Crypto and DeFi: types of risks and scams

Practical guides

29 oct.

A job offer, a meeting invitation or a message from someone you have known online for months can lead to the same requests: install this app, sign here or send a little more money. The story changes, but the action you are asked to take often reveals the danger.

This guide groups scams by mechanism: manipulation, fraudulent investments, stolen access, harmful signatures and diverted transfers. It then separates losses without fraud from the steps to take after an incident. The first guide explains wallets, signatures and DeFi; the second covers practical precautions and incident response.

No article can cover every scenario, and an absence of warning signs does not establish safety. No product, provider or protocol discussed in our articles is endorsed by Token Expert.

1. How scammers approach you

Personal relationships and professional contacts

In romance and friendship scams, a person builds a relationship before suggesting a crypto investment. The conversations may continue for weeks or months. The person, their investment experience and the recommended platform may all be invented. Do not entrust money to someone you met online on the strength of that relationship alone; check the investment