Scams and phishing: pyramids, fake tokens, drainers

If sanctions and darknet are the "heavy artillery" of risk, then scams and phishing are the most widespread, "grassroots" threat that almost every crypto holder faces. What is especially insidious here is that the victim often becomes a carrier of suspicious activity themselves: scam tokens and traces of interaction with fraudulent contracts settle in their wallet. Let's examine the types of scam, the phenomenon of "dust", the mechanics of drainers and approval phishing, and understand why databases of scam addresses are always lagging behind.

Types of scam

Financial pyramids and Ponzi schemes"Investment platforms" with guaranteed returns that pay old participants out of new ones. Classics range from BitConnect to countless "staking bots" on Telegram.
Rug pullThe creators of a token/project gather liquidity and then "pull the rug" — dump their coins and drain the pool, zeroing out the price. A common scheme on DEXes with new tokens.
Romance scam (pig butchering)Long psychological grooming of the victim through a "relationship", followed by luring them into a fake investment. One of the most lucrative types of scam in recent years.
Fake airdrops and "giveaways""You've won tokens", "claim your airdrop" — lures that lead to a phishing site or a malicious contract.
ImpersonationFake accounts of exchanges, support desks and well-known people that trick victims out of seed phrases or into transfers "for verification".

Fake tokens and "dust"

One of the most underrated topics. The blockchain lets anyone create a token with any name and send it to any addresses — without the recipient's consent. Fraudsters exploit this.

A wallet's Token transfers tab. Numerous unsolicited tokens with "come-on" names — the typical picture of a scam giveaway and "dust".

Let's go through what is visible on the screenshot and why it matters:

Unsolicited tokens. The wallet has "received" dozens of tokens the owner never bought. They were sent automatically — this is a mass mailing, not a deliberate transaction.Receiving a scam token does not make you guilty, but it clutters the wallet's history and can distort superficial scoring.
"Come-on" names. The tokens are named to provoke a click: a promise of a large sum, the name of a well-known project, an invitation to "claim" / "visit site".A token's name is, in effect, a spam message embedded directly into the blockchain.
The trap link. Often a website address is encoded in the token's name or metadata. Going there and trying to "sell" or "activate" the token lands the victim on a drainer.The main danger is not the token itself, but the action it prompts.
Zero-value tokens (dusting). "Dust" — microscopic amounts sent to thousands of addresses. The goal is either advertising/phishing, or de-anonymisation (to track where the victim moves this dust and link their addresses).Rule of hygiene: do not touch dust and unknown tokens you receive — do not swap, forward or "activate" them.

Caution. Never interact with unknown tokens that "arrived" on their own. Do not try to sell them, exchange them, or follow the link inside them. Any action is exactly the fraudster's goal: a signature they will turn into a theft.

Wallet drainers and approval phishing

A drainer is a malicious service that empties a victim's wallet. The key to understanding it is the mechanics of approval on blockchains like Ethereum.

Why this matters. For a DeFi application (a swap service, a marketplace) to be able to spend your tokens, you sign an approve transaction — permission for the contract to dispose of your tokens. Legitimate applications request limited access. A drainer, however, disguised as "connect wallet" or "activate airdrop", asks you to sign an approval for an unlimited amount (unlimited approval) in favour of the fraudster's contract. After that, the attacker can withdraw all the approved tokens at any moment — without the victim's renewed consent.

The lure. A phishing site (a clone of a well-known project, an "airdrop", a "mint NFT"). It often arrives via a scam token, a fake advert or a hacked social media account.Domains differ by a single letter; the interface copies the original 1:1.
Connecting and signing. The victim "connects the wallet" and signs what looks harmless (a login, a "verification"), but is in fact an approval or a direct transfer.Permit/Permit2 signatures are also dangerous — they grant approval without a separate on-chain transaction, "with a single signature".
Draining. The drainer immediately withdraws all available tokens and NFTs to its own addresses, often through a drainer-as-a-service with a fee to the developer.The funds of hundreds of victims flow into the common clusters of drainer services.

Phishing site
"claim airdrop"

→

Approval signature
unlimited

→

Wallet emptied

Why databases of scam addresses always lag behind

It might seem: "There are blacklists of scam addresses — check against them and you're done." In practice this method is fundamentally behind the curve, and here is why.

Single-use addressesFraudsters generate fresh addresses for each campaign. By the time an address makes it into a database, it has already done its job and been abandoned.
The speed of new tokensCreating a token and mailing it out takes minutes and pennies. Scam tokens appear by the thousand every day; tagging physically cannot keep up.
Reliance on complaintsMany databases are filled after the fact — from victims' reports. That means by the time an address is listed, someone has already suffered.
Mutating schemesDrainer services update their contracts and domains, evading signature filters.

Why this matters. Because of this lag, a scam check cannot be built on "blacklists" alone. You need behavioural analysis: mass mailing of identical tokens, the pattern "many inputs from victims → rapid withdrawal", unlimited approval to an unknown contract, clusters characteristic of drainers. Such analysis catches new schemes before they make it onto lists. Hence the practical principle: a fresh address with no history and no reputation is not a "clean" address but an address with unknown risk, and it should be treated more cautiously, not more leniently.

Practical hygiene for the client (and for you). 1) Do not interact with unsolicited tokens. 2) Regularly revoke old approvals through dedicated services. 3) Check the application's domain letter by letter. 4) Use a separate "hot" wallet with a small balance for risky interactions. 5) Never enter your seed phrase for anyone — a legitimate service will not ask for it.

Lesson summary

Scams are a mass riskPyramids, rug pulls, pig butchering, fake airdrops, impersonation.
Scam tokens and dustUnsolicited tokens clutter a wallet and lead to phishing; don't touch them.
A drainer = theft via a signatureUnlimited approval / Permit empties the wallet without renewed consent.
Lists lag behindBehavioural analysis is needed; a fresh address = unknown risk, not a safe one.

In the closing lesson of this section we will examine the "grey zone" — high-risk exchanges without KYC, nested exchanges, casinos and P2P: why this is a moderate rather than maximum risk, and how to correctly interpret scores of 30–50.

← Programme Programme →

This material is for educational purposes only and does not constitute legal advice.