9 crypto scams to watch for in 2026, and how to avoid them
Fake job offers, wallet drainers, fake support and more: how today's crypto scams work, the warning signs, and what to do if you've been targeted.
Key takeaways
- Most crypto losses come from deception, not from breaking the technology.
- Fake job offers helped start the largest crypto theft on record.
- No real company ever needs your recovery phrase.
- If you have to pay to get your money out, it's a scam.
In 2026 a fake job interview helped North Korean hackers begin the largest crypto theft in history. If professional engineers at the world's biggest exchange can be fooled, so can anyone. Most crypto is not lost to genius hacks. It's lost to well-designed tricks. These are the scams to know, and how to spot each one.
1. Fake job offers and "take-home tests"
How it works: a recruiter contacts you about a great role. After a convincing interview process, you're asked to download a coding test, a meeting app or a tool. It's malware that steals wallets, passwords and session data.
Real example: according to Binance's report on its $6.3 billion hack, an engineer was approached on a job platform and went through fake interviews, including one with the "CEO" of a company that didn't exist.
Protect yourself: verify the company independently, never run files from recruiters on a machine that holds crypto, and be suspicious of meeting links that require a new app.
2. Fake ads and tampered downloads
How it works: search or social ads lead to a copy of a real site. The download looks normal, but contains malware or a fake wallet that sends your recovery phrase to the attackers.
Real example: Binance said a second engineer clicked an ad for a tampered version of Homebrew, a popular developer tool.
Protect yourself: don't download wallets through ads. Use bookmarks and official app stores, and check the publisher's name.
3. Fake support and fake refunds
How it works: after any big hack or outage, "support agents" message you first. They say your account is at risk, or that you can claim compensation. Then they ask for your password, 2FA code or recovery phrase, or send you to a fake claims page.
Protect yourself: real support never contacts you first in a DM, and never needs your recovery phrase. Check for news only in the official app or on the official site.
4. Investment romance scams ("pig butchering")
How it works: a friendly stranger builds trust for weeks, then shows you a platform with amazing returns. Your small first withdrawal works. When you deposit more, the balance on screen is fake, and you're told to pay "tax" or a "fee" to withdraw.
Protect yourself: never invest through a platform recommended by someone you only know online. Being asked to pay money to withdraw money is the clearest warning sign of all.
5. Wallet drainers and malicious signatures
How it works: a site offers an airdrop or free NFT and asks you to connect and sign. The signature is actually an approval allowing the attacker to move your tokens.
Protect yourself: keep savings in a wallet that never connects to new sites. Use a wallet that simulates transactions, read what you sign, and revoke approvals you don't need.
6. Address poisoning
How it works: attackers send a tiny transaction from an address that looks almost the same as one you use. Later, you copy it from your history by mistake.
Protect yourself: don't copy addresses from your history. Use a saved address book, compare the full address and send a small test first.
7. Fake tokens and rug pulls
How it works: a token copies a famous name, or a new project creates hype. Insiders then sell everything or drain the liquidity. Some tokens are coded so that you can buy but never sell.
Protect yourself: verify contract addresses from official sources and don't chase a token because it's trending.
8. Deepfakes and fake giveaways
How it works: a video of a celebrity or CEO promises to double any crypto you send. Others use AI-generated video calls or voices to impersonate people.
Protect yourself: nobody doubles your crypto. If a video call asks for money or a download, end it and contact the person another way.
9. "Recovery experts"
How it works: after you've lost money, someone offers to get it back for an upfront fee. Often they found you through your own post about what happened, or they bought a list of victims.
Protect yourself: report thefts to the police and your country's fraud authority. Don't pay anyone who promises to trace or recover funds.
Six warning signs
- Guaranteed or unusually high returns
- Urgency: "only today" or "your account will be closed"
- Requests for a recovery phrase, password or 2FA code
- Pressure to move the conversation to Telegram or WhatsApp
- Paying money to get your own money out
- Remote-access apps such as screen-sharing tools
If you think you've been scammed
- Stop sending money, even if you're told it will unlock your funds.
- Move remaining funds to a brand-new wallet from a clean device if your phrase or device might be compromised.
- Revoke token approvals if you signed something suspicious.
- Save the evidence: transaction IDs, addresses, screenshots and messages.
- Report it to the police, your national fraud authority and any exchange involved. Exchanges may be able to act if funds arrive on their platform.
- Warn others, and don't feel ashamed. These scams are designed by professionals.
Sources
Keep reading
The $6.3 billion Binance hack explained
How attackers stole about $6.3 billion from Binance in October 2026, what has been frozen and replaced so far, and what users should do now.
How to store your seed phrase safely
Where to keep your crypto recovery phrase, what never to do, how passphrases and multisig help, and what the 2026 Coldcard flaw teaches us.
Exchange or wallet: where should you keep your crypto?
After the Binance hack and the Coldcard flaw, an honest comparison of exchange accounts and self-custody wallets, and how to split your holdings.