Cryptocurrency Fraud: 10 Schemes and How to Protect Yourself

Crypto fraudsters rarely need to “hack” a blockchain: much more often they make a person hand over the money, the keys or the access themselves. According to a representative of the Cyberpolice, a noticeable share of reports about internet fraud today is connected specifically with crypto assets. Below are ten schemes described by the Cyberpolice, the National Securities and Stock Market Commission (NSSMC) and the exchanges WhiteBIT and Binance, their signs and the rules of protection. The descriptions are given only so that you can recognize the schemes. Data checked on 19 October 2026.

10 Cryptocurrency Fraud Schemes

1. An “investment platform” with profit on the screen. Ads on social networks or messengers, a professional website, a personal “broker” or “analyst” who pushes you to deposit more and more. The NSSMC (31 July 2026) warns that the displayed “income” may have nothing to do with real transactions, and when a person wants to withdraw money, they are asked for a “tax,” a “withdrawal fee,” an “insurance deposit” or an “account unlocking” payment. After the next payment the money is usually not returned. A project can be checked in the list of dubious investment projects on the Commission’s website.
2. A trusting acquaintance and a “profitable investment.” According to the Cyberpolice, fraudsters find a victim on social networks, dating apps or messengers, win their trust and offer a “profitable crypto investment.” At first the amounts are small and the profit even symbolic, but when the investor wants to withdraw significant funds, transactions are blocked and the money disappears. Do not invest through intermediaries in messengers or on the advice of people you do not know personally.
3. Cloned sites, fake emails and apps. Attackers pose as well-known exchanges to obtain passwords, API keys or seed phrases, or to make you transfer assets yourself (WhiteBIT). Binance advises logging in only through the official website and enabling the anti-phishing code that appears in genuine emails. Go in through your own bookmark, not through a link in a message.
4. Fake support, a “security service” and remote access. The Cyberpolice names “official” calls on behalf of a bank or crypto exchange and “wallet updates” among the most common pretexts. WhiteBIT describes “consultants” who write to you in private messages on their own initiative, and the NSSMC describes requests to install remote access software such as AnyDesk or TeamViewer, supposedly to help with registration. Binance employees, the exchange says, never ask for confidential data and never ask you to transfer money to an address.
5. Extorting a seed phrase. It is requested “to restore the wallet,” for “verification” or for a “test task.” The Cyberpolice advises never giving seed phrases or private keys to anyone. For how to store a phrase safely, read the material How to Store Crypto.
6. Address poisoning in the transfer history. WhiteBIT writes that attackers watch wallets with high activity, create an address with the same first and last characters and send tiny amounts, for example 0.01 USDT. They are counting on you to copy the address from the history. Check every character, not just the beginning and the end, and use the address book. For choosing a network, see the material USDT Networks.
7. “Doubling” and “giveaways” from well-known people. According to WhiteBIT, fraudsters create deepfake videos or audio of public figures and, in “live streams” on YouTube or Telegram, urge viewers to send cryptocurrency, promising to double the amount. WhiteBIT considers all such cases deepfakes. The Cyberpolice adds that a scammers’ site may look high quality but have no official contacts or licenses. There is no such thing as doubling an amount. WhiteBIT also gives an example of a “free giveaway” of NFTs: users were asked to connect a wallet on a fake site, and they themselves gave the attackers access to it.
8. Rug pull and honeypot. In the first case, the developers of a new token, after hype and purchases, suddenly remove the liquidity, the website and the accounts; in the second, the contract lets you buy the token but blocks selling for everyone except the creators. The Cyberpolice names the signs: no verified team, documentation or roadmap, guarantees of quick enrichment, a sharp jump and fall in price, tokens mostly held in the developers’ wallets. Check whether the token contract is verified in a block explorer (Etherscan, BscScan) and whether there is a code audit.
9. P2P: a forged proof of payment. Binance advises releasing crypto only when you have yourself confirmed in the bank or wallet that the money has arrived. A counterparty’s screenshots cannot be trusted, and fake receipts may contain errors in the text, shifted blocks or different fonts. Pressure to “release immediately” is a warning sign, even if the pressure does not come from the buyer. Under Binance P2P policy, the payment must come from an account in the buyer’s name; a payment from a third party is dangerous. For more, see the material Binance P2P: How to Buy and Sell Crypto.
10. A “job” paid in USDT and money mules. The Cyberpolice describes lucrative vacancies in the crypto field where, for “registration” or a “test task,” you are asked to install a program or hand over a seed phrase or wallet, and the “employer” communicates only in messengers. A separate risk is a request to receive money on your own card and transfer it on: the NBU calls such people drops and reminds of criminal liability for complicity under Article 209 of the Criminal Code (3 to 12 years of imprisonment). See also How to Withdraw Crypto to a Ukrainian Bank Card.

