Crypto Scams in 2026: The Playbooks and How to Spot Them

Last updated: October 2026

The biggest crypto scams in 2026 are investment "pig butchering" schemes, AI-powered impersonation, fake platforms, wallet attacks, crypto ATM scams, rug pulls, recovery scams and, increasingly, physical "wrench" attacks. All of them end the same way: you send funds, or authorise a transfer, that cannot be reversed. This page covers every major playbook, with the latest numbers and the tells for each.

Crypto scams in 2026 by the numbers

The FBI's Internet Crime Complaint Center recorded $11.37 billion in cryptocurrency-related fraud losses in 2025, across 181,565 complaints. That was a record, and more than half of the $20.9 billion in all internet crime losses reported that year (The Block on the IC3 2025 report, 12 Apr 2026). Americans aged 60 and over filed 44,555 crypto complaints and lost roughly $4.4 billion, by far the largest share of any age group.

Chainalysis estimates that at least $17 billion went to crypto scams in 2025, up from $12 billion in 2024. It found that impersonation scams grew more than 1,400% year over year and that AI-enabled operations took in about 4.5 times more revenue than those without AI (Chainalysis, 13 Jan 2026). The average scam payment rose from $782 to $2,764. Scammers are going after fewer people for more money.

Investment fraud was the single largest category in the FBI data: $7.2 billion across 61,559 complaints.
Crypto ATM and kiosk scams rose 58% to $389 million.
Wallet-drainer phishing fell 83% to $83.85 million in 2025, but attacks shifted to more victims and smaller amounts (Scam Sniffer, 3 Jan 2026).
Violent "wrench" attacks took $30 million in the first half of 2026 alone, after a record $58 million in 2025 (Chainalysis, 6 Aug 2026).

These numbers describe an organised industry, not opportunistic theft. Below is each playbook, with a link to the full guide where one exists.

1. Investment scams and pig butchering

The largest category by value. The scammer builds a relationship over weeks, often starting with a wrong-number text or a dating app match. They avoid talking about investments at first, and only later introduce a trading platform that shows spectacular returns. The platform is fake. Small withdrawals are paid out to build trust. A large one triggers a demand for tax or unlocking fees.

Much of this runs out of industrial-scale scam compounds. In the most visible enforcement action so far, US authorities seized about $15 billion linked to the Prince Group, which operated forced-labour scam compounds in Cambodia and Myanmar (Chainalysis, 13 Jan 2026).

The tells: a stranger who makes contact and steers toward money; a platform you cannot find independently; returns without volatility; pressure to put in more; and above all, a fee demanded before you can withdraw. No legitimate platform charges you to release your own funds.

2. Fake wallets and wallet drainers

This attack does not steal your keys. It gets you to hand them over through a cloned wallet app or extension, or to sign an approval that lets a contract move your tokens.

Full guide: Fake wallet scams in 2026 covers the 2026 cases (fake wallet apps in Apple's App Store, hijacked Chrome extensions, a compromised real wallet update), how to verify a wallet before installing it, and what to do in the first hour. The signature mechanics are in wallet drainers and approval phishing.

3. AI impersonation and deepfakes

The fastest-growing category. Voice cloning needs only seconds of audio. Video deepfakes of well-known figures now run convincingly in livestreams promoting fake giveaways. Chainalysis attributes much of the 1,400% growth in impersonation scams to these tools. It also documents a single case in which a man posing as Coinbase customer support defrauded victims of nearly $16 million (Chainalysis, 13 Jan 2026).

The tells: any giveaway that requires you to send first; support agents who contact you rather than the other way round; urgency plus a familiar face. Verify through a separate channel you open yourself. A real executive does not livestream an offer to double your crypto.

4. Fake exchanges and cloned sites

These are cloned front ends of real platforms, or entirely invented exchanges with fake trading volume. Deposits work; withdrawals do not. The 2026 wave of exchange closures has made this worse. Users are actively searching for new platforms and for withdrawal help, which is exactly when a cloned site works best.

The tells: a URL you reached through an ad, a search result or a message instead of typing it yourself; no company you can verify; not listed in any regulatory register. Our guide to verifying MiCA authorisation covers how to check a platform against the official registers.

5. Address poisoning

An attacker plants a lookalike address in your transaction history and waits for you to copy it. Two victims lost $62 million this way between December 2025 and January 2026. The defence is to never copy addresses from history. Mechanics and examples are in fake wallet scams in 2026.

6. Crypto ATM and kiosk scams

This is the scam most aimed at people who have never owned crypto. A caller posing as a bank, a utility, a government agency or the police says your account is compromised or that you owe a fine. They then talk you through withdrawing cash and feeding it into a crypto kiosk, sending it to "their" QR code. FBI data shows $389 million lost this way in 2025, up 58%, with people over 60 accounting for about $257 million of it.

The tells: any official who asks you to pay in crypto, stay on the phone while you withdraw cash, or keep the call secret from your bank or family. No bank, court or tax authority takes payment through a crypto kiosk.

