How to Spot Crypto Scams and Rug Pulls Before Investing

Most crypto losses reported to the FBI come from persuasion, not hacking. People are talked into sending money to a fake trading platform, to a token whose creators can drain the market, or to a "recovery" service that targets earlier victims. The warning signs usually show up before the first transfer. Passing every check does not make a token safe; it only rules out some known ways to lose money.

Key takeaways

Crypto investment fraud was the largest source of losses reported to the FBI in 2025: $7.228 billion.
A demand for "taxes" or "fees" before a withdrawal is a red flag, and paying does not release the money.
Locked liquidity, renounced ownership, verified code and audits each answer one narrow question. In the example below, a locked pool still loses 97% of its dollars to an owner who can mint.
Recovery offers are a second scam. IC3 never charges to recover funds.

What the 2025 loss data shows

The FBI's 2025 IC3 Annual Report, published in April 2026, counted 1,008,597 complaints and $20.877 billion in reported losses. It says crypto investment schemes are largely run by Southeast Asian criminal groups using trafficking victims as forced labor.

IC3 category, 2025	Complaints	Reported losses	Share of all losses
All complaints (p. 6)	1,008,597	$20.877 billion	100%
Any cryptocurrency link (p. 8)	181,565	$11.37 billion	54%
Crypto investment fraud (p. 53)	61,559	$7.228 billion	35%
Recovery scams (p. 53)	10,516	$1.4 billion	7%*

*May include money lost in the earlier scam, IC3 notes. Shares are computed from the report; crypto investment fraud averages about $117,400 per complaint.

The Federal Trade Commission's figures point the same way. In testimony to Congress on March 25, 2026, it reported $15.9 billion in consumer fraud losses for 2025, more than $7.9 billion of it from investment scams, with bank payments and then crypto carrying the largest losses. IC3 feeds the FTC's database, so the totals overlap, and the FTC says reported losses are only a fraction of actual losses.

The main patterns and their tells

Relationship scams and fake platforms

An FBI public service announcement of October 3, 2022 described the scheme known as "pig butchering." The scammer makes contact through social media or a dating app, spends time gaining trust, then steers the victim to a website or app that shows the "investment" growing fast. Cashing out brings a demand for income taxes or fees first. A March 14, 2023 FBI alert adds that victims do not get their money back even if they pay. The 2025 report adds that victims may be offered loans to fund bigger deposits.

IC3's investment fraud guidance adds "matching" funds, deadlines, a quick move to another messaging app, and group chats full of fake "happy clients."

Fake exchanges and trading apps

The 2022 FBI alert warns of misspelled copies of real exchange domains and apps whose legitimacy cannot be verified. A January 2026 Washington State Department of Financial Institutions release on NASAA's top investor threats lists clone websites built with AI-generated graphics and "fictitious trading apps and websites in the crypto space." The tell is how the platform was found: one reachable only through a contact's link or deposit address cannot be checked independently.

Pump-and-dumps and memecoin presales

The CFTC's advisory on virtual currency pump-and-dump schemes describes chat groups counting down to a buy signal on a thinly traded coin, sometimes with fake news of a famous investor's interest. The organizers sell first. The SEC's May 29, 2024 investor alert on crypto asset scams applies it to memecoins: promoters tout a token, sometimes in a "pre-sale," sell before the hype ends, and later buyers lose most of their money.

Rug pulls, soft and hard

In the Frosties NFT case (March 24, 2022), prosecutors defined a rug pull as creators soliciting investment, abruptly abandoning the project and keeping the money; they alleged Frosties was abandoned within hours of selling out and about $1.1 million moved through several wallets.

Hard rug pulls use the token's mechanics: pulling the pool's liquidity, minting and selling new tokens, or blocking sales. Soft rug pulls need no malicious code: insiders dump holdings or let the project wither. In SafeMoon's case, investors were told part of a 10% transaction tax went into "locked" liquidity pools that prevented a rug pull. An IRS Criminal Investigation release of February 10, 2026 says the defendants kept access to the pools and diverted millions of dollars' worth of tokens. SafeMoon's chief executive was sentenced to 100 months in prison.

Giveaways and impersonation

The FTC's consumer guide to cryptocurrency scams describes a scammer posing as a celebrity "who can multiply any cryptocurrency you send them," and puts it plainly: "Only scammers demand payment in cryptocurrency." The SEC's 2024 alert adds deepfakes and hacked friends' accounts touting crypto expertise.

