Almost every crypto scam works the same way. It is not technically clever. It manufactures a reason to hurry, and hurry defeats judgement. Once you can recognise the machinery, the specific story being told stops mattering.
This is what the common attacks look like on Telegram, X and Instagram, and the checks that stop nearly all of them.
Why these platforms in particular
Three features make social platforms ideal for this.
Identity is cheap. An account with a convincing name, photograph and follower count costs very little to create or buy. Nothing you see on a profile is verified in any meaningful sense.
Urgency is native. These platforms are built around things happening now. A message saying an opportunity closes in an hour does not feel out of place — it feels like the medium working normally.
And there is no recourse. A bank transaction can be disputed. A crypto transaction cannot. Once sent, it is gone, which is precisely why these platforms attract this kind of fraud.
The fake support account
The most common attack, and the one that catches the most experienced people.
You post publicly about a problem — a stuck transaction, a wallet question, anything mentioning an exchange or wallet by name. Within minutes, sometimes seconds, an account with the correct logo and a plausible name replies offering help, or messages you directly.
They are helpful, patient and knowledgeable. Eventually they ask you to "verify your wallet" or "sync your account" through a form, or ask for your recovery phrase to "restore access."
The absolute rule: no legitimate service will ever ask for your recovery phrase or private key. Not support, not a wallet upgrade, not a migration, not a validation step. There is no legitimate process anywhere in this industry that requires it. Any request for it is theft, without exception.
The second rule: real support never messages you first. Bots monitor public posts for keywords. If someone reaches out unprompted about a problem you mentioned publicly, that is the attack, not coincidence.
The giveaway
Send 0.1 ETH, receive 0.2 back. A verified-looking account, a live video of a conference or an interview, a countdown timer, and a stream of comments from other accounts confirming it works.
The video is real footage, usually old, restreamed. The comments are controlled accounts. The verification badge was bought or the account was compromised and renamed.
The check takes two seconds: nobody gives away money at a profit to themselves. If sending someone crypto returned double, they would do it to themselves indefinitely. The logic does not survive a moment's thought, which is exactly why every element of the presentation is designed to prevent you having that moment.
The Telegram group that adds you
You find yourself added to a group with thousands of members discussing a token or a trading service. Screenshots of profits, confident analysis, an "admin" answering questions.
Most members are automated. The screenshots are fabricated or belong to someone else. The group exists to manufacture social proof, because a claim repeated by a crowd feels different from the same claim made once.
The check: being added to a group you did not join is itself the signal. Legitimate communities do not harvest and add strangers. Leave, and report it.
The variant worth knowing: an "admin" moves the conversation to direct messages to help you personally. Real project admins in real communities almost never initiate DMs, and most legitimate groups say so in their pinned message precisely because this is so common.
The romance and friendship approach
The most expensive of these, and the least discussed because victims rarely talk about it.
It begins on a dating app or as a friendly conversation on Instagram. No crypto is mentioned for weeks. A genuine relationship develops. Eventually they mention an investment platform — a family connection, an inside track, something they use themselves.
The platform is real-looking and fully functional. Your deposit appears. The balance grows. You can withdraw small amounts early, which is what converts scepticism into confidence and prompts a larger deposit.
When you try to withdraw the larger balance, there is a fee. Then a tax. Then a compliance hold. Each payment is real; the balance is a number in a database.
The check: any investment introduced by someone you met online is the scam, regardless of how long you have known them or how genuine the relationship feels. The relationship is the investment they made in you. The timescale — often months — is exactly what makes it work.
And the second wave is worse: after the loss, "recovery experts" appear offering to retrieve your funds for an upfront fee. They are frequently the same operation returning for the remainder.
The compromised account of someone you know
A message from a real friend's real account, recommending a platform or asking for help with a transaction. Their account was compromised; the message is not from them.
The check: contact them through a different channel. Phone them. If an account you trust suddenly mentions a crypto opportunity, treat the account as compromised until proven otherwise — that is the far more likely explanation.
The address swap
Technically simple and easy to miss. Malware monitors your clipboard and replaces a copied crypto address with the attacker's. You paste, glance at it, and send.
The check: verify the first four and last four characters after pasting, every time. On a hardware wallet, verify on the device screen rather than the computer — malware can alter what your monitor shows but not what the device displays.
The five checks that stop nearly all of it
- Nobody legitimate ever needs your recovery phrase. No exceptions, ever, for any reason.
- Anyone who contacts you first is suspect. Support, admins, opportunities, old friends with new investments.
- Urgency is the weapon. Every one of these attacks needs you to act before you think. A genuine opportunity survives you sleeping on it.
- Type addresses yourself. Never reach a wallet or exchange through a link in a message, email or advertisement. Bookmark the real ones.
- If returns are guaranteed, it is a lie. Not a risky investment — a lie. No legitimate financial product guarantees returns.
If it has already happened
Move remaining funds immediately to a new wallet with a new recovery phrase, if there is any chance your keys were exposed. Attackers often wait.
Revoke permissions you granted to any application, using a token approval checker.
Report it. In the US, the FBI's IC3 and the FTC. In the UK, Action Fraud. In the EU, your national police cybercrime unit. In India, the National Cyber Crime Reporting Portal. Recovery is rare and reporting still matters — it builds the case that eventually reaches the operators.
Ignore every recovery service that contacts you afterwards. Legitimate asset recovery does not find you through a direct message, and does not ask for payment upfront. Victims are targeted twice more often than most people expect.
And tell someone. Shame keeps these operations working. The people who fall for these are not careless; they are targeted by professionals running a refined process, often over months.
The underlying point
None of these attacks are technically sophisticated. They do not break cryptography. They work on attention and emotion, which is why technical knowledge protects you far less than people assume, and why experienced holders are caught regularly.
The defence is procedural, not technical. Slow down. Verify through a second channel. Never let urgency set your pace.
This article is educational. If you believe you have been targeted, report it to the relevant authority in your jurisdiction.