Common DeFi Scams

Most losses in decentralised finance do not come from clever code exploits. They come from someone being persuaded to sign a transaction, send funds, or paste a seed phrase into a box. The technology usually works exactly as designed, which is the problem: a blockchain transaction is final, there is no chargeback, no fraud department, and no one to reverse it.

That makes recognising the pattern far more valuable than reacting quickly. This guide covers the scams that turn up most often, what each one actually does at a technical level, and the specific signals that give them away before any money moves.

If you have not read our DeFi security best practices, start there. This page covers the specific patterns; that one covers the habits that make you hard to catch in the first place.

The one thing nearly every scam needs

Almost every scam in this list ends the same way: you approve or sign something. It might be a token approval, a signature request, a contract interaction, or a plain transfer. Once your wallet signs, the outcome is settled.

So there is a single discipline that defends against most of what follows. Read what you are signing, and if you cannot tell what it does, do not sign it. Legitimate protocols will still be there in ten minutes while you check. Scams rely on you not taking those ten minutes.

The second discipline is separation. Funds you are not actively using should sit in a wallet that never touches an unfamiliar site, ideally a hardware wallet. Our guide to setting up your first wallet explains how to run more than one.

Rug pulls

A rug pull is when the people behind a token remove the value and disappear. The name covers a few different mechanics.

In the simplest version, the team holds most of the supply, waits for buyers to push the price up, then sells everything into the pool. Buyers are left holding a token with almost no liquidity behind it.

In the liquidity version, the team supplies the pool themselves, then withdraws it once enough real money has arrived. Because a token's price on a decentralised exchange comes from the pool, removing the pool removes the ability to sell at all. Our guide to liquidity pools explains why that mechanism makes the token effectively worthless rather than merely cheap.

What gives it away: an anonymous team with no verifiable history, a very large share of supply held in a handful of wallets, liquidity that is not locked, and a contract that has not been audited by anyone you can name. Urgency is almost always present, because the model only works while people are buying quickly.

Honeypot tokens

A honeypot lets you buy and then quietly prevents you from selling. The contract contains logic that blocks transfers from ordinary holders, or applies a sell tax so extreme that selling returns almost nothing.

The chart looks superb, because the only transactions happening are purchases. That is the entire trick: a token nobody can sell only ever goes up until the operator exits.

What gives it away: a price line that rises without any meaningful sells, a contract with functions that can pause or restrict transfers, and an owner address that has not renounced control. Honeypot checking tools exist, though they can be fooled, so treat a clean result as one input rather than a verdict.

Wallet drainers and malicious signatures

A drainer is a script on a website that produces a signature request designed to hand over your assets. You are told you are claiming a reward, verifying a wallet, minting an NFT, or connecting to a new app. What you actually sign gives an address permission to move your tokens.

These are effective because the request often does not look like a payment. There is no obvious amount, so the wallet warning feels routine. Some use off-chain signature standards that a wallet may display as an unreadable block of data.

What gives it away: any request you did not initiate yourself, any "verify" or "validate" step that requires a signature, and any signature request whose contents your wallet cannot decode into plain language. Free money that needs your signature is not free money.

Token approval exploits

When you use a decentralised exchange, you grant the contract permission to spend a particular token from your wallet. That is normal and necessary. The abuse is in the size and duration of that permission.

Many interfaces default to an unlimited approval, so the permission stays alive indefinitely, long after the trade completes. If that contract is malicious, or is later compromised, it can drain that token whenever it likes. The dangerous part is that the theft can happen weeks after you last thought about the site.

What to do: approve the amount you actually intend to spend where the interface allows it, and review your existing approvals periodically, revoking any you no longer recognise or need. Our Uniswap guide walks through what a legitimate approval looks like so the unusual ones stand out.

Phishing sites and cloned front ends

Attackers copy a real protocol's interface pixel for pixel and put it on a lookalike domain. Traffic arrives through paid search results, a link in a reply on social media, a message in a project's chat, or a bookmark saved from a compromised source.

The clone behaves normally until you connect a wallet, at which point it serves a drainer signature. A variant compromises the real project's domain records, so the correct address serves a hostile page. That is rarer, and it is why sanity-checking a transaction still matters even on a site you trust.

What gives it away: a URL that is subtly wrong, a site reached through an advert rather than your own bookmark, and any interface asking for a seed phrase. No legitimate application ever needs your seed phrase, under any circumstances, for any reason.

Fake airdrops and dusting

Unexpected tokens appearing in your wallet are not a windfall. Sending tokens to an address costs almost nothing, so scammers distribute worthless tokens widely, with a name or accompanying message pointing to a site where you can "claim" the real value.

