Crypto scams: how to spot them before they empty your wallet

Combine three ingredients and you get the perfect breeding ground. Transactions are irreversible: there is no bank to ask for a chargeback. Addresses carry no names. And money crosses borders in minutes. Add greed, urgency and a little FOMO, and the scammer barely has to try. And once the funds go through mixers and dozens of addresses, following the trail gets much harder.

The scale is frightening. The FBI's 2025 IC3 annual report, one of the most detailed public data sets available, logged 181,565 cryptocurrency-related complaints in the United States and $11.366 billion in losses, up 22 % from 2024. Crypto investment fraud alone was the single largest source of losses in the entire report.

Spain does not publish such a detailed breakdown, but local cases follow the same pattern. In June 2025 Spain's Guardia Civil, backed by Europol, arrested five members of a crypto investment fraud network that, according to Europol, had laundered more than EUR 460 million from over 5,000 victims worldwide. And in April 2025, the Guardia Civil and the Policía Nacional broke up a ring in Alicante that took more than EUR 19 million from 208 people using celebrity videos manipulated with artificial intelligence.

Look closely and almost all of them rely on the same thing: getting you to act fast (pay, sign, send, install) before you check. That is why the most effective defense is not technical but about pace: if something cannot wait until tomorrow, do not do it today.

Pump and dumps and rug pulls usually dress up as “the next big coin”. In my video on the three worst cryptocurrencies of 2026 I look at exactly that: scam signals, dangerous tokenomics and what to watch for so you don't fall for it.

Las 3 Peores Criptomonedas de 2026 | No Inviertas Aquí6:32

Spain's market regulator, the CNMV, uses the slang term chiringuito financiero for entities that offer and provide investment services without authorization. Its guide is blunt: the returns they promise are usually too good to be true, they are only bait, and when they cannot explain the losses they disappear or change their name. Because they are not registered, no guarantee scheme covers you if they vanish with your money.

Pig butchering is the cruelest version. The name comes from the Chinese sha zhu pan, “fattening the pig before the slaughter”, as the US financial crimes agency FinCEN explained in a 2023 alert. The FBI describes the script like this: you are contacted by text, social media, ads or dating apps; the conversation quickly moves to a messaging app; you are introduced to a group of “experts”; you invest on a fake platform that shows invented profits and even offers loans so you invest more. When you try to withdraw, taxes and fees appear. And then, nobody.

“Trading bots” with fixed daily returns are the same trick in different clothes: a Ponzi scheme that pays early investors with later investors' money. And the celebrities promoting them almost never know they exist. INCIBE, Spain's national cybersecurity institute, has warned for years about ads using celebrity images that link to fake news articles, and in the Alicante case the scammers were already using AI-manipulated videos. The pattern repeats: they let you withdraw a small gain at the start so you trust them and put in more.

The vaccine is knowing how money is really made in crypto, which is far less exciting than what you're sold. In this video I go through three real strategies and the traps that ruin most people, without promising to make you rich overnight. Anything promising the opposite deserves automatic suspicion.

Cómo ganar dinero con criptomonedas en 2026: 3 estrategias reales12:53

The golden rule fits in one line: no legitimate party will ever ask for your recovery phrase. Not your exchange's support team, not your wallet's manufacturer, not a “technician” messaging you on Telegram. If someone asks for it, you know what it is. The same goes for installing remote-control software or reading out verification codes.

Being in an official store is no guarantee either. In April 2026 a fake copy of Ledger Live showed up in Apple's Mac App Store, published by a developer unrelated to Ledger, and it asked for the recovery phrase. According to AppleInsider and BleepingComputer, it was linked to about $9.5 million stolen from roughly 50 people before Apple pulled it. Ledger only distributes its macOS desktop app from its official website.

Data leaks feed another kind of phishing, the most convincing kind: the one that arrives with your real name and address. In 2020 Ledger lost data on 272,853 customers, with names, postal addresses and phone numbers, which ended up published; and in September 2026 someone used Trezor's newsletter provider to send a fake vulnerability alert to about 347,000 addresses. No leak included recovery phrases, so the trick always ends the same way: an email, a text or a call asking you to “verify” your device or type in your 24 words. Neither Ledger nor Trezor will ever ask for them, as I point out in the description of my comparison of the two.

