7 Common DeFi Scams and How to Spot Them Before They Get You

Billions are lost to crypto scams every year, and most victims aren't beginners — they're people who'd heard of every scam on this list and still got caught in a weak moment. Pattern recognition is your best defense. Here are the seven that do the most damage.

1. Rug pulls

A team launches a token, seeds a liquidity pool, markets hard, then pulls the liquidity — the price instantly collapses to zero. Tells: anonymous team, unlocked liquidity, huge team token allocation, a chart that only knows one direction for a few days. Check whether liquidity is locked and for how long before touching any new token.

2. Honeypot tokens

You can buy the token, but the contract silently blocks selling — you watch it "pump," unable to exit while the deployer sells into you. Tells: run any new token through a honeypot-checker tool first; be suspicious of a chart with many buys and almost no sells from regular wallets.

3. Wallet drainers

A malicious site gets you to sign a transaction granting token approvals (or an eth_sign blind signature); a script empties everything approved. Tells: signature requests that don't match your action, "claim airdrop" or "verify wallet" prompts, wallet warnings you're tempted to click through. One rule prevents most of this: read every signature, and revoke stale approvals regularly (see our 12 security rules).

4. Phishing clones & poisoned ads

Pixel-perfect copies of Uniswap, bridges, or wallet sites — often ranking above the real site via paid search ads. Tells: the URL. Always. Bookmark real sites, never click ads for DeFi apps, never open "support" links from DMs.

5. Pig butchering

A long-game romance/friendship scam: weeks of rapport, then an introduction to a "trading platform" that shows fake profits — and even lets you withdraw once — before taking everything the moment you commit real size. Tells: any online acquaintance who steers conversation to an investment platform you must access through their link. 100% scam rate. No exceptions.

6. Address poisoning

Scammers send $0 transactions from vanity addresses matching the first/last characters of addresses you interact with, hoping you'll copy the wrong one from your history. Tells: this only works if you copy addresses from transaction history. Don't. Use saved contacts and verify more than the first and last four characters.

7. Fake airdrops & impersonators

Unsolicited tokens appear in your wallet; interacting with them (or the "claim site" they advertise) triggers approvals or drains. Meanwhile, verified-looking accounts impersonate founders announcing giveaways — "send 1 ETH, receive 2 back." Tells: you never have to send anything to receive an airdrop, and nobody legitimate doubles your money.

The meta-rules

• Urgency is the weapon. Every scam engineers time pressure. Slowing down for one hour defeats most of them.
• Greed is the hook. Guaranteed returns and too-good yields exist only to hook you — compare against real market yields to calibrate what "normal" looks like.
• Verification is the shield. URLs, contract addresses, signatures, counterparties — verified every time, no matter how routine it feels.

Assume everything is a scam until proven otherwise, and you'll be right often enough to keep your funds.