The claim page is the payload. Sometimes the token itself is engineered so that attempting to sell or transfer it triggers a hostile interaction.

What to do: ignore them. Do not attempt to sell, transfer, or claim against them. Hide them in your wallet interface if it supports it, and leave them alone.

Impersonation and fake support

Ask a question publicly about a wallet or protocol and you may get several direct messages within minutes, each claiming to be support. They will offer to help through a "validation" tool, a form, or a screen-sharing session.

Real support teams do not contact you first by direct message, and they do not need your seed phrase or a signature to diagnose a problem. Impersonation also runs the other way, with fake accounts for founders and projects announcing partnerships or token launches that do not exist.

What gives it away: unsolicited contact, pressure to move to a private channel, and any request for a phrase, key, or signature as part of "support".

Long-running investment scams

These are not really DeFi scams, though they use crypto as the payment rail. Contact begins on a dating app, social platform, or a friendly message that seems to have arrived by mistake. A relationship builds over weeks before any money is mentioned.

The victim is eventually introduced to a trading platform or app that shows steady, impressive returns. The balance shown is fabricated. Small withdrawals may succeed early to build confidence, and the platform stops cooperating when a large withdrawal is attempted, often demanding tax or fees first.

What gives it away: any investment opportunity introduced by someone you met online, guaranteed returns, a platform you cannot independently verify, and fees demanded before a withdrawal will be released. The fees are the scam continuing, not an obstacle to recovering your money.

Yield that cannot be explained

Some schemes are simply Ponzis: returns paid from new deposits until they cannot be. They are attractive because the numbers are enormous and the early payouts are real.

Yield in decentralised finance does come from somewhere identifiable, such as trading fees, lending interest, or token emissions. If you cannot describe where a return originates in a sentence, treat that as the answer. Our yield farming basics covers the legitimate mechanisms, and understanding them makes the invented ones easier to spot.

Note that token emissions are not free either. Rewards paid in a token the protocol issues itself dilute existing holders, so a very high advertised rate often reflects that dilution rather than genuine income.

Quick red flag checklist

• Anything asking for your seed phrase or private key, without exception
• Guaranteed returns, or returns with no explainable source
• Unsolicited direct messages offering help or opportunity
• Time pressure, countdowns, and limited allocations
• A signature request you did not initiate
• A signature request your wallet cannot decode into readable terms
• Tokens arriving in your wallet unannounced
• Unlocked liquidity, anonymous teams, and no audit
• Fees demanded before a withdrawal can be processed
• A URL reached through an advert or a message rather than your own bookmark

If you think you have been caught

Move quickly, but in the right order.

1. Move remaining assets first. If a wallet has signed something hostile, transfer what is left to a wallet whose keys have never been exposed. Revoking approvals takes a transaction and may not confirm before the attacker acts.
2. Revoke approvals on the affected wallet afterwards.
3. Stop using the compromised wallet for anything of value. If a seed phrase was exposed, every account derived from it is compromised permanently, not just the one that was drained.
4. Record everything: transaction hashes, addresses, URLs, usernames, screenshots, and timings. This is what any report will need.

Be aware that a second wave often follows. Recovery services promising to retrieve stolen crypto for an upfront fee target people who have just been defrauded, using details from public transaction records.

Reporting crypto fraud in the UK

Crypto is not covered the way a bank account is. The Financial Services Compensation Scheme does not protect cryptoasset holdings, so there is generally no compensation route when funds are lost, which is precisely why prevention carries so much weight here.

That said, reporting still matters, both for investigation and because reports feed the warnings that protect other people.

• Action Fraud is the national reporting centre for fraud and cybercrime in England, Wales and Northern Ireland: actionfraud.police.uk. In Scotland, report to Police Scotland on 101.
• The FCA Warning List records firms known to be operating without authorisation: fca.org.uk/consumers/warning-list-unauthorised-firms. Checking it before depositing anywhere is a two-minute step.
• If a bank transfer was involved at any point, tell your bank immediately. Fiat rails sometimes offer recovery options that crypto rails do not.

The regulatory position is also changing. The UK is building a formal cryptoasset regime, and our note on the FCA authorisation window sets out the timetable. Until it is in force, assume a platform marketing to you is unauthorised unless you have verified otherwise.

Where to go next

Scam awareness works best alongside the underlying mechanics, because most of these tricks are ordinary features used dishonestly.

• DeFi security best practices for the habits that prevent most of this
• Key DeFi concepts for the vocabulary behind approvals, contracts and gas
• Best DeFi wallets 2026 for choosing something that shows you what you are signing
• Disclaimers and risks for the risks that remain even when nobody is trying to defraud you