How to Avoid Web3 Scams: A Practical Safety Guide for 2026

Most Web3 scams follow a handful of patterns. Learning the pattern helps more than memorising any single scam, because names and branding change while the mechanics stay the same.

• Phishing and fake sites: a copy of a real dApp, wallet or exchange page, reached through a search ad, a social post, a reply or a direct message.
• Wallet drainers: a site or contract that asks for a signature or token approval and then moves your assets.
• Seed phrase theft: fake support agents, fake wallet apps or "validation" pages that ask for your recovery phrase. No legitimate service ever needs it.
• Rug pulls and honeypots: tokens whose creators pull liquidity, mint unlimited supply, or code the contract so buyers cannot sell.
• Address poisoning: an attacker sends a tiny transfer from an address that looks like one you have used, hoping you copy it from your history later.
• Fake airdrops and giveaways: unsolicited tokens with a "claim" site, or celebrity giveaways promising to multiply what you send.
• Investment and romance scams: a long friendly conversation that ends at a fake trading platform showing invented profits. Withdrawals are always blocked behind new "fees".
• Impersonated support: helpful strangers in Discord, Telegram or social replies who offer to fix a problem you mentioned in public.
• Malicious software: fake wallet extensions, cracked apps and clipboard malware that swaps the address you paste.

The common thread is that you are asked to do something, such as sign, send, download or reveal. Public blockchains have no chargeback, so every one of these depends on you taking an action you cannot reverse.

Wallet drainers rely on permissions you grant, not on breaking into your wallet. Two mechanisms matter.

Token approvals. An ERC-20 approval lets a spender contract move your tokens up to an allowance. Legitimate protocols need this. Supplying assets to Aave V3 or Compound V3, or swapping on a decentralized exchange, normally starts with an approval. A malicious site asks for the same thing but names an attacker's contract, often with an unlimited amount. NFTs have an equivalent, a collection-wide approval, that lets an operator move every item you hold from that collection.

Off-chain signatures. Some tokens and systems accept signed permits that create an allowance without a gas-paying transaction. The signature looks like a harmless pop-up, yet it can authorise a spender just as an approval does. Some scams also use blind signing, where you approve unreadable hexadecimal data.

How to read a request:

1. Check the site's domain against the one in the project's official documentation.
2. Look at the spender or recipient address and whether it matches a known protocol contract.
3. Check the amount. Where your wallet allows, replace "unlimited" with the exact amount you need.
4. Read the plain-language preview or simulation if your wallet offers one.
5. Reject anything you cannot explain to yourself in one sentence.

A sign-in message should be readable text that names the site you are on. If the domain in that message differs from the address bar, close the page. If you are asked to sign something while only trying to "verify" or "claim", treat that as a strong warning sign.

Good wallet setup limits the damage of any single mistake. The aim is to make sure no one wrong click can reach everything you own.

1. Use a hardware wallet for savings. Keys stay on a separate device, and every transaction needs a physical confirmation. Buy it directly from the manufacturer and check that the packaging and setup flow look untouched. Never use a device that arrives with a pre-written recovery phrase.
2. Store the recovery phrase offline. Write it on paper or metal. Do not photograph it, put it in cloud notes, email it or type it into a computer except when restoring on a device you trust. Consider an optional passphrase for larger holdings.
3. Split your wallets. Keep a vault wallet that never connects to new sites, a daily wallet with a modest balance for established dApps, and a throwaway wallet for anything unfamiliar.
4. Install software from the right place. Reach wallet extensions and apps through the publisher's official site, typed or bookmarked by you, not a search ad. Check the publisher name and review history.
5. Send a small test first. For a new address or chain, send a small amount and confirm it arrives before sending the rest.
6. Use an address book or allowlist. Compare the full address, not just the first and last characters, to avoid address poisoning.
7. Consider a multisig. For team or large holdings, requiring several signers removes the single point of failure.
8. Keep your device clean. Update the operating system and browser, avoid pirated software, and use a separate browser profile for crypto.

Before connecting a wallet or buying a token, run through a short verification routine. None of these checks is conclusive on its own, but together they filter out most low-effort scams.

