In 2024, Americans reported losing $9.3 billion to cryptocurrency fraud, according to the FBI's Internet Crime Complaint Center (FBI IC3, 2025) — a 66% jump from the year before, spread across nearly 150,000 complaints. Crypto's basic design is what makes it such an attractive target: there's no chargeback, no bank fraud department to call, and no central authority that can freeze or reverse a transaction once it clears. The patterns below aren't hypothetical; they're the specific schemes regulators are actively tracking right now, with numbers attached.
Pig Butchering: The Romance-Investment Scam Behind Most of the Losses
Investigators call it "pig butchering": a scammer builds a relationship with a victim over weeks or months, usually starting with an unsolicited message on a dating app or social media. Once trust is established, the conversation shifts to a "can't-lose" crypto opportunity on a slick, scammer-controlled platform. Early "withdrawals" often go through fine, to build confidence; then withdrawal requests get stuck behind a supposed tax or fee, and the scammer disappears.
The FBI attributes much of the $5.8 billion lost to crypto investment fraud in 2024 to this exact playbook (FBI IC3, 2025). Adults 60 and older were hit hardest, accounting for $2.8 billion in losses (FBI IC3, 2025). A tell: genuine crypto markets are volatile and choppy, not smooth — see understanding crypto market volatility for what price behavior looks like.
Rug Pulls: When the Project Itself Is the Scam
A rug pull happens when the people behind a token quietly drain its liquidity and disappear with investor funds. One widely reported example: the SQUID token, riding the popularity of the Netflix show with no actual affiliation to it, surged from around $0.01 to over $2,861 in days — then on November 1, 2021, the developers pulled the liquidity pool, draining roughly $3.38 million and collapsing the price to near zero, leaving more than 43,000 buyers holding tokens they could never sell (CBS News, 2021).
Rug pulls are almost exclusively a DeFi risk. Treat an anonymous dev team, an unlocked liquidity pool, and aggressive influencer promotion as a combined warning sign.
SIM Swapping: Your Phone Number Is the Attack Surface
A scammer convinces your mobile carrier to move your phone number onto a SIM card they control, intercepting SMS two-factor codes. In March 2025, an arbitration panel ordered T-Mobile to pay $33 million over a 2020 SIM-swap incident that let attackers drain over 1,500 bitcoin and roughly 60,000 bitcoin cash (SecurityWeek, 2025). The FBI and CISA advised the public in December 2024 to stop using SMS for 2FA entirely, recommending authenticator apps or hardware keys instead (Forbes, 2024).
Address Poisoning and Bitcoin ATM Scams
"Clipper" malware watches your clipboard and silently swaps a copied wallet address for an attacker's. Separately, Bitcoin ATM scams usually start with a caller impersonating the IRS or a bank, instructing the victim to feed cash into a nearby crypto ATM. Losses topped $65 million in just the first half of 2024, with adults 60+ accounting for about 71% of losses and a $10,000 median loss (FTC, 2024). No legitimate agency ever instructs payment via a crypto ATM.
Worth knowing: Before funding any "trading platform," run its name through the CFTC's free registration check tool, and cross-check it against FinCEN's MSB registrant search. Being unlicensed and unfindable in either database is a specific red flag the SEC's Investor.gov alert tells investors to check for.
The First-Time Buyer: Your biggest risk usually isn't a hacked wallet — it's being walked into a convincing fake exchange, often by someone you met online. Stick to platforms you can verify independently (see centralized vs. decentralized exchanges).
The Active DeFi User: Pig butchering matters less than rug pulls and address poisoning. Check whether liquidity is locked before connecting your wallet, and read what you're approving — a signed transaction can grant ongoing access to your funds.
| Scam Type | Red Flag | What To Do |
|---|---|---|
| Pig butchering | Online-only contact steers you to an app; withdrawals get stuck behind a "fee" | Stop sending funds; verify via CFTC check; never pay to unlock a withdrawal |
| Rug pull (DeFi) | Anonymous team, unlocked liquidity, heavy influencer promotion | Check liquidity-lock status independently |
| SIM swapping | Sudden loss of phone signal; locked out of accounts | Move 2FA off SMS to an authenticator app or hardware key |
| Address poisoning | Pasted address doesn't match, or a "dust" transaction appears | Verify the full address character-by-character before sending |
| Bitcoin ATM scam | Caller claims to be IRS/bank/police, demands crypto-ATM payment | Hang up — no agency demands this |
Run This Checklist Before You Send Any Crypto Today
- Verify the platform via the CFTC's registration check tool and FinCEN's MSB search.
- Verify the person if this started with a message from someone you haven't met in person.
- Move 2FA off SMS to an authenticator app or hardware key.
- Paste, then check — compare the full destination address character-by-character before confirming.
- If you've already sent funds, report it immediately at IC3.gov and to the platform involved.