Ledger vs Trezor en 2027: ¿Cuál es Mejor? (Comparativa Honesta)9:25

Wallet drainers are subtler. In DeFi you do not just send money, you also sign permissions. A malicious site (an airdrop, an “exclusive” mint) asks you to sign an approval granting unlimited permission to move your tokens, and your wallet shows technical text almost nobody reads. Protect yourself by reading what you sign, using a separate low-balance wallet for experiments and revoking old approvals from time to time.

Address poisoning preys on laziness. The attacker generates an address that starts and ends like one you use and sends you a tiny transaction so it lands in your history. The next time you copy “the usual one” from there, you send the money to them. A 2025 academic study counted 270 million attempts against 17 million victims on Ethereum and BNB Chain over two years. Always copy from your address book or a QR code, check the whole address and send a test transaction first.

In late July 2026, Coinkite, the maker of Coldcard hardware wallets, published a security advisory: because of a build error dating back to March 2021, several firmware versions generated seeds with a weak software random number generator instead of the hardware one. That left roughly 40 bits of entropy on the Mk2 and Mk3 and about 72 on the Mk4, Mk5 and Q, instead of 128. No device was hacked remotely: attackers brute-forced the weak seeds offline without touching the hardware. Seeds created with at least 50 private dice rolls were not affected.

The bill was huge. According to Galaxy Research's tally, as reported by TRM Labs on August 5, about 1,816 BTC (close to $116 million) left more than 5,200 addresses in four waves starting July 30. In the video I explain what happened, why, who was really at risk and who was not, and I clear up what people were confusing most: this is not a Bitcoin flaw.

¿Qué ha pasado con Coldcard? ¿Tú dinero está en peligro?7:15

The practical key: what matters is which firmware version you generated your seed with, not the one you run today, because updating does not fix a seed that already exists. If yours is on the official advisory's list (on the Mk2 and Mk3, versions 4.0.1 to 4.1.9; on the Mk4 and Mk5, anything before 5.6.0; on the Q, anything before 1.5.0Q), move your funds to a new wallet generated on fixed firmware with independent entropy such as dice, and consider adding a passphrase or multisig. Galaxy Research also detected a third wave aimed at small balances, so “I have too little for anyone to bother” protects nobody.

Why is this in a scams guide? Because every incident like this brings a wave of phishing behind it: cloned sites, fake support agents and “checking tools” that only want your phrase. I warned about it in the video description:

“

Only go through the official website (coldcard.com). In situations like this, fake sites appear that imitate the original to rob you. NEVER enter your recovery phrase on any website or app.

October 2026: Ledgers tampered with in the sales chain

The Ledger case in October was a textbook criminal job, and a sophisticated one. Someone planted an implant in devices sold by CryptoBilis, an official reseller in Southeast Asia: it read the recovery phrase off the screen while the buyer set the device up and sent it out over the mobile network. Ledger's authenticity check doesn't catch it, because the original secure chip is still intact. Estimates of the losses range from $72 million to $93 million across more than 300 wallets, figures Ledger hasn't verified, and the company says every confirmed loss comes from that reseller's devices.

The defense is boring and it works: buy your hardware wallet only from the manufacturer's official store, never second-hand, from a marketplace or at a suspicious discount, and set it up yourself from scratch. The one I recommend is Ledger, and Trezor if you prefer open source: the official Ledger store and the official Trezor store are the only ones I link to (affiliate links: if you buy, I earn a commission at no extra cost to you). What has gone wrong at each brand is covered in Ledger vs Trezor.

If you are thinking about your own custody setup, the hot vs cold wallet guide covers the pros and cons of each option.