How to Protect Yourself

• Check who is behind the project. The Cyberpolice advises studying the organization’s social networks and checking the website through the WHOIS service. In its warning about 10 signs of a fictitious project, the NSSMC names, among others, the absence of permits and licenses, aggressive marketing and the lack of a physical office.
• Do not believe in guaranteed profit and time pressure. If you are asked to make a first deposit as soon as possible and are not told where the money will go, refuse.
• Never tell anyone your seed phrase, private keys or 2FA codes. WhiteBIT writes that its official representatives never ask for a password, 2FA codes or a seed phrase; whoever asks is a scammer.
• Enable two-factor authentication and the exchange’s anti-phishing code. Binance Academy recommends an app or a hardware key instead of SMS.
• Do not install programs on the instructions of the person you are talking to. A bona fide intermediary will not ask for remote access to your device.
• Use the address book and a test transfer. Make the first transfer to a new address a small one.
• Do not rush to connect your wallet to new sites for the sake of a “giveaway” or a “free” token.

What to Do If You Have Already Lost Money

1. Stop communicating and make no additional payments. Demands for a new “tax” or a “fee” to return the funds are the same scenario the NSSMC warns about.
2. Collect evidence: wallet addresses, transaction hashes (TxID), amounts, times, correspondence, screenshots of the site. WhiteBIT asks you to provide exactly this data when contacting support.
3. Secure your accounts. Change passwords and end sessions on unfamiliar devices. If the seed phrase has been exposed, move the funds to a new wallet while you still have access.
4. File a complaint with the Cyberpolice through the form on its website. Law enforcement notes that blockchain transactions are preserved and the movement of funds between wallets can be traced, so it is worth reporting right away.
5. Notify the exchange through official channels (email, chat on the website), not through messengers: fake support is a separate scheme.
6. If it concerns an “investment project,” report it to the NSSMC: the Commission’s contacts are listed on its website. For card fraud, see the material Bank Card Fraud: 10 Schemes.

Frequently Asked Questions

Can money sent to fraudsters in cryptocurrency be returned?

Blockchain transactions are irreversible: a transfer cannot be cancelled. The Cyberpolice notes that the movement of funds between wallets can be traced, but this gives no guarantee of a refund. So report right away and beware of “intermediaries” who promise a refund for a fee.

How can I tell a real exchange from a fake?

Go in only through your own bookmark or the official app, and check the website address and the anti-phishing code in emails. WhiteBIT has a page where you can check whether a channel or link belongs to the exchange, and Binance advises checking the site’s certificate and using Binance Verify.

Is it safe to buy crypto through P2P?

There are risks, but they can be reduced: release crypto only after you have seen the money arrive in your own account, do not accept payments from third parties and do not communicate outside the platform. For more, see the material Binance P2P: How to Buy and Sell Crypto.

What is dangerous about connecting a wallet to a new site?

By connecting a wallet to a fake site, you may give attackers access to it: WhiteBIT gives the example of an NFT “giveaway.” Do not rush to connect your wallet to new or unverified platforms, and first check them through the project’s other official sources.

Where can I report an investment project?

To the Cyberpolice, if money has been lost, and to the NSSMC, which maintains a list of dubious investment projects and asks to be notified about suspicious platforms.