Crypto security: common scams, phishing, rug pulls and real exchange hacks

By Unicorn Private Research. Published 27 October 2026.

How do you protect yourself from crypto scams and hacks? Most losses do not come from breaking the cryptography but from deceiving people: fake websites, fake support agents, fake investment platforms and malicious approvals. The core defenses are simple: never share a seed phrase or a login code, reach companies only through addresses you have typed or saved yourself, use an authenticator app or a hardware key, verify every address and approval before signing, and treat any promise of fixed or very high returns as a warning sign.

The scale of the problem

The FBI's Internet Crime Complaint Center (IC3) received 181,565 complaints involving cryptocurrency in 2025, with reported losses of about 11.4 billion dollars, up 22% on 2024; crypto investment fraud alone accounted for about 7.2 billion dollars, and losses through crypto ATMs reached 389 million dollars (IC3 2025 report, published in April 2026, as summarized by The Block). Thefts from platforms add to that: Chainalysis counted about 2.17 billion dollars stolen from crypto services in the first half of 2025 alone (Chainalysis mid-year update, July 2025).

The most frequent scams

• Investment fraud: a contact met on social media, a dating app or a messaging group shows profits on a professional-looking platform, encourages larger deposits and then blocks withdrawals or asks for fees and taxes to release them. It is the largest category in the IC3 data.
• Phishing: emails, text messages and sponsored search results that copy the page of an exchange or wallet to steal logins, codes or the seed phrase.
• Fake support: accounts on social networks or phone calls that pose as support staff, often after the victim posts a question publicly, and ask for remote access, codes or a transfer to a so-called safe wallet.
• Malicious approvals and wallet drainers: a website asks you to sign a transaction or a permission that lets a contract move your tokens.
• Address poisoning: the scammer sends a tiny amount from an address that looks like one you use, hoping you will copy it from your history.
• Rug pulls: the creators of a token or project attract money and then withdraw the liquidity or sell their holdings, leaving buyers with tokens that cannot be sold at any meaningful price.
• Fake giveaways and airdrops: promises to double what you send, or tokens that require you to connect your wallet to claim them.
• Recovery scams: after a loss, someone offers to recover the funds for an upfront fee.

Protecting accounts

• Use a unique, long password for each exchange and for the email linked to it, stored in a password manager.
• Prefer an authenticator app or a physical security key to SMS codes, which are exposed to SIM swapping; ask your mobile operator for a port-out lock.
• Turn on withdrawal address allowlists and anti-phishing codes where the exchange offers them.
• Reach the exchange only by typing its address or using a saved bookmark, not through ads or links received.
• Keep devices updated, install wallets and extensions only from official stores and links, and remove extensions you do not use.

Protecting the seed phrase and self-custody wallets

• Write the seed phrase offline, on paper or metal, and never photograph it or store it in the cloud.
• Never type it into a website or a form: a wallet only asks for it when you restore it on your own device.
• Check the full receiving address, the network and the amount on the device screen before confirming.
• Read what you are signing; revoke old token approvals you no longer need.
• Keep larger holdings in cold storage or in a multi-signature setup, and use a separate hot wallet for everyday use.

Real attacks on exchanges and wallets

• Bybit, 21 February 2025: about 1.5 billion dollars in ether were stolen from a cold wallet during a routine transfer; on 26 February 2025 the FBI attributed the theft to North Korean actors known as TraderTraitor (FBI IC3). Chainalysis estimated that it represented about 69% of the funds stolen from services in the first half of 2025.
• Coinbase, May 2025: criminals bribed support contractors outside the United States to obtain customer data, then posed as Coinbase to trick customers into sending funds; the company refused a 20 million dollar ransom and estimated costs of 180 to 400 million dollars (Form 8-K filed with the SEC, May 2025). Passwords and private keys were not compromised.
• Trust Wallet, December 2025: a malicious version 2.68 of the browser extension, published with a leaked store credential, emptied wallets for about 7 million dollars; the company announced reimbursements (The Block, December 2025).
• Ledger, June 2020: a breach of the e-commerce database exposed about 1 million email addresses and the details of 9,500 customers, later used for phishing letters and emails; devices and funds were not affected (Ledger, July 2020).
• FTX, November 2022: not a hack but the failure of an exchange that, according to the SEC complaint of 13 December 2022, diverted customer funds. It is a reminder that custody risk includes misconduct as well as attacks.

If something goes wrong

Act quickly: move remaining funds to a new wallet with a new seed phrase, change passwords, revoke approvals, contact the exchange through its official channels and report to the police and, in the United States, to ic3.gov. Keep transaction hashes and screenshots. Be wary of anyone who contacts you afterwards promising to recover the money for a fee.

Security and Unicorn Club

The same rules apply to any crypto payment to a counterparty: confirm the address through a verified channel and send a small test first when in doubt. Unicorn Club, the club for accredited investors organized by Unicorn Private LLC, accepts BTC, ETH, USDT and USDC (ERC-20) for its pre-IPO club deals; the guide on how to invest in pre-IPO companies with crypto describes how payments are confirmed.

Frequently asked questions

Can stolen crypto be recovered?

Sometimes, when funds reach an exchange that blocks them at the request of law enforcement, but in most cases a confirmed transfer cannot be undone. Prevention matters more than recovery.

How can I tell a fake investment platform?

Warning signs include returns that look guaranteed, pressure to deposit more, a contact you have never met in person, withdrawals that require extra fees, and a company that does not appear in the register of any regulator.

Is a hardware wallet enough?

It protects the private key from malware, but it cannot stop you from revealing the seed phrase or approving a malicious transaction. It works together with good habits.

Related guide

• How to invest in pre-IPO companies with crypto through Unicorn Club
• Bitcoin and ether ETFs and other indirect ways to invest in crypto
• Crypto wallets explained: custodial and self-custody, hot and cold, seed phrases
• How to buy your first cryptocurrency, step by step
• What is a club deal? How pre-IPO club deals work

Sources

• FBI Internet Crime Complaint Center, 2025 IC3 Report, April 2026
• The Block, FBI says crypto-related fraud losses hit record 11.4 billion dollars in 2025, April 2026
• Chainalysis, 2025 crypto crime mid-year update, July 2025
• The Record, Chainalysis: 2.17 billion dollars stolen in the first half of 2025, July 2025
• FBI IC3, public service announcement on the Bybit theft, 26 February 2025
• Coinbase Global, Form 8-K filed with the SEC, May 2025
• The Block, Trust Wallet extension incident, December 2025
• Ledger, addressing the July 2020 e-commerce and marketing data breach, July 2020
• SEC, charges against the founder of FTX, 13 December 2022