What to check	How to check it
Website address	Compare with the domain in the project's official docs or verified social profiles. Bookmark it and use the bookmark.
Contract address	Copy it from the official documentation, then open it in a block explorer and confirm the name and token details match.
Verified source code	On a block explorer, check that the contract source is published and readable.
Admin powers	Look for functions that mint, pause, blacklist or change fees, and who controls them.
Upgradeability	Find out whether a proxy lets the team change the code, and who holds that key.
Audits	Read the report, the audited contract addresses and whether issues were resolved.
Age and activity	A brand-new contract with heavy marketing and little history deserves caution.
Independent listings	Dashboards such as DefiLlama show whether a protocol is tracked and how long it has operated.

Check cross-references from more than one source. A scam can fake a website, a social account and an audit badge together, but it is harder to fake years of consistent history, an established documentation site and independent coverage.

When figures such as TVL, volume or token holders matter to you, look them up live in a dashboard or block explorer rather than trusting a number quoted on a site you reached through a link.

Social engineering works because it targets people, not code. The messages differ, but the red flags are consistent.

Warning signs

• Urgency: "claim within one hour", "your account will be locked".
• Unsolicited contact: someone messaging first about your wallet, a trade or a "problem".
• Requests for your seed phrase, private key, a screen share or remote access.
• A new link, wallet connection or file offered as a fix for an error you mentioned publicly.
• Rewards that are too good: guaranteed returns, giveaways, "double your crypto".
• Job interviews or investor calls that ask you to run code, install software or join a call through an unusual link.
• Official-looking accounts that are actually compromised, posting a "mint" or "airdrop" link.

Habits that block it

1. Treat any direct message as untrusted. Real support teams do not start private chats about your funds.
2. Never share a recovery phrase, ever, with anyone, including someone claiming to be wallet or exchange staff.
3. Open support pages by typing the address or using a saved bookmark, not by clicking a sponsored search result. Scam sites often buy ads above the real one.
4. Verify announcements in at least two independent official places before acting on them.
5. Slow down. Wait before acting on anything that creates pressure.
6. Be sceptical of QR codes and shortened links, since you cannot see the destination before opening them.
7. If a stranger moves you from a public chat to a private one, that move itself is a warning.

Approvals can sit on your wallet for years. If you once granted unlimited access to a site that later turned out to be malicious, or to a protocol that was later exploited, that allowance may still be open. Regular review is cheap insurance.

How to review approvals

1. Open a token approval checker. Most major block explorers have one, and there are independent revoke tools.
2. Enter your wallet address, or connect in a way that only reads your public address.
3. Select the right network. Approvals are per chain, so repeat for each network you use.
4. Sort or filter for unlimited allowances and for spenders you do not recognise.
5. Revoke access for dApps you no longer use or never meant to approve. Each revocation is a transaction and costs gas.
6. Check separately for signature-based or allowance-manager approvals, since some tools list those in a different place.
7. Repeat after any unusual signing prompt, and as a routine every month or two.

Things to keep in mind

• Revoking stops future losses. It does not return funds that were already taken.
• If your seed phrase or private key was exposed, revoking is not enough. Create a new wallet and move assets, because the old key is permanently compromised.
• If you are using a protocol such as Aave V3 or Lido regularly, you may choose to keep a limited allowance open. Prefer exact amounts rather than unlimited ones when the interface lets you.
• Do not use a "revoke" tool you reached through an ad or a message. Fake revoke sites exist.

Rug pulls and honeypots exploit the fact that anyone can launch a token in minutes. Many harmful tokens share recognisable traits.

Common red flags

• An anonymous team combined with heavy promotion and a countdown or "stealth launch".
• Liquidity that is not locked, or locked for a very short period.
• Owner functions that can mint new supply, pause trading, blacklist wallets or change taxes without limits.
• Extreme buy or sell taxes, or a contract that blocks sales for most wallets (a honeypot).
• A small number of wallets holding most of the supply.
• Copy-pasted websites and whitepapers with generic claims.
• Tokens that appear in your wallet uninvited, with a website to "claim" or "sell" them.

What liquidity locks do and do not do

Locking tools such as Team Finance let projects lock liquidity and team tokens and set up vesting, which can reduce the risk that a team simply removes the pool. That is helpful evidence, but it is not a guarantee. Check what exactly is locked, for how long, who else holds tokens that are not locked, and whether the token contract itself has dangerous admin powers. A locked pool can still contain a token nobody is able to sell.

