Why scams work in DeFi
Anyone can deploy a token or a website in minutes, with no gatekeeper. Transfers are final: there is no bank to call and no chargeback. Scammers combine that with urgency, because a rushed user skips the checks that would have exposed them.
The good news: the tricks repeat. Learn the patterns below and most scams become easy to spot. One red flag is a reason to slow down. Two or more is a reason to walk away.
Eight red flags
1. Yield nobody can explain
Fixed high returns, "guaranteed" or "risk-free", with no clear source such as trading fees or borrower interest.
Example: Anchor Protocol paid close to 20% on UST deposits. When the subsidy ran out, UST lost its peg in May 2022 and the Terra ecosystem collapsed.
2. Rug pull setup
A new token whose liquidity the team can withdraw at any time, with most of the supply in a few wallets.
Example: The SQUID token, launched on the back of a TV series in 2021, rose sharply before its creators pulled the liquidity and vanished.
3. Honeypot token
You can buy but not sell, or a sell tax takes most of what you sell. Charts only go up because nobody can exit.
Example: Honeypots launch daily, usually copying a trending name or a well-known ticker.
4. Look-alike website
A perfect copy of a real app on a slightly different domain, reached from an ad, a search result or a DM.
Example: Fake swap and wallet sites ask for an approval or a permit signature that hands your tokens to the attacker.
5. Free airdrop or claim
Tokens you never bought appear in your wallet, often with a website in their name, or a post urges you to "claim now".
Example: The claim page asks you to connect and sign, and the signature is a drainer approval.
6. Address poisoning
A zero-value transfer in your history from an address that starts and ends like one you use.
Example: The attacker hopes you copy the fake address from your history the next time you send funds.
7. Helpful strangers
Someone replies to your public question and offers support by DM, or an "admin" contacts you first.
Example: The "support" link leads to a page that asks for your seed phrase to "validate" your wallet.
8. Pressure and secrecy
Countdown timers, "first 1,000 users", unverifiable team, no audit, contract source not published.
Example: Wonderland collapsed in 2022 after its pseudonymous treasury manager was revealed to have a criminal fraud history.
Spotting a bad token before you buy
Many of these scams end with a token you cannot sell. A few quick checks catch most of them:
Can it be sold?
Look for sells in the token's recent transactions from many different wallets, not just buys. A chart with no red candles is a warning, not a signal.
What are the taxes?
A buy or sell tax is taken from every trade. Anything above a few percent eats your position, and a tax the owner can change can be raised to 100% at any time.
Who holds the supply?
If a handful of wallets hold most of the supply, or the team can pull the liquidity, one sale can crash the price.
Is it the real contract?
Copy the address from the project's official site or docs and compare it in full. Scam tokens reuse real names and tickers.
Token safety checks covers honeypots and taxes in depth, and verifying smart contracts shows how to read a contract on a block explorer.
What ChainBridge checks for you
Before a swap, ChainBridge runs a GoPlus security check on both tokens and checks the route itself. Some findings block the swap outright; others need your explicit acknowledgement.
| Check | Result |
|---|---|
| Honeypot or unsellable token | Swap blocked |
| Sell tax above 10% | Swap blocked |
| Owner powers (mint, pause, blacklist, changeable tax, upgradeable proxy, unverified source) | Warning; you must acknowledge the risk to continue |
| Token imported by contract address | Not-in-list warning, with the security check shown before import |
| Imported token with a look-alike name or symbol, or a known scam address | Warning on the swap card; swapping is disabled |
| Router or spender not on the contract allowlist | Route rejected |
| Transaction would revert in simulation | Swap blocked |
Ten-point checklist before you trade
- Open apps from your own bookmarks, never from ads, search results or DMs
- Copy token addresses from the project's official site and compare them in full
- Check that the token can be sold and what its taxes are
- Ask where the yield comes from; if nobody can say, assume new deposits pay it
- Read every approval and signature request before you sign
- Try a new protocol with a small amount first
- Ignore tokens and NFTs that appear in your wallet unasked
- Never share your seed phrase or private key, with anyone, for any reason
- Keep savings in a hardware or multisig wallet that never connects to new apps
- Walk away from anything that pressures you to act now
If you get scammed
Act fast: drainers often come back for whatever is left.
Revoke approvals
Revoke every approval the scam could use. The approvals page covers the swap contracts ChainBridge knows; use Revoke.cash or your block explorer's approval checker for the rest. See the token approvals guide.
Move what is left
Send remaining funds to a new wallet with a new seed phrase. If the seed phrase leaked, revoking is not enough: the old wallet is lost for good.
Write everything down
Save the site URL, the addresses, the transaction hashes and a timeline. You will need them to report it.
Report it
Report the addresses to the block explorer and the platform where you met the scam, and file a report with the police or the relevant authority in your country.
Beware of recovery scams
Victims are targeted again by people promising to recover funds for a fee. Nobody can reverse an on-chain transfer.