1. You are promised high returns with no risk, or a fixed return every day or month.
2. They contact you first: a call, WhatsApp, Telegram, Instagram or a dating app.
3. There is pressure: “today only”, “last spots”, “if you don't get in now, you'll miss it”.
4. You are asked for your seed phrase, private key or a verification code.
5. You are asked to install a remote-access app so they can “help”.
6. To withdraw, you first have to pay something.
7. The entity is not authorized, is missing from the ESMA register or appears in the CNMV's warnings.
8. A celebrity endorses it in an ad or “news story” you cannot find on the real outlet's site.
9. They let you withdraw a small amount at first to win your trust.
10. You are offered bonuses for bringing in friends and family.
11. The site or app looks like the official one, but the domain or developer does not match.
12. You are asked to sign a transaction you do not understand, in a hurry.

In the description of my video on the mistakes that ruin beginners I put it in writing: never share your recovery phrase, and buy hardware wallets only from the official website.

7 errores que ARRUINAN a los principiantes en cripto (evítalos antes de perder dinero)12:34

If you live in Spain or elsewhere in the EU, the rules got simpler when MiCA's transitional period ended: Spain's ran until June 30, 2026, and since July 1 only crypto providers authorized by the CNMV or another EU authority can operate in Spain, as the CNMV itself explains. On June 23, ESMA also told unauthorized platforms in a public statement to stop onboarding clients and to cease marketing, so an unlicensed platform advertising to you in Spain is already giving you the first red flag. ESMA's MiCA page hosts the EU-wide register you need.

1. 01

   Look up the exact entity in the ESMA register

   ESMA publishes an interim register of authorized crypto-asset service providers (plus one of non-compliant entities), updated weekly. Careful: MiCA protection covers the specific authorized legal entity, not other companies in the same group trading under the same brand. And a big brand name isn't enough: as of October 15, 2026, neither Binance nor Bitget appeared in the register.

2. 02

   Check the CNMV warnings

   Its warnings search includes unauthorized outfits flagged by the CNMV and alerts from foreign regulators. If it shows up there, end of conversation.

3. 03

   Ask when in doubt

   The CNMV answers investor queries on 900 535 015 (a Spanish number). A call takes five minutes; skipping it can cost you your savings.

4. 04

   Check the domain and the developer

   Type the address yourself or use a bookmark, never a link from an ad. For apps, make sure the developer is the real company.

5. 05

   Read who actually provides the service

   The contract or terms must name the entity dealing with you and its country. If you cannot find it, you have your answer.

First, breathe. Second, do not pay another euro, whatever they tell you. Then, in this order:

1. 01

   Cut contact and keep the evidence

   Transaction hashes (TXIDs), addresses, chat screenshots, URLs, usernames, bank statements and the time of every movement. Without the TXID, tracing funds is close to impossible.

2. 02

   Call your bank

   If a card or transfers are involved, block them and report the transactions. According to the Banco de España, for fraudulent card charges made before you notify the bank you are liable for at most EUR 50, unless you were negligent, and the bank covers those made afterwards. If you made the transfer yourself after being deceived, getting it back is much harder.

3. 03

   Alert the exchange

   If the funds went through a regulated platform, tell them as soon as possible: they can freeze accounts linked to the scam while the police act.

4. 04

   File a police report

   At a Policía Nacional station, a Guardia Civil post or, in Catalonia, the Mossos d'Esquadra. The Policía Nacional's online reporting office lets you start the report on the internet, but you must sign it at a station within 72 hours or it has no legal validity.

5. 05

   Call INCIBE's 017 helpline

   INCIBE's cybersecurity helpline is free and confidential, open 8:00 to 23:00 every day of the year, also on WhatsApp (900 116 117) and Telegram (@INCIBE017), with technical, legal and psychosocial advice.

6. 06

   If it was an unlicensed outfit, tell the CNMV

   It helps stop others from falling for it and gets the entity onto the warnings list.

So you never get to this point, the security section has more videos on custody, and any unfamiliar terms are in the glossary. If you are starting from zero, the guide on how to start in crypto will spare you many of these scares. And do not skip the risk warning: this is information, not financial advice.

More videos to protect your crypto

9:10

Las 5 MEJORES wallets frías para proteger tus criptos en 2026 (máxima seguridad)

Jul 19, 2026 · 718 views

20:30

Cómo Crear tu Wallet MetaMask y Pasar Dinero del Exchange sin Perderlo

Sep 9, 2026 · 148 views