2026 latest anti-fraud guide: How many currency scams do you know?

Author: Biteye "I've bought fake coins, fake NFTs, and aped into fake projects, but today is the first time I've played with a fake chain." The appearance of the fake GIWA mainnet last night should have made many people realize for the first time: it turns out that in crypto, even a "chain" can be fake. To some extent, this statement also points out the most terrifying aspect of scams in crypto today: scammers can always find a way to deceive you that you have never seen before. So this article starts with the fake GIWA mainnet and systematically sorts out the most common and most deceptive types of scams in crypto in 2026. I. X Scams 1️⃣ Fake project official websites | KOL reposts drive traffic to phishing sites At the time, Circle's Arc mainnet had not yet officially opened its official cross-chain, but scammers had already set up a fake cross-chain bridge called onbridge in advance and promoted it on X: "The Arc mainnet is now Live, and you can bridge USDC in directly now." The scammers even specifically bought KOL comment and repost services on third-party platforms. Some airdrop-farming and airdrop-related KOLs would directly reply and retweet under the scam post. When followers saw that "familiar people were also interacting," their vigilance naturally dropped, and they assumed this was an already-verified official entry point. In the end, users clicked the "cross-chain bridge" in the post, connected their wallets, authorized assets, and actually entered a phishing website. 💡 How to prevent it: Reconfirm all entry points through the project's official account, and ask AI whether all links are official links. 2️⃣ Fake recruitment/fake investment institutions | Business cooperation phishing These scams are essentially all the same: first approach you with a seemingly reasonable identity, then find a way to get you to run malicious files on your computer. Scammers may impersonate VCs, investment institutions, or project teams, chat with you about financing or cooperation, schedule meetings normally through Calendly or Google Meet, and finally suddenly say there is a problem with the meeting software and ask you to download a new Zoom, Teams, or Meet plugin. They may also impersonate Crypto or AI companies or headhunters, using recruitment as a pretext to have developers complete a Coding Test, download a project from GitHub or Bitbucket, and run the code. The earlier process is usually very normal, and the real attack is hidden in the last step: the meeting plugin, updater, Coding Test, or project code actually contains a Trojan. Once run, it may steal sensitive information such as browser cookies, Telegram Session, API Keys, wallet private keys, and seed phrases. Some scammers will build up for a long time, while others are more impatient and directly throw out a fake meeting link or GitHub project on first contact. 💡 How to prevent it: Never download or run meeting links or software sent by strangers. For business communication, try to use only official entry points you are familiar with, such as Zoom or Google Meet. If the other party insists that you switch platforms or install plugins, terminate immediately. 3️⃣ Hacked KOL accounts posting tokens / shilling This type of scam specifically targets influential KOLs, founders, and institutional executives in crypto. Scammers usually first send phishing links under the pretext of DMCA complaints, account anomalies, or security verification to trick the victim out of their X account. After obtaining the account, they immediately use the original account's influence to post Memes or promote projects, making followers mistakenly believe it is endorsed by the person themselves. Sometimes scammers even continue to host Spaces and reply to comments, acting even more like the real person. The X accounts of 0xSun, Professor Hash Wesley, and Nano Labs founder Kong Jianping were also hacked one after another, with almost the same routine: as soon as they got the account, they posted tokens and shilled, using the KOL's existing followers to quickly create trading volume, after which the token price went to zero. 💡 How to prevent it: If a familiar KOL suddenly posts a token, first confirm through other channels whether it is really them. II. Tg Scams 1️⃣ Impersonating Telegram friends | Fake accounts borrowing money / phishing Scammers will directly register a new Telegram account and copy your friend's avatar, nickname, and username style entirely, making it look almost identical to the real person. Then they proactively DM you, first making a few normal pleasantries, then saying they have an emergency and need to borrow U, change the receiving address, or ask you to help process a transfer. Some scammers will even study your relationship with the other person in advance, imitate the chat tone, and even know mutual friends, making the whole conversation seem more real. 💡 How to prevent it: Directly call or confirm through another commonly used channel that it is really them. 2️⃣ Telegram fake verification | Stealing verification codes to hijack accounts Scammers will impersonate Telegram official staff, group admins, or the Safeguard verification bot, telling you that your "account is abnormal," "login has expired," or "verification is required to join the group," then ask you to fill in a verification code, scan a QR code, or enter your two-step verification password. Once you hand over the verification code, the other party can log into your Telegram on their own device and further kick out other logged-in devices and change the two-step verification. After getting the account, they will not just steal your account. They will directly go through your contacts and client groups and start using your identity to ask others to lend U or send receiving addresses. 💡 How to prevent it: Never send verification codes, login QR codes, or 2FA passwords to anyone. III. Phishing Entry Point Scams 1️⃣ Fake Google official websites | Even the first search result can be fake Many people directly search Google when looking for Hyperliquid, MetaMask, or a project's official website. Scammers will prepare a phishing website almost identical to the official one in advance, then use search ads, SEO, and other methods to push the fake website ahead of the search results. When users see that they searched for it themselves and that it ranks very high, their vigilance is usually much lower than when receiving a strange link. In August this year, a user searched for Hyperliquid, clicked into the pinned fake official website, signed a malicious authorization in it, and ultimately had about 550,000 USDC stolen. 💡 How to prevent it: Try to enter official websites through the project's official X homepage; when unsure whether an account is real, first use XHunt to confirm the official account, then verify the domain. 