Security & protection

· THEIR METHOD ·

• The trap: a link takes you to a fake site identical to the original, where you’re asked to enter your private keys or sign a transaction. The result? Your wallet is emptied within minutes.
• Their technique: playing on urgency (fake withdrawals, security alerts) to make you act fast. Some malicious links even appear on official sites and accounts.

· HOW TO PROTECT YOURSELF ·

• Never click a link received by email or DM.
• Check the site’s URL before entering any information.
• Enable 2FA on your accounts.

· THEIR METHOD ·

• Their method: they pose as trusted people (employers, colleagues, support staff) and get you to reveal sensitive information or install malicious software.
• Recent example: the Bybit hack ($1.4 billion stolen) by the Lazarus group through psychological manipulation.
• Recent example: GrassCall, a fake meeting app used to infect Web3 job seekers with malware.

· HOW TO PROTECT YOURSELF ·

• Never disclose sensitive information, even to a “trusted” person.
• Be wary of urgent requests or offers that seem too good to be true.
• Verify the authenticity of recruiters and platforms before installing anything.

· THEIR METHOD ·

• Their method: a slightly altered URL (e.g. Binance-crypto or Biinance instead of Binance), but a visually identical site. You enter your credentials or private keys, and within minutes your funds are gone.
• Example: a fake site mimicking Blockworks where only one detail (like a banner) linked to a fraudulent page.

· HOW TO PROTECT YOURSELF ·

• Always check the URL before logging in.
• Never enter your private keys on a website.
• Use bookmarks to access official platforms.
• Enable 2FA to limit unauthorised access.

· THEIR METHOD ·

• Copying the name, profile picture and bio of an influential account.
• Privately contacting followers to offer fake giveaways, airdrops or investment opportunities.
• Sometimes they buy verified accounts to appear more credible.
• Why it’s dangerous: even in a small community, fake accounts regularly appear to trap members. At scale, the damage is enormous.

· HOW TO PROTECT YOURSELF ·

• Always verify an account’s authenticity before interacting.
• Never send money or share your private keys, even if the message comes from an “official account”.
• Be wary of offers that seem too good to be true.

· THEIR METHOD ·

• You receive a mysterious NFT or token that looks like an airdrop or a reward.
• Curious, you click on it or try to sell it.
• You sign a malicious transaction that gives hackers access to your wallet. The result? Funds drained instantly.

· HOW TO PROTECT YOURSELF ·

• Never interact with an NFT or token received without reason.
• Never connect your wallet to an unknown site claiming to “unlock” your rewards.
• Disable automatic NFT display on Metamask and other wallets.
• Use a second wallet dedicated to airdrops, separate from your main portfolio.

· THEIR METHOD ·

• They impersonate you with your phone carrier to request a new SIM card.
• Sometimes they infiltrate databases by posing as an IT technician.
• They send hundreds of texts to the victim to bury the security alerts sent by crypto services.
• Notable example: in 2016, the US Department of Justice recovered $5.2 million in Bitcoin stolen via SIM swapping.
• Notable example: “Baby Al Capone”, a teenager, stole $23.8 million in crypto using this technique.

· HOW TO PROTECT YOURSELF ·

• Disable SMS-based 2FA and prefer an app like Google Authenticator or a hardware key (Yubikey).
• Set a PIN code on your SIM card to prevent it from being transferred.
• Avoid linking your phone number to sensitive platforms (exchanges, wallets).
• Be wary of “technical support” calls asking for personal information.

· THEIR METHOD ·

• They post fake testimonials and results on social media.
• You’re invited to deposit crypto on an “automated” platform.
• Once the funds are sent, there’s no getting them back: the bot doesn’t exist, and the scammers disappear.

· HOW TO PROTECT YOURSELF ·

• Be wary of returns that seem too good to be true. No bot guarantees consistent profits.
• Never deposit funds on an unknown platform without thorough checks.
• Check independent reviews and look for verifiable proof of performance.
• Don’t trust social media testimonials, which are often faked.

· THEIR METHOD ·

• Their method: they build a relationship over several weeks or months, earn your trust, then introduce crypto by boasting about their “gains”.
• The trap: you send a small amount, receive a fake return on investment, and, feeling confident, invest more. But when it’s time to withdraw, you can’t. The scammer disappears with all your money.

· HOW TO PROTECT YOURSELF ·

• Be wary of strangers online who talk about investing.
• Never send money to someone you met on the internet.
• Always check platforms before depositing funds there.

· THEIR METHOD ·

• Their method: they launch a promising project, attract capital, and once enough has been raised, everything disappears (website, social media, developers).
• Notable example: the Kokomo project scammed $4 million before shutting down all its channels.

· HOW TO PROTECT YOURSELF ·

• Be wary of anonymous projects with no verifiable track record.
• Check whether the team is public and their identity confirmed.
• Favour audited, well-established projects.
• Never invest more than you can afford to lose.

· THEIR METHOD ·

• Fake websites with a slightly altered URL (Binance-crypto instead of Binance). You enter your credentials and your funds vanish.
• Fake apps on Google Play, the App Store or ads on X and Google, imitating well-known wallets or exchanges.
• Fraudulent updates: during an official update announcement, scammers distribute an infected version, and many fall for it.
• Notable example: a fake Ledger Live app appeared on the Microsoft Store, leading to the theft of 16.8 BTC (about $600,000).

· HOW TO PROTECT YOURSELF ·

• Always download apps via the project’s official website.
• Check the URL before logging in.
• Never enter your private keys into an app or a website.
• Enable 2FA to secure your access.

· THEIR METHOD ·

• Spying: they monitor your screen and keyboard, watching for keywords like Bitcoin or wallet.
• Address hijacking: when you copy a crypto address, the malware replaces it with the scammer’s.
• Hidden mining: software installs on your PC and uses your computing power to mine crypto.
• Ransom: the ransomware encrypts your files and demands a ransom in crypto to unlock them.
• Notable example: in 2017, the WannaCry malware (Cryptolocker) hit the entire world, encrypting thousands of computers’ data in exchange for a Bitcoin ransom.

· HOW TO PROTECT YOURSELF ·

• Never download suspicious software or files.
• Avoid dubious sites and torrents.
• Keep your antivirus up to date and your firewall enabled.
• Always double-check the address before sending funds.

· THEIR METHOD ·

• A fake giveaway claims to offer you 2 BTC if you send 1.
• Influential accounts, often hacked, promote the scam.
• Once your crypto is sent, it’s gone.
• Notable example: Vitalik Buterin’s X account was hacked, spreading a scam that stole $691,000.
• Notable example: Graham Ivan Clark, behind one of the biggest “Double your Bitcoin” scams, manipulated thousands of victims.

· HOW TO PROTECT YOURSELF ·

• No serious project will ever ask you to send crypto to receive more.
• Verify sources before following a giveaway link.
• Never trust offers that seem too good to be true.

· THEIR METHOD ·

• You receive an alarming email claiming the scammer holds a record of your visits to adult websites.
• They threaten to reveal everything to your loved ones unless you pay a ransom in crypto.
• It’s all fake, but some, gripped by panic, pay to avoid an imaginary scandal.
• Notable example: the “Crypto-Porno” case, where two French hackers extorted over a million euros in Bitcoin, trapping 1,300 victims.

· HOW TO PROTECT YOURSELF ·

• Never reply to these emails. They send mass threats hoping someone takes the bait.
• Check whether your email address has been leaked (via Have I Been Pwned).
• Never pay the ransom. Giving in only encourages them to continue.
• Mark the email as spam and report it.