Crypto scams explained on one page: what a scam actually is, the eight attacks behind most reported losses, and the first check that breaks each one. This page opens a security series, “Know the Scam by SimpleSwap”.

You do not need to be careless to lose crypto in 2026. You only need to be busy.

Americans reported $11.37 billion in crypto-related fraud losses to the FBI in 2025, the highest total the bureau has recorded. That is a floor, not a ceiling. Reporting is voluntary, and most victims stay quiet, so analysts who trace the money estimate the real total is several times larger.

Then there is the case that reframes the rest. In January 2026, one person lost $284 million in a single social engineering attack. The victim held their coins on a hardware wallet, and the hardware wallet was never broken. Someone posing as its manufacturer's support team asked for the recovery phrase and got it.

That is the shape of the risk now. Social engineering accounted for about two-thirds of the cases that one blockchain forensics firm reviewed last year. The code is getting harder to break. People are not.

What counts as a scam

The word covers everything from a bad trade to a bank failure, which makes it useless right when precision matters. A working definition:

Scam: Fraud in which your own valid action moves the funds. Consent is real; it was obtained through deception. Nothing is broken into, because nothing needs to be.

Hack: Theft that defeats a system: stolen keys, or a contract exploited through its own code. Funds move without any action from the owner.

Why we decided to talk about this

Crypto security does not fit into one article, so we are treating it as a project rather than a post. This page is the map, and every attack on it will get a breakdown of its own over the coming months in a series we are calling The Safe Route. Here is why we took it on.

Some of these scams exploit trust in the SimpleSwap name. Two of the eight attacks below involve copies of our site and accounts impersonating our support team and explaining how they work beats leaving people to find out on their own.

A swap is the step of a longer route where a transfer becomes final. SimpleSwap is self-custodial: coins move from your wallet to your wallet, and we hold no balance in between. Once a transfer is confirmed on-chain, no exchange or swap service can recall it, so the useful work occurs before the transfer rather than after.

Our support team sees what happens afterwards. When a route goes wrong, people often write to us, because ours is one of the names they recognize in their own history. Much of what those conversations taught us is on this page now, at the point where it still helps.

Two limits are worth stating plainly. Most schemes do not start on any exchange or swap service: they start in an inbox, a search ad, a dating app, a group chat, and by the time value moves, the manipulation is weeks old. And no service can make its users immune to fraud, ours included. Prevention is a habit rather than a feature.

This is also not a bulletin about crypto crime in general. It is the road our own users travel, with the points marked where people lose money.

"No one can build infrastructure that makes people unscammable, and anyone promising that belongs somewhere on this map. What we control is our own step of the route: the real domain must be easy to verify, and the flow must never ask for anything a scammer could reuse later. Everything around that step is education, which is why this page exists."

Stefan Lauer, Head of Infrastructure, SimpleSwap

The map: eight patterns

1. Phishing

What it is. Fake pages and messages built to capture whatever unlocks your funds, from a seed phrase to an exchange login. Kits are now sold as a service, and AI writes the bait in any language, on-brand, without the old typos. Drainers alone took $83.85 million from 106,106 victims in 2025, and the sharp drop from 2024 mostly reflects a move to vectors those statistics cannot see.

Where it meets your swap. The moment you search for a service instead of typing its address, because paid ads and lookalike results sit above the link you wanted.

First check. Type simpleswap.io by hand once, bookmark it, and use the bookmark every time after. And a rule that survives every redesign: no swap flow needs your seed phrase.

2. Clone sites and fake apps

What it is. Complete copies of known products, same logo and interface, sometimes a paid ad above the original. The clone borrows a real name so the damage lands on someone else's reputation. Impersonation was the fastest-growing category of 2025, up 1,400% year over year.

Where it meets your swap, this is a large part of why searches like "simpleswap scam" exist in the first place. The official domain is simpleswap.io. A page that differs by one letter or one ending is not it, no matter what the interface looks like.

First check. Install apps only through links published on the official site, and verify the domain before sending anything.

3. Wallet drainers

What it is. Malicious code behind buttons labelled "claim", "mint", or "connect", where one approved signature can empty every supported asset from the wallet. Kits are rented like software subscriptions, so one trick surfaces on hundreds of sites at once. The average victim lost $790 in 2025, so the business model is volume rather than whales.

Where it meets your swap. Not inside a standard swap, which is worth knowing as a baseline. Our flow asks for a receiving address and never asks you to connect a wallet. A "swap" page that opens with a signature request has already departed from how wallet-to-wallet exchange works.

First check. Read what a signature grants before approving it, on the device screen rather than the browser. Keep a separate wallet for new sites and airdrops.

4. Approval abuse

What it is. On many networks, tokens move through allowances you grant to smart contracts, and a contract with an unlimited allowance can move your tokens later, without any new action from you. It is quiet by design: a permit grants without transferring, so nothing appears to happen when you sign. Permit-style approvals accounted for 38% of losses among incidents above $1 million in 2025.

Where it meets your swap, the risk follows the wallet, not the venue: anyone who has traded on DEXs is likely carrying old allowances they have forgotten. Wallet-to-wallet transfers add nothing to that list.

First check. Review your approvals with a reputable checker a few times a year and revoke what you no longer use. Where a dApp offers a choice, approve exact amounts rather than unlimited amounts.

