Crypto Scams & Wallet Drainers

What this guide covers

Crypto scams aren't a single trick — they're a playbook of overlapping techniques that all exploit the same weakness: the gap between what you think is happening and what's actually happening on-chain. This guide breaks down the major scam categories, how they work mechanically, and the habits that stop them before they start. It goes deeper than our blog post on the same topic — this is the full reference.

If you've already read Guide 1: Wallets & Self-Custody, you know the basics of seed phrase security. This guide picks up from there and covers everything else: phishing, malicious smart contract approvals, fake airdrops, social engineering, and the modern "wallet drainer" attacks that have become the dominant threat since 2023.

A Short History

Crypto scams have evolved alongside the technology itself. In the early Bitcoin era (2010–2013), most scams were simple: fake exchanges that took deposits and disappeared, or Ponzi schemes like Trendon Shavers' "Bitcoin Savings and Trust" that promised unrealistic returns and used new deposits to pay old investors. The SEC shut Shavers down in 2013, but the template — promise high yield, pay early investors with later investors' money — never went away.

The ICO boom of 2017 created a new attack surface. Anyone could create a token, write a whitepaper full of buzzwords, and raise millions from investors who couldn't tell a real project from a copy-paste contract. The SEC eventually classified most of these as unregistered securities, but by then the money was gone. The lesson stuck: in crypto, the cost of creating something that looks legitimate is near zero, and the cost of verifying that it is legitimate falls entirely on you.

The modern era began around 2021–2022 with the rise of "wallet drainer" technology. Instead of stealing a seed phrase (which requires tricking you into typing it somewhere), drainers ask you to sign a smart contract transaction that gives them permission to move your tokens — often disguised as a claim, a verification, or an airdrop. You approve, and within seconds your wallet is empty. By 2024, on-chain analytics firms estimated that wallet drainers had stolen over $295 million from more than 324,000 victims, and the technology had been commercialized as a service — scammers could "rent" a drainer kit and split proceeds with the developer.

Timeline

• 2011: First major exchange hack — Bitomat, a Polish Bitcoin exchange, loses its private key database and shuts down overnight
• 2013: Trendon Shavers' Bitcoin Savings and Trust is shut down by the SEC — the first major crypto Ponzi scheme prosecution
• 2014: Mt. Gox hack revealed — 850,000 BTC stolen (then worth ~$450M), the largest exchange loss in crypto history at the time
• 2017: ICO boom — hundreds of token sales raise billions; many are later revealed as scams or failed projects
• 2020: DeFi "rug pulls" emerge as a dominant scam pattern — developers create a liquidity pool, attract deposits, then withdraw everything and disappear
• 2021: Squid Game token pumps 83,000% then drops to near-zero in minutes — a textbook "pump and dump" with a built-in anti-sell mechanism
• 2022: Wallet drainer attacks begin scaling — scammers use fake airdrop websites and malicious contract approvals to drain wallets without needing seed phrases
• 2023: "Inferno Drainer" and similar phishing-as-a-service kits are identified by security researchers, offering scammers turnkey wallet-draining infrastructure
• 2024: On-chain analytics estimate wallet drainers have stolen over $295M from 324,000+ victims cumulatively
• 2025: FBI and CISA issue joint advisories on "pig butchering" — long-form social engineering scams where attackers build fake relationships over weeks before introducing a fake crypto investment platform