Rug Pulls, Phishing and Wallet Drainers: A Practical Scam Checklist

How big the problem is

The FBI's 2025 Internet Crime Report, released on 6 April 2026, says cyber-enabled crimes defrauded Americans of nearly $21 billion. Cryptocurrency-related complaints had the highest losses of any category: 181,565 complaints totalling more than $11 billion. Investment fraud remains the main driver, accounting for nearly 49% of scam-related losses. People over 60 reported about $7.7 billion in losses, up 37% from 2024.

These figures only cover complaints that victims reported, and they are US figures. The patterns below apply anywhere.

1. Rug pulls

A rug pull is a scam in which a project's developers suddenly vanish with investors' money, leaving the tokens worthless. A December 2024 academic study of Uniswap and PancakeSwap pools gives a concrete picture of the simplest form. The authors define a "one-day simple rug pull" as a pool where the scammer adds ETH or BNB and a token, then removes at least 99% of the liquidity tokens within a day.

Their findings, from their own dataset of collected pools and under their own criteria:

The takeaway is not that 45% of everything on Uniswap is a scam. The study counts pools under a narrow definition in two ecosystems, so read the percentages as how common this pattern is in that data, not as a measure of the whole market. The scale of the dataset does suggest that launching a scam token is cheap for people who do it in bulk.

Checks before you buy a new token

• On Uniswap, they flagged 161,329 of 356,295 pools as scam pools, which is 45%. On PancakeSwap, 470,712 of 1,694,058, or 28%.
• Some scam tokens are "trapdoor" tokens: it is possible to buy but impossible to sell them.
• Fake investors, likely controlled by the scammer, buy the token to make it look popular. Once the cost of that wash trading is counted, the authors found that existing profit formulas overstate scam profit by at least 32% on Uniswap and 24% on PancakeSwap.
• The same people run many of them. The authors found clusters of scammer addresses linked by common patterns, with token contracts within a cluster more than 70% similar.

1. Confirm you can sell. Trapdoor tokens let you buy but not sell. Use a very small test amount.
2. Ask who can remove the liquidity. A rug pull works by pulling it out. If the deployer holds the liquidity position and nothing restricts it, the risk is high.
3. Distrust the crowd. A busy chart can be wash trading.
4. Check where the hype came from. The SEC's investor alert describes fraudsters pumping up the price of a token, often a memecoin, then selling at your expense. It says never to make investment decisions based solely on information from social media.

2. Phishing, impersonation and fake sites

The SEC's May 2024 alert lists how fraudsters reach people. They contact you on social media or by a supposedly accidental text, exploit the hype around technologies such as AI, and impersonate or exploit trusted sources, including friends, family and government agencies, sometimes with AI-generated voices or video. The alert warns that an investment may not be legitimate if you are required to pay for it with crypto assets.

Checks

1. Type the address yourself, or use a bookmark you made earlier. Do not follow links in messages, ads or replies.
2. Verify the contact through another channel. If a friend sends an investment tip, call them.
3. Never share your seed phrase or private key. No real support team, exchange or wallet needs it. The SEC alert notes that scammers may ask for your private key.
4. Treat "recovery services" as a second scam. The SEC says scammers demand extra fees, taxes or deposits to unlock an account, and that if you pay you are unlikely to get your money back and you will lose the extra payment too.

3. Wallet drainers

A drainer is a malicious site or contract that gets you to sign something, often a token approval or a gasless permit signature, that lets the scammer move your tokens. You never "send" anything. You just sign.

Scam Sniffer, which tracks signature phishing, reported that losses fell sharply in 2025:

That is a fall of 83% in losses and 68% in victims. The largest 2025 loss came from a Permit signature in September. Permit and Permit2 signatures accounted for 38% of large-case losses, and Scam Sniffer says malicious EIP-7702 signatures emerged after the Pectra upgrade, with two August cases totalling $2.54 million. Scam Sniffer also notes that new drainers emerged in 2025, so the ecosystem remains active even as old ones exit.

A token approval is a way of allowing a smart contract or another address to withdraw funds from your wallet. 1inch's help page warns that unlimited approvals can be dangerous because the approved contract can keep drawing on the allowance, and that a malicious or compromised contract can take tokens without further consent.

Checks before you sign

1. Read what the wallet says you are signing. A request to "approve" or "permit" access to your whole token balance for a site you just opened is a warning sign.
2. Prefer exact amounts over unlimited approvals where the interface lets you.
3. Verify the contract address from the project's official source before approving.
4. Review your approvals regularly and revoke those you no longer need. Revoke.cash and the block explorers' token approval checkers (for Ethereum, etherscan.io/tokenapprovalchecker) are the tools 1inch lists.
5. Use a separate wallet for experiments with a small balance, and keep your main holdings elsewhere.

4. Address poisoning

Address poisoning does not need you to click anything dodgy. The attacker creates an address whose first and last characters match someone you have paid before, then puts it in your transaction history, hoping you copy it next time.

Bitquery, an on-chain data firm, analysed the twelve months to 31 July 2026 on Ethereum. This is a vendor study, so treat the numbers as indicative. It reports:

The article's advice is simple. Do not copy addresses from your transaction history, use an address book instead. Do not treat a test transfer as verification, because it can create the bait. Check the full address and not just the ends.

• 6,922,366 wallets targeted, and 1,319 people who sent money. It calls the $22,261,415 it measured stolen "a floor, not a total".
• The success rate was 0.019%, or one wallet in 5,248, against an attempt cost of about $1.86 in fees. The median theft was $336, and 64% of victims lost under $1,000.
• The largest single theft was 4,556 ETH, about $12.4 million, sent to a lookalike on 30 January 2026.
• Every attack Bitquery found matched the first and last four characters, and the median time from bait to theft was 5.8 days.

5. Relationship and investment scams

The CFTC lists six warning signs of online financial romance fraud:

The CFTC's advice includes keeping all communication on the original platform, never mixing money with long-distance relationships, running a reverse image search on their photos, and checking a trading website's registration date at lookup.icann.org.

1. Your new online "friend" wants to move the conversation to a private messaging app.
2. They message frequently but can never meet in person.
3. They claim to be wealthy due to crypto or foreign currency trading successes.
4. They encourage you to open an account and recommend a trading website that only accepts cryptocurrency.
5. They tell you to invest in crypto and send the funds to their wallet or a particular trading platform.
6. You follow their directions and make a lot of money quickly or easily.

If you have been hit

This article is general information, not personal advice.

1. Stop sending money. Another fee is another loss.
2. Revoke approvals and move what is left to a fresh wallet with a new seed phrase, if your wallet may be compromised. 1inch says to revoke approvals immediately if your wallet is compromised. (Moving funds to a new wallet is our general precaution, not something the sources above specify.)
3. Report it. The CFTC says to report fraud to cftc.gov/complaint or the FBI at ic3.gov, and also to the platform or exchange involved.
4. Keep records: wallet addresses, transaction hashes, screenshots and messages.