5. Address poisoning

What it is. Attackers send tiny transfers from addresses crafted to match ones you use: the first and last characters line up, the middle does not. The bet is that you will copy the wrong entry from your own history next time, which makes this an attack on a habit every interface encourages. Carnegie Mellon researchers who analysed two years of on-chain data counted roughly 270 million attempts targeting 17 million victims.

Where it meets your swap. The seconds when you paste a receiving address into the swap form. Every wallet-to-wallet transfer has that moment, which makes this the most universal attack on the map.

First check. Compare the full string rather than the ends against a source you control, such as your own wallet's address book, never your transaction history. A test transaction still helps, on one condition that the largest case on record makes vivid: in December 2025, a victim sent a $50 test transfer to the correct address; the attacker dusted a lookalike into their history within minutes; and the $50 million that followed went to the attacker. Re-enter the address from your trusted source for the real transfer, because the poison arrives in the gap between the two.

6. Fake support

What it is. Impostor accounts that reply to public complaints faster than any real team, then pull you into a DM or a "verification bot". The endpoint is always the same: your seed phrase, or a payment to "unlock" your funds. This is what took $284 million from one holder in January 2026.

Where it meets your swap. The minutes after something stalls, when you post an order ID in public and the first reply arrives suspiciously fast.

First check. Start with the channels listed on simpleswap.io itself: the live chat and the help centre, where the average response time is about 4 minutes. Real support answers where you asked and never needs your seed phrase. An account that opens with a DM is answering a question you did not ask it.

7. Pig butchering

What it is. The long con of crypto fraud, and the most industrial: weeks of relationship building through dating apps or "wrong number" texts, then a guided "investment" on a platform showing fabricated profits, then pressure to deposit more. It drove $7.2 billion in reported US losses in 2025, the largest single category in the FBI's data, and Americans over 60 carried $4.4 billion of it. The operations run out of compounds in Southeast Asia staffed in part by trafficking victims.

Where it meets your swap, victims are often coached to buy real crypto through legitimate services and then move it to the fake platform. That places honest infrastructure in the middle of a dishonest route, and it is the position we work hardest not to occupy.

"A transfer that resembles a known fraud scenario deserves a slower route, not a faster one. A pause costs minutes. An irreversible transfer to a scam platform costs everything the victim sent."

Stefan Lauer, Head of Infrastructure, SimpleSwap

First check. No real investment requires secrecy from your family or a fee to withdraw your own money.

8. Honeypot tokens

What it is. Token contracts written so the asset can be bought but not sold. The chart looks alive because exits are impossible, and every buyer joins the display. One Web3 security scanner has flagged close to 4 million fraudulent contracts, 3.1 million of them inside a single recent 30-day window.

Where it meets your swap. Chasing a brand-new ticker from a group chat. Established listings filter out much of this noise; a contract deployed yesterday has been through no filter at all.

First check. Check that independent wallets have actually sold the token and that liquidity is locked. A minimal test buy followed immediately by a test sell answers it directly. If you cannot verify an exit, assume there is none.

The map at a glance

Red flags that repeat on every branch

A few signals show up across all eight, whatever the costume:

• Urgency that punishes thinking ("only 10 minutes left to claim")

• Guaranteed returns, stated as a number

• Requests for a seed phrase or private key, in any context, from anyone

• Contact that you did not initiate, however helpful it sounds

• Pressure to move the conversation to a different app

• A fee required to receive money that is supposedly already yours

Any one of these is a reason to stop. Together, the two of them are the whole answer.

The takeaway

Attackers have stopped trying to beat cryptography and started working on the twenty seconds before a person presses send. The industry spent a decade auditing contracts, and the losses moved to the one layer nobody can patch. So the defence that survives every iteration is not a product feature, ours or anyone's. It is the habit of checking the route before value moves.

"Scammers map user journeys for a living. The least the industry can do is publish a better map."

Stefan Lauer, Head of Infrastructure, SimpleSwap

What comes next

Each entry above will get its own breakdown in "Know the Scam by SimpleSwap" over the coming months. Follow #KnowTheScam to catch every new one as it drops — phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.

FAQ

Is SimpleSwap safe to use? SimpleSwap is a self-custodial multi-source swap aggregator that has been operating since 2018, with 20M+ swaps processed and 99.9% uptime. Funds move wallet-to-wallet, with no customer balance held on the platform between swaps. None of that removes the need for the checks above: safety is a property of the whole route, not of any single step in it.

What is the difference between a crypto scam and a crypto hack? A hack defeats a system and moves funds without you. A scam persuades you to move them yourself, which leaves a valid, signed, irreversible transfer that nobody can dispute on technical grounds. Social engineering accounted for about two-thirds of the theft cases that one forensics firm reviewed in 2025.

Can a transaction be reversed if I sent funds to a scammer? Any exchange or swap service cannot recall confirmed on-chain transfers. That is why this page focuses on checks that happen before sending rather than remedies after.

This article was written by SimpleSwap — a self-custodial multi-source swap aggregator. 2,800+ assets, 20+ liquidity providers across CEX and DEX sources, 20M+ swaps since 2018. Wallet-to-wallet by design, with routing handled under the hood.

The information in this article is not a piece of financial advice or any other advice of any kind. The reader should be aware of the risks involved in trading cryptocurrencies and make their own informed decisions. SimpleSwap is not responsible for any losses incurred due to such risks.