Ponzi-style yield programs

In its September 1, 2021 complaint against BitConnect, the SEC alleged a $2 billion fraud. Its "Lending Program" claimed high returns from a "volatility software trading bot," but the SEC alleges the money was never traded and went to wallets controlled by the founder, a promoter and others. NASAA's 2026 list warns of the modern version: AI "trading bots" that promise guaranteed returns.

Recovery scams

The FBI's August 13, 2025 alert on fictitious law firms lists the tells: claimed government partnerships (no law firm is an authorized partner of a US agency), made-up regulators such as an "International Financial Trading Commission," detailed knowledge of past transfers, fees payable in crypto or gift cards, and a "foreign bank" whose website is fake.

A rug pull, worked in numbers

Many new tokens trade in an automated pool of the token and a paired asset, priced so the product of the two balances stays constant (the "constant product formula" of the Uniswap v2 whitepaper). Whoever supplied the liquidity holds pool tokens redeemable for a share of both balances.

k = x × y
Tokens received for Δx dollars:  y − k ÷ (x + Δx)
Dollars received for Δy tokens:  x − k ÷ (y + Δy)

x  = dollars (stablecoin) in the pool
y  = new tokens in the pool
Δx = dollars a buyer adds;  Δy = tokens a seller adds

Illustrative example. A developer opens a pool with $50,000 of a dollar stablecoin and 50,000,000 new tokens, a starting price of $0.001, and keeps all the pool tokens. Buyers then spend $30,000, treated as one purchase. The example ignores the 0.3% trading fee, which changes the results by less than 0.5%.

Buyers receive 50,000,000 − 2.5 trillion ÷ 80,000 = 18,750,000 tokens. The pool now holds $80,000 and 31,250,000 tokens, a price of $0.00256.
At that price the buyers' wallets show $48,000. Selling everything would return only $30,000, because each sale pushes the price down, so the $18,000 "gain" exists only on screen.

Ending	What the insider does	Insider receives	Buyers can recover from the pool
Hard rug pull	Redeems all pool tokens	$80,000 plus 31,250,000 tokens	$0 (no pool left to sell into)
Soft rug pull	Sells 50,000,000 extra tokens held outside the pool in a "team" wallet	$49,231	$5,769, a loss of $24,231 (81%)
Liquidity locked, minting allowed	Mints 1 billion new tokens and sells them	$77,576	$43; the pool keeps $2,424 of $80,000

In the hard rug pull the developer leaves with the buyers' $30,000 on top of the original stake. In the third row the lock did its narrow job, since the pool tokens never moved, yet minted tokens still took 97% of the pool's dollars.

A honeypot works without touching the pool. The contract accepts buys but blocks sales from unapproved addresses, or lets the owner raise a sell tax to almost 100%, so the chart only climbs. A small test sale proves little if the owner can switch on the block or the tax later.

On-chain checks and their limits

A block explorer can expose some hard rug-pull mechanics, but none of these checks proves a token is safe.

Check	What it shows	How it can mislead
Source code verified	Per Etherscan's verification guide, the published code matches the deployed bytecode, so anyone can read the functions.	Verified code can still contain mint, blacklist or fee switches. Weaker match types do not check how the contract was deployed.
Ownership renounced	In OpenZeppelin's Ownable contract, renouncing leaves no owner, so owner-only functions stop working.	Only functions guarded by that owner check are disabled. Separate admin roles, hard-coded privileged addresses or an upgrade mechanism can survive.
Liquidity locked	Pool tokens are held by a time-lock contract until a set date.	The lock may cover only part of the pool, expire soon, or be controlled by the team. It does not stop minting or insider selling.
Holder concentration	The share of supply held by the largest wallets.	The pool, lock and exchange contracts show up as big holders. One insider can spread a stake across many new wallets.
Mint, blacklist, pause or fee functions	Whether the visible code can create tokens, block addresses or change taxes.	Their absence matters only if the contract cannot be upgraded or controlled by another contract. An upgradeable contract's logic can be replaced after launch.

What an audit does and does not cover

An audit reviews one version of the code, once, within an agreed scope. Ethereum.org's smart contract security guide says audits "won't catch every bug" and warns against treating them as a silver bullet. An owner's power to mint or blacklist is a feature working as designed, so a report may list it without calling the token unsafe, and it says nothing about the team's honesty. Check that the report appears on the auditor's own site and names the contract address being traded.

