Crypto security: avoiding scams & rug pulls

Most crypto losses come from human mistakes and scam projects — not broken blockchains. A handful of habits will protect you from the vast majority of them.

Protect your wallet first

• Never share your seed phrase (recovery words) with anyone, ever. No real service will ask for it.
• Store the seed phrase offline, on paper — never in a screenshot, email or cloud note.
• Use a hardware wallet for larger amounts.
• Double-check website URLs; bookmark the real ones to avoid fakes.

What is a rug pull?

A rug pull is when a token's creators drain its liquidity or dump their holdings, crashing the price to near zero. Warning signs: unlocked liquidity, a team holding most of the supply, anonymous founders with big promises, and a brand-new token with sudden hype.

What is a honeypot?

A honeypot is a malicious token you can buy but cannot sell — the contract blocks selling for everyone but the creator. Always check that a token is sellable (use a token-safety scanner) before buying, and prefer tokens with verified, open-source contracts.

Checklist before buying a token

• Is the contract verified on the block explorer?
• Is liquidity locked, and for how long?
• Has the owner renounced the contract (no hidden mint/blacklist)?
• How is the supply distributed across wallets?
• Is there a real community and use case?

If you are creating a token: build trust

The same signals that protect buyers make your project credible. Use a verified contract, keep your token immutable & ownerless by default (or renounce ownership), and lock liquidity after launch. Our token creator deploys open-source, verified contracts that are rug-proof by default.

Golden rules

• If it sounds too good to be true, it is.
• Never invest more than you can afford to lose.
• Verify, then trust — never the other way around.
• Slow down: scams rely on urgency.

The blockchain is secure — you are the target

Here is the most important security insight: the blockchain itself is extraordinarily secure and is almost never the thing that gets “hacked.” Nearly all crypto losses happen at the edges — where you, your wallet and apps meet the chain. Scammers cannot break the blockchain, so they target people instead: tricking you into revealing your seed phrase, approving a malicious transaction, or buying a worthless token. Once you internalise that the danger is social and behavioural rather than technical, you start protecting the right things. We cover this in depth in blockchain security explained.

The common scams to recognise

Most scams fall into a few recognisable patterns. Knowing them is half the defence:

• Phishing. Fake websites, messages and “support” designed to trick you into entering your seed phrase or connecting to a malicious site. The most common attack of all.
• Fake support and impersonation. No real support will ever DM you first or ask for your recovery phrase. Anyone who does is an attacker.
• Malicious approvals. Some sites request token approvals that let them drain your wallet. Read what you sign, and revoke approvals you no longer use.
• Fake airdrops and giveaways. “Send X to receive Y” and “connect to claim” schemes that steal funds or approvals.

The thread through all of these is that they target your behaviour, not the technology. Guarding your wallet and seed phrase, and verifying before you trust, defeats the vast majority of them.

Security when you launch a token

If you create a token, security cuts both ways — you must protect yourself and prove your project is safe to others. The trust signals buyers look for are a verified contract (so anyone can confirm there is no hidden mint or freeze function), locked liquidity (proving you cannot pull the rug), and a transparent, sanely-distributed supply. Building these in from the start is what separates a project that looks legitimate from one that looks like a scam — and it is the same transparency that protects your community.

Frequently asked questions