Scam Tokens After John McAfee's Death: How to Spot Them in 2026

John McAfee founded the antivirus company that carried his name, and he became a well-known figure in crypto advocacy during the late 2010s. He died in June 2021 in a Spanish prison near Barcelona while he was awaiting possible extradition to the United States and facing tax-related proceedings in Spain. Spanish courts later confirmed that his death was a suicide.

His death drew wide coverage, and within days people were searching for tokens connected to his name. Some of those tokens were new listings with no real link to him or his estate. Scammers rely on this kind of attention because search traffic and social media posts bring in buyers who have not yet checked anything.

The lesson is not about McAfee himself. It is about how any sudden public event, including a celebrity death, a major hack or a viral post, creates a window in which unverified tokens get bought before anyone looks at the code, the liquidity or the holders.

Scam token operators want speed. A famous name gives them a story that buyers recognise, and that story spreads without any marketing spend. Their goal is usually to create a price spike, sell their own holdings into the demand and leave everyone else holding a token that cannot be sold at a fair price.

The main reasons this works are simple:

• Search interest rises quickly after a death, so new tokens appear in public reporting.
• Buyers assume that a token with a famous name must have some backing or purpose.
• Early buyers often post about gains, which pulls in people who feel they are late.
• Attention is short, so the scam only needs to work for a few hours or days.

None of these reasons depends on the token being technically sophisticated. A basic token contract is enough for a pump-and-dump, which is why checking the mechanics matters more than judging the story.

Several documents tie McAfee to fraud allegations from before his death. In October 2020 he was arrested in Spain on allegations of tax evasion, a case that was separate from the crypto charges. In March 2021, US prosecutors in New York unsealed an indictment accusing him of fraud and money laundering. The charges were tied to promotions of initial coin offerings in which he was alleged to have failed to disclose that he was being paid to promote them.

The indictment also described a pump-and-dump scheme. According to the charges, McAfee and an associate used his large social media following to push a coin, and the price rose before insiders sold. Reporting on the case put the amount allegedly taken from investors at over $13 million.

These were allegations. They were never tested in a trial because McAfee died before the case reached one. Readers should treat the details as what prosecutors said, not as settled facts, while still noting that the case is a clear example of how a promotion can hide a conflict of interest.

Celebrity-linked scam tokens tend to follow a similar structure, whether the name belongs to a living person, a deceased figure or a famous brand. Recognising the pattern helps you pause before you buy.

• Name borrowing: the token uses a famous name, nickname or image without any verifiable agreement.
• Urgency: messages say the price will rise sharply or that the window is closing.
• Paid promotion: influencers or channels post about the token without disclosing payment.
• Liquidity games: most of the supply sits in one or a few wallets, and liquidity can be pulled at any time.
• Exit pattern: sharp price rises followed by a steady drop as holders sell.

A token can show one of these signs and still be legitimate, but several together is a strong warning. Pump-and-dump schemes depend on people reacting to the story rather than checking public sources.

A short checklist can screen out most obvious scams before you spend any money. Work through it in order and stop as soon as one check fails.

1. Find the official contract address from the project's own website or verified announcement channels, not from a comment or a direct message.
2. Compare that address with the one you are about to buy. Impersonator tokens often differ by one or two characters.
3. Open the contract on a block explorer for the chain it runs on. Look at whether the source code is verified and whether the owner can mint new tokens, pause trading or change fees.
4. Check the liquidity pool. Find out who added the liquidity, whether it is locked, and for how long.
5. Look at the holder list. If a few wallets control most of the supply, the price can be manipulated by those wallets.
6. Check whether the project has a team, an address, a history or any independent review that you can verify.

A token that passes every step can still lose value, because the checklist tests for scam mechanics, not for future price. It only reduces the chance of buying a token that is designed to trap you.

Some warning signs are specific enough to check quickly. Each one is a reason to slow down or walk away.

• Liquidity is not locked, or the lock expires soon.
• The deployer wallet holds a large share of the supply.
• The contract has a function that lets the owner blacklist addresses or stop sales.
• Selling is restricted, taxed heavily or fails in test transactions.
• The token has very few trades but a large market value, which often means the price is set by a small pool.
• Social accounts were created recently, have little history, or post the same message across many channels.

Use on-chain explorers and token-tracking sites to look at these details yourself. Do not rely on a single number from a promotional post. If you find that the data does not match what the promoter said, that mismatch is itself information.

Many losses happen after a wallet connection rather than through a direct transfer. When you approve a contract, you may give it permission to move tokens later, sometimes without another prompt. Scam sites often request broad approvals in the first step.

Practical habits reduce the risk:

• Keep your main holdings in a separate wallet from the one you use to test new apps.
• Read each approval request and the amount it covers before signing. Refuse unlimited approvals when a limited one will do.
• Review and revoke old approvals with a reputable permission-management tool on a regular schedule.
• Bookmark the sites you use instead of clicking links from messages or ads.
• Never type or share your seed phrase or private keys on any website or with any person, including someone who says they are support staff.

Hardware wallets add a layer of protection because they require physical confirmation for each transaction, but they do not stop you from approving a malicious contract, so the habits above still matter.

If you bought a token and now suspect it is a scam, act quickly but calmly. Acting too late can cost you more, and rushing can lead to a second scam from someone offering recovery help.

Start with these steps:

• Stop interacting with the token contract and the site that promoted it.
• Revoke any approvals you gave to that contract.
• Move any remaining assets you control to a wallet that has never touched the token.
• Save screenshots, transaction hashes and the promotional messages you saw.
• Report the token to the platform where you traded it and to your local consumer or financial crime authority.

Beware of people who contact you offering to recover funds for a fee, especially if they ask for a seed phrase or remote access to your device. Legitimate authorities and exchanges do not work that way. Recovery is rarely possible once funds have been moved, so prevention remains the strongest protection.

For facts that change, check the source rather than trusting a figure you read here or in a post. Prices, trading volume, total value locked and fees all move quickly, and a number from a week ago can be misleading.

Useful places to verify information include:

• Court records and official press releases for the McAfee case and any later rulings.
• The official website and verified social accounts of any project you are considering.
• Block explorers for the chain a token runs on, which show contracts, holders and transactions.
• Data aggregators for DeFi protocols, which show total value locked and volumes over time.

When a claim cannot be traced to a court record, a company filing or a transaction you can inspect, treat it as unverified. That single habit would have spared many people who bought into tokens tied to McAfee's name in 2021.