Registration and regulator status

For memecoins there is often nothing to check. In a February 27, 2025 staff statement, the SEC's Division of Corporation Finance said memecoins of the type it described are not securities, so their sales need not be registered. Buyers therefore get no federal securities-law protections such as registration disclosures. The statement is a staff view with no legal force, does not cover securities disguised as memecoins, and leaves fraud open to other agencies.

Registration matters more when someone offers to manage money, run a trading account or pay a set yield. The Washington DFI release says crypto scams "often involve unregistered securities." Background checks are free on the SEC's Investor.gov, on the CFTC's registration check page and with state securities regulators. The CFTC's RED List names foreign firms that appear to need CFTC registration but do not have it. Listing is not a finding of wrongdoing, and a firm missing from the list still needs a registration check.

Red flags before you send money

These are warning signs, not a safety test; a project can show none and still be a fraud.

An online contact or "wrong number" text turns to investing.
The platform or deposit address is reachable only through the contact's link.
Account balances rise quickly, matching funds or loans are offered, or a deadline is imposed.
Withdrawals require a fee, a tax or a deposit to "unfreeze" the account.
Returns are promised or guaranteed, often credited to a secret bot or algorithm.
A token is pushed through social media countdowns, presales or claims of celebrity backing.
The contract can still mint tokens, block addresses or change taxes, or it can be upgraded.
Liquidity is unlocked, partly locked or locked briefly, or a few wallets hold most of the supply.
A seller of a managed or yield product is unregistered or on the RED List.
Payment is demanded in crypto or gift cards, or an unsolicited firm offers to recover past losses.

Frequently asked questions

Will IC3 contact me about my complaint or lost funds?

No. According to an FBI alert of April 18, 2025, IC3 never contacts individuals directly by phone, email, social media or messaging apps. Any follow-up comes from an FBI field office or other law enforcement. IC3 does not charge to recover funds and does not refer victims to companies that do.

Why do some fake platforms let users withdraw money at first?

IC3's investment fraud guidance says scammers often allow early withdrawals of the deposit and some "earnings" to look legitimate. The aim is a larger deposit later; at the final withdrawal, fees appear, and victims often pay more to release funds than they deposited.

Is an app safer because it is in a well-known app store?

Not necessarily. The SEC's 2024 crypto scam alert says fraudsters may direct victims to a fake website "or to a widely-used app that can be downloaded from a well-known app store." A store listing says nothing about whether deposits can be withdrawn.

How quickly can a crypto pump-and-dump play out?

Very fast. In one example in the CFTC's advisory, the buy-and-sell cycle was over in less than eight minutes.

Are older investors hit harder by crypto investment fraud?

By dollar amount, yes. In the 2025 IC3 report, people aged 60 and over filed 13,685 crypto investment fraud complaints with $2.76 billion in losses, more than any other age group (page 53). That is about 38% of the $7.228 billion total, and many complaints did not record an age.

If money has already moved

Stop sending money, including any "fee," "tax" or "verification deposit" demanded before a withdrawal.
Record the details. The FBI's guidance for crypto scam victims asks for wallet addresses, amounts and types of crypto, dates and times, transaction IDs (hashes), website and app names, contact identifiers and a timeline.
Report it. File with IC3 by typing www.ic3.gov into the browser; the FBI warned in September 2025 about spoofed IC3 sites in sponsored search results. Also report to the FTC at ReportFraud.ftc.gov, to the SEC through its tips and complaints page for securities fraud, to the CFTC through its complaint page, and to any exchange used. Per the FBI's April 2025 alert, victims 60 or older can get filing help from the DOJ Elder Justice Hotline, 1-833-FRAUD-11 (833-372-8311).
Ignore recovery offers that charge up front or arrive unsolicited.

The tax position is narrow. In Chief Counsel Advice memorandum 202511015 (released March 14, 2025), the IRS concluded that victims who sent money with a profit motive had a deductible theft loss under section 165(c)(2), reported on Form 4684, Section B.

That includes pig-butchering investments, even ones that began as romances, and savings moved to "safeguard" them at a scammer's direction. The deduction is limited to the victim's basis and taken in the year of discovery, once there is no reasonable prospect of recovery.

Romance or fake-kidnapping payments with no profit motive were personal casualty losses, disallowed by section 165(h)(5) for 2018 through 2025. Section 70109 of the One Big Beautiful Bill Act (P.L. 119-21) removed that end date. From 2026 on, such personal losses stay deductible only if attributable to a federally or state-declared disaster, or to the extent of personal casualty gains. The memo is not precedent and turns on each person's facts; a tax professional can confirm how it applies.