7. Rug pulls and exit scams

A token launches with real liquidity and marketing and attracts buyers. Then the team pulls the liquidity or dumps its supply. Variants include contracts with hidden mint functions or transfer restrictions that stop you selling. Our glossary entry on what a rug pull is covers the warning signs in more detail.

The tells: anonymous teams with no verifiable history, liquidity that is not locked, token supply held by a few wallets, unverified contracts, and returns promised at a fixed rate. Sustainable yield comes from sources you can identify: trading fees, lending interest, staking rewards. If nobody can explain where the return comes from, there is your answer.

8. Wrench attacks and physical coercion

A risk that barely existed a few years ago. Criminals find people who are publicly known to hold crypto and force them to transfer it, sometimes through home invasions or by targeting family members. Chainalysis counted 46 documented incidents worldwide in the first half of 2026. France was the main hotspot, and home invasions made up 37% of attacks (Chainalysis, 6 Aug 2026).

The defences: don't publicise your holdings, keep leaked personal data in mind (see what happens to your KYC data), and keep most funds in setups that one person cannot move alone, such as a multisig wallet or time-delayed withdrawals.

9. Recovery scams

The second robbery. After losing money once, victims are approached by "recovery specialists" or fake law enforcement who promise to trace and return the funds for an upfront fee. Victim lists circulate among fraud groups, which is why the approach often arrives soon after the original loss. Covered fully in our guide to crypto recovery scams.

The defences that actually work

Separate wallets by purpose. A drained experimental wallet is an inconvenience; a drained main wallet is a catastrophe. See our self-custody guide.
Never enter a seed phrase anywhere except a wallet's restore screen. There is no legitimate exception.
Read what you sign, and revoke old token approvals regularly.
Bookmark the real URLs and open apps only from your own bookmarks.
Treat unsolicited contact as hostile by default, however it arrives.
Hang up and call back on a number you look up yourself whenever someone claiming to be a bank, an exchange or the police asks you to move money.
Adopt a mandatory delay. Almost every one of these playbooks depends on urgency. A rule that no transfer above a set size happens within 24 hours of first hearing about it defeats most of them.

On the institutional side

For businesses, the equivalent controls rely on data analysis rather than personal habits. Blockchain analytics platforms such as Crystal Intelligence trace stolen funds and flag exposure to known fraud infrastructure before a deposit is credited. Identity verification providers such as iDenfy handle the onboarding side, where synthetic identities and deepfaked verification attempts are now routine rather than rare.

If you have already sent funds

Stop sending. Any further payment described as a fee, tax or unlock charge is part of the same scheme.
Revoke approvals immediately if a signature was involved, and move remaining assets to a new wallet.
Record everything: addresses, transaction hashes, URLs, usernames, screenshots.
Report it to your national fraud authority and, in the US, to IC3. Reports feed the seizure operations that have recovered large sums. The UK Metropolitan Police's recovery of 61,000 bitcoin from a fraud that hit more than 128,000 victims is the largest example (Chainalysis, 13 Jan 2026).
Refuse every recovery offer. Legitimate tracing is done by law enforcement, and by licensed firms hired through formal channels. It is never done by someone who contacts you first.

Frequently asked questions

How much is lost to crypto scams each year?

The FBI's IC3 recorded $11.37 billion in cryptocurrency-related fraud losses in 2025 across more than 181,000 complaints. That was a record and more than half of all reported internet crime losses. Chainalysis estimated total scam revenue above $17 billion for the same year.

What are the most common crypto scams in 2026?

Investment and pig-butchering scams remain the largest by value, while impersonation scams are growing fastest because of AI voice and video tools. Fake wallets and drainers, crypto ATM scams, rug pulls and recovery scams make up most of the rest, and physical wrench attacks are a growing risk for known holders.

What is a pig butchering scam?

A long-running investment fraud in which the scammer builds trust over weeks through social or dating apps, then introduces a fake trading platform showing fake profits. Small withdrawals are paid out to build credibility; larger ones trigger demands for fees that never end.

Why do scammers target older people?

Americans aged 60 and over reported roughly $4.4 billion in crypto losses in 2025, the largest share of any age group. Savings built up over a lifetime, less familiarity with how crypto works and more social isolation make the long-relationship and fake-official playbooks unusually effective.

Can stolen crypto be recovered?

Sometimes, but only through law enforcement. Blockchain transactions are irreversible, and no private service can force a return. Recoveries happen when authorities seize assets at the points where crypto is cashed out, which is why reporting quickly matters. Anyone who contacts you offering paid recovery is running a second scam.

What is the single most effective anti-scam habit?

A mandatory delay. Nearly every playbook depends on urgency, so a personal rule that no significant transfer happens within 24 hours of first hearing about the opportunity removes the pressure the scam needs.

Are DeFi protocols scams?

Legitimate protocols are not, but the space attracts imitators. The differences that matter can be checked: published audits, open-source contracts, documented and explainable yield sources, and a real team. Yield promised at a fixed, guaranteed rate with no stated source is the clearest warning sign.

Keep reading

Viktor Vostrikov

Co-Founder

About the author.

Co-Founder at JewelSwap & Chief Strategy Officer at iDenfy. Viktor brings his successful track record of superb development & project management.