Crypto scams evolve faster than regulators can catalog them. This database describes the patterns we see most frequently in our fraud recovery practice — the tactics scammers use, the red flags to watch for, and what to do if you have already been targeted. If you recognize a pattern below, contact us before the trail goes cold.
The most financially destructive crypto scam type. 38% of all cases we handle.
Pig butchering (also called "sha zhu pan" from the Chinese) is the most financially destructive crypto scam in operation today. The scammer builds a romantic or friendship connection over weeks or months, then gradually introduces the victim to a "crypto investment opportunity" that shows consistent fake returns. The victim is encouraged to deposit more and more — and when they try to withdraw, the platform either demands a "tax" or simply disappears.
What to do: Stop all communication immediately. Do not send any additional funds — not "fees," not "taxes," not "verification deposits." Document everything: screenshots of conversations, the platform URL, wallet addresses you were asked to send to. Contact us with this documentation — we can trace the wallet addresses on-chain and assess whether recovery is possible.
Scams that target your wallet access rather than your trust. 24% of cases.
Scammers create exact replicas of popular crypto sites — Binance, MetaMask, Uniswap, Coinbase — using slightly different domain names (e.g., binance-pro.com instead of binance.com). When you enter your credentials or connect your wallet, the scammer captures your seed phrase or tricks you into signing a malicious transaction that drains your wallet.
A sophisticated evolution of phishing: the scammer tricks you into signing a transaction that appears normal (e.g., "claim your airdrop") but actually grants the scammer unlimited spending approval (an "infinite approval") for your tokens. Once approved, the scammer can drain your wallet at any time — even days later. These scams are often spread through fake airdrop announcements on Twitter/X and Discord.
The scammer convinces your mobile carrier to port your phone number to a SIM card they control. With your phone number, they bypass SMS-based 2FA on your exchange and email accounts. This is particularly dangerous if your exchange uses SMS as a 2FA method rather than an authenticator app.
What to do: Contact your mobile carrier and exchange immediately — every minute counts. If funds have already been moved, contact us with the transaction details for blockchain tracing.
Fraudulent platforms and projects designed to steal deposits. 30% of cases combined.
Scammers create fake exchange websites that look fully functional — you can "deposit," "trade," and see your "balance" grow. But no actual trading occurs. The deposits go directly to the scammer's wallet. When you try to withdraw, you are asked for KYC documents, "verification fees," or simply see an error. By the time you realize it is a scam, the site has disappeared.
In a rug pull, the creators of a new token or DeFi project suddenly withdraw all liquidity from their project's pool, leaving investors with worthless tokens. This is common with meme coins and low-cap DeFi projects. The token creators may promote the project heavily on social media, recruit influencers, and create a sense of urgency ("presale ends in 24 hours").
Our recovery process involves four parallel tracks:
We trace the stolen funds across the blockchain using forensic tools to identify where they were sent.
If the funds land at a known exchange, we issue legal requests to freeze the scammer's account.
We prepare documentation suitable for filing criminal complaints in the relevant jurisdiction.
Where possible, we pursue civil claims against identified perpetrators or complicit platforms.
Not all stolen crypto can be recovered. We are honest about this. But early action dramatically increases the odds — particularly if the scammer uses a centralized exchange to cash out, which many do.
If you've been scammed, our crypto fraud recovery team can trace and freeze stolen assets. Before engaging any recovery service, read our recovery scam warning. For a comprehensive overview, read our crypto scam recovery guide. For AML terms used on this page, see our compliance glossary.
It is not too late, but time is critical. After 3 days, the scammer may have already moved the funds through a mixer or cashed out at an exchange. However, if the funds are still on-chain and identifiable, or if they landed at a centralized exchange, we may be able to initiate a freeze. Contact us immediately with the transaction hash and the scammer's wallet address — we will conduct an initial assessment at no cost.
Check four things: (1) Regulatory registration — search the FCA register (UK), BaFin (Germany), FinCEN MSB list (US), or the relevant regulator in your country. (2) CoinGecko/CoinMarketCap listing — legitimate exchanges are listed with verified metrics. (3) Company registration — the exchange should have a publicly registered company with a physical address. (4) Community reputation — search Reddit, Trustpilot, and BitcoinTalk for user experiences. If any of these checks fail, do not deposit funds.
You likely fell victim to a wallet drainer — a scam where you signed a transaction that granted "infinite approval" to the scammer's smart contract. This allows them to transfer your tokens at any time. The transaction may have looked like an airdrop claim, a token approval, or a swap — but it was malicious. We can trace the drainer's contract, identify where your tokens were sent, and coordinate with exchanges if the funds are cashed out. Recovery depends on speed and whether the funds pass through a centralized exchange.
Almost certainly not. This is a "recovery scam" — scammers who target people who have already been scammed, offering to "recover" their funds for an upfront fee. See our recovery scam warning page for the full list of red flags. Real law firms do not cold-message scam victims on social media. Do not send them any money or information.
Partially. Mixers (Tornado Cash, ChipMixer) are designed to break the on-chain link between sender and recipient. However, blockchain forensics has advanced significantly — if the scammer eventually cashes out at a centralized exchange, the exchange's KYC records can connect the wallet to a real identity. The key is speed: before the funds are fully mixed and cashed out, there is a window where tracing is possible. We work with blockchain forensics partners who specialize in this.
At minimum: (1) The wallet address you sent the funds from. (2) The wallet address you sent the funds to (the scammer's address). (3) The transaction hash (you can find this on a blockchain explorer like Etherscan or Blockstream). (4) A description of how the scam occurred. (5) Any communication screenshots, platform URLs, or other evidence. With this information, we can conduct an initial on-chain trace and assess recovery options within hours.
Every hour that passes after a crypto scam reduces the chance of recovery. If you have been targeted by any of the patterns described above, contact us immediately with your transaction details. We will begin tracing within hours.
Describe what happened →