Back to: Wallets & Security 101
Scams don’t break cryptography — they break *you*, at the exact moment something valuable is one click away. This lesson dissects the five working scams of 2026 so you recognize the machinery, not just the costume.
1. Phishing sites (the volume leader)
A pixel-perfect copy of a wallet, exchange, or dApp. You “connect” or “log in,” approve one malicious transaction, and your wallet drains. Delivery: search ads, DMs, QR codes in public, typosquatted domains. Defense: type domains yourself; bookmark real ones; treat every link as hostile.
2. Fake support (the trust exploit)
“You have a stuck transaction / verification / bonus — our agent will help.” Real support never DMs first, never asks for keys, never needs a “refundable deposit.” Urgency + authority + a small upfront payment = the formula. Defense: initiate all support contact yourself, on official channels.
3. Fake airdrops & giveaways (the greed hook)
“Connect to claim 500 tokens.” The site drains on connect, or the tokens are honeypots you can never sell. Celebrity-doubling scams are the same shape. Defense: real airdrops never require connecting, paying, or hurrying.
4. Rug pulls (the insider exit)
Devs launch a token, hype it, then drain liquidity. Red flags: anonymous team + huge insider allocation + unlocked liquidity + “can’t-miss” marketing. Defense: check holders, locks, and contract verification first. If you can’t find who controls the money, assume it’s the scammer.
5. Clipboard malware & fake apps (the technical ones)
Malware swaps pasted addresses; fake wallet apps in app stores steal seeds at import. Defense: verify pasted addresses character-by-character; download wallets only from official domains; use hardware signing for size.
The universal detector
Every scam answers YES to at least two of: *Did they contact me first? Is it urgent? Does it need my keys, an approval, or an upfront payment?* Two yeses — walk away, verify elsewhere, come back tomorrow.
Scammers sell certainty on a deadline. Safety is the habit of pausing.
Next lesson: advanced protection — multisig and hardware done right.