2️⃣ Discord fake verification | Malicious authorization to steal assets Scammers disguise phishing entry points as normal Discord identity verification. After users join the group, they are asked to click Verify, then jump to a third-party website to connect their wallet. The entire page looks like ordinary "identity verification," but behind the scenes it is connected to a wallet Drainer. Once users connect and sign, scammers use the wallet's previous old authorizations left on protocols such as Morpho and Uniswap to directly transfer assets away. 💡 How to prevent it: If joining a group and verifying requires connecting a wallet or signing, first confirm the domain and the signing content. Do not blindly click confirm. 3️⃣ Fake airdrop emails | "You have an airdrop waiting to be claimed" Scammers send bulk emails that look very formal from project teams, telling you that you "qualify for the airdrop," "have tokens waiting to be claimed," or that "the Claim deadline is approaching." The logos, layout, and even sender names in the emails are made to look very official. After clicking Claim / Check Eligibility, you are redirected to a counterfeit project official website and asked to connect your wallet to check the airdrop. The website induces you to sign and authorize, while what is actually connected behind it is a Wallet Drainer; some are even more direct and ask you to enter your seed phrase or private key. 💡 How to prevent it: Try not to click Claim links in emails directly. For all information, rely on the project's official X account. IV. Wallet/On-chain Scams 1️⃣ Address poisoning | Copying a historical address and getting scammed Scammers specifically generate a wallet address very similar to your frequently used address, usually with almost identical first and last few characters. Then they transfer a very small amount to your wallet, or even directly transfer 0 U, in order to make this fake address appear in your on-chain transaction history. When you transfer funds next time, if you are used to copying an address directly from historical records and only checking the first and last few characters, it is very easy to mistake this fake address for your commonly used address. In the end, you will find that although you "copied a familiar address," the money was transferred to the scammer's wallet. 💡 How to prevent it: Transfer by scanning QR codes, and for large transfers, first send a small test transfer; do not copy addresses directly from historical records, and each time verify at least multiple characters at the beginning and end of the full address. 2️⃣ Fake mainnet / fake cross-chain bridge | Even the Chain ID is real The GIWA official team had long announced Chain ID 9134, but the mainnet has not actually officially launched yet, and there is no official RPC or official cross-chain bridge.Scammers exploited this information gap by directly setting up a fake "GIWA Mainnet": using the real Chain ID 9134, paired with a fake RPC and a fake cross-chain bridge. After users added the network to their wallets, they would find that the Chain ID matched perfectly, making it easy to mistake it for the official mainnet. As a result, this fake chain quickly spread within the community, and even a DEX integrated it, further enhancing its credibility. Many users, hoping to "front-run," bridged ETH into the so-called GIWA Mainnet. In the end, a total of 1,335 addresses transferred approximately 767.65 ETH to the fake mainnet, of which about 766.25 ETH was siphoned off by the scammers, resulting in losses of nearly $2 million. 💡 How to prevent it: Before front-running a new chain, only trust the RPC, Bridge, and contract addresses in official announcements. A matching Chain ID does not mean it is real. V. Device / Account Compromise 1️⃣ Malicious App | Poisoned update after normal listing FomoPeek appeared to be a normal on-chain monitoring tool, requiring no wallet connection and no seed phrase entry. The scammers first listed a normal version on the App Store, then mass-distributed invite codes through KOLs and airdrop groups, using "download and try it to get 5 U" to attract a large number of real users to install it. Once the install base grew, FomoPeek quietly added malicious code in a subsequent update, exploiting iOS vulnerabilities to read wallets, private keys, notes, and other sensitive information from the phone. 💡 How to prevent it: Do not casually install unfamiliar apps for a few U in rewards; important wallets must be isolated from daily phones, and devices that have installed suspicious apps should not continue to store large assets. iOS is not absolutely safe either, and both the system and apps should be updated to the latest version promptly. 2️⃣ Exchange Account Theft | Passing appeals with forged identity documents Attackers will collect the user's name, ID documents, phone number, transaction records, and other information in advance, then use forged videos, AI faces, or other social engineering methods to impersonate the victim and apply to the exchange for security resets such as "lost email" or "Google Authenticator unavailable." Once the review is passed, scammers may replace the email and 2FA with their own and create APIs, withdrawal addresses, or other long-term permissions in advance. Even if the user later recovers the account and changes the password and authenticator again, if these hidden permissions are not cleared at the same time, the assets may still be transferred away. As AI face-swapping, voice cloning, and forged materials become more widespread, several similar cases have already appeared this year. 💡 How to prevent it: Regularly check the exchange's APIs, withdrawal whitelist, login devices, and security settings. If anything abnormal is found, do not just change the password; the related permissions must be cleared as well. 🌟 Final Thoughts After reading these cases, you will find that what makes many scams truly formidable is not necessarily how advanced the technology is, but how well social engineering is done. Scammers exploit the scenarios you are already familiar with—acquaintances, KOLs, official websites, conferences, recruitment, verification processes—to lower your guard, then induce you to complete transfers, signatures, enter verification codes, download files, or run code. So rather than demanding that you never make a mistake, it is better to isolate risk in advance so that the cost of a single mistake is as small as possible. First, assume everyone could be a scammer. Even for acquaintances, partners, or KOLs, when it involves transfers or money, it is best to switch to another channel and confirm repeatedly. Do not skip verification just because "you know this person." Second, isolate devices and assets. Large assets and the main wallet should be kept on an independent device as much as possible, not used for daily chatting, meetings, downloading software, or running code. Third, do not click unfamiliar links directly. Whether sent by a friend, posted by a KOL, or found through Google, before clicking, check the domain, search for project announcements, or simply hand it to AI to help judge it first. Fourth, keep the system and commonly used software up to date. Once iOS, macOS, browsers, wallets, etc. release security updates, upgrade as soon as possible. Many attacks exploit vulnerabilities that are already public but have not yet been patched by users.