals 256 ETH
Scammers hijacked legitimate YouTube accounts with high subscriber counts to promote a “cryptocurrency trading bot.” Victims sent funds expecting returns, only to have the funds stolen via a hidden smart contract drain, resulting in the theft of more than 256 ETH (~USD 940,000).
Crypto Wallet Drained After Social Media Impersonation
In an elaborate scam documented by Darktrace, fraudsters tricked crypto investors into downloading and testing software in exchange for crypto. Victims opened the software and unknowingly installed info stealers on their systems, which were used to drain their crypto wallets.
UK Minister’s X Account Hijacked to Push Fake “Commons” Token
The verified X account of UK Minister Lucy Powell was taken over and used to promote a fraudulent $HCC token, branded as “House of Commons Coin.” This follows on from crypto scams that used deepfake videos of British Prime Minister Keir Starmer and Prince William to con people (one woman lost 20k GBP in this scam).
What does this mean going forward?
The same market forces that make digital assets attractive to legitimate investors also make them fertile ground for fraud: speed, borderless transactions, and lack of reversibility. As AI advances, especially in deepfake video and voice synthesis, scammers will gain new tools to impersonate trusted figures, fabricate “live” endorsements, and add a layer of convincing realism that static phishing pages or text messages can’t match. Expect social engineering in crypto to get more personal, more interactive, and harder for an untrained eye to spot.
More reputable exchanges will likely invest in better anti-fraud and anti–money laundering mechanisms, but crypto’s design means these defenses can only go so far once a transaction is signed and broadcast. At that point, recovery is virtually impossible.
Whether it’s a bank enabling crypto purchases or an exchange holding customer wallets, users usually hold the provider accountable when scams succeed. The reputational, legal, and operational risks are already in motion, and they won’t be limited to the pure-play crypto sector as more banks launch crypto trading services.
That’s where solutions like Acoru become pivotal. By combining continuous account classification with the ability to detect money mules and act on pre-fraud signal intelligence, Acoru enables financial institutions, whether in fiat, crypto, or both, to flag suspicious counterparties before funds move.
This proactive stance is what closes the gap between a customer clicking “send” and a bank or exchange being seen as the last line of defense. In a threat landscape evolving this quickly, the winners will be the institutions that treat crypto scam prevention as part of their core fraud strategy.
Want to learn more about how Acoru does this? Request a demo here.
"This is your bank's security team. Your account is at risk."
What are Bank Impersonation Scams? A bank impersonation scam is where fraudsters pose as a legitimate bank to con the bank’s customers into taking...
“Hi Dad, I broke my phone. Here is my new number”
"Hi Dad” scams, also known as “Hi Mum” scams, are a type of authorized fraud (scam). These scams typically involve a deceptive impersonation tactic,...