How to Avoid Crypto Scams
Most people who lose money in crypto do not get hacked. They get talked into something. Here are the patterns that keep working on smart people.
The three that get everyone
- Fake wallet extensions. Ads at the top of search results pointing at lookalike domains. Bookmark the real site instead.
- "Verify your wallet" sites. They ask you to connect and sign, then drain your approvals. Real eligibility checks are read-only.
- DM support. Nobody legitimate messages you first. Not the project, not the exchange, not "MetaMask support."
Approvals are the real attack surface
When you swap a token, you grant a contract permission to spend it. That permission usually stays open, forever, on every token you've ever traded.
If a contract you approved is later compromised, it can drain those tokens without you signing anything new. This is why revoking old approvals matters more than most people think.
The smell test
If it promises a return, it is a risk you are not being told about. If it needs urgency, it is a decision you would not make calmly. If it needs your seed phrase, it is theft — there is no fourth category.
What to do today
Bookmark your wallet's real site. Revoke approvals at revoke.cash. Turn on a hardware wallet for anything you'd be upset to lose.