Practical steps

1. Read the contract on a block explorer and check for mint, blacklist and pause functions.
2. Use a token scanner or sell simulator as one input, not as a verdict.
3. Do not interact with unsolicited tokens. Ignore them or hide them.
4. Size positions as if the token could go to zero, because with new tokens that is a realistic outcome.

Real protocols can be exploited, and fake front ends imitate them. Safety here means both avoiding impostors and accepting smart contract risk.

Activity	Main risk	Safer habit
Bridging	Fake bridge sites, contract exploits	Use the official route for the network, for example Arbitrum Bridge or Linea Bridge, or a well-established bridge such as Across or Stargate V2
Liquid staking	Smart contract bugs, token depegging	Understand how the token like stETH, rETH or JitoSOL is redeemed; spread across providers
Lending	Liquidation, oracle or market-design risk	Borrow well below limits on markets such as Aave V3, Compound V3 or SparkLend; read the risk parameters
Yield farming	Unaudited vaults, hidden admin keys	Start with a small amount; be wary of yields far above comparable markets

Bridges have historically been among the biggest targets for large exploits, because they hold pooled funds and rely on complex message passing. Infrastructure layers such as LayerZero V2 and CCIP are mainly for developers, so most users meet them through an app. Check which chain and token you are sending, and use a small test amount first.

Staking and lending protocols differ in custody, upgrade controls and risk management. Look for published documentation, audit coverage, governance control over parameters, and a long track record. Remember that a protocol's brand does not protect you from a copycat domain. Always start from the official documentation or a bookmark you saved earlier.

If an interface promises a very high return with no explanation of where it comes from, assume the source is either high risk or your own deposit.

Centralized exchanges hold your assets, so safety depends on both the platform and your account hygiene. Large platforms such as OKX, Bitget, Gate, Bitvavo, Robinhood and Deribit differ in regulation, products and location, so check which entity serves your country.

Account protections to turn on

1. Use a unique, strong password and a dedicated email address for the exchange.
2. Turn on two-factor authentication through an authenticator app, passkey or hardware security key instead of SMS where possible.
3. Set an anti-phishing code if the exchange offers one, so genuine emails contain a phrase you chose.
4. Enable a withdrawal address allowlist and, if available, a delay after security changes.
5. Review active devices and sessions periodically.
6. Install the app only from the official app store listing linked from the exchange's own site.

Scam patterns specific to exchanges

• Calls or messages from "security staff" asking for codes or to move funds to a "safe wallet".
• Fake apps and lookalike sites that capture your login.
• Platforms that show big profits but block withdrawals behind new fees.
• Requests to upload identity documents to unknown sites. Legitimate exchanges do ask for identity checks, so submit documents only inside the official app or site, and never try to bypass these checks.

Exchanges can also fail, so do not leave more than you need on any platform. Check regulatory status and the licence register for your country yourself.

If you also use crypto casinos, you must be 18 or older, and rules vary widely, so check your local laws before depositing.

Acting fast limits the damage, though recovery is rarely possible. Work through these steps in order.

1. Stop signing. Close the site and do not interact with it again. Do not try to "fix" the problem by following further instructions from the same source.
2. Move what remains. If your seed phrase or private key was exposed, create a new wallet on a clean device and transfer remaining assets there. Automated bots may watch the old wallet, so move the most valuable assets first.
3. Revoke approvals. If only an approval or signature was abused, revoke the allowance using an approval checker. This stops further theft but does not return funds.
4. Secure your accounts. Change passwords for your email, exchanges and password manager, and review two-factor settings. Scan your computer for malware if you installed anything.
5. Document everything. Save wallet addresses, transaction hashes, URLs, chat logs and screenshots.
6. Notify the right parties. If funds went to an exchange, contact its support quickly using the official channel, since freezes are sometimes possible. Report to your local police or national fraud authority, and report the site to the hosting provider and the platform where you found it.
7. Avoid recovery scams. After a loss, you may be contacted by people claiming they can trace and retrieve funds for a fee. These are commonly a second round of fraud.

Be honest with yourself about the odds, but do not stay silent out of embarrassment. Reports help investigators and platforms block repeat offenders, and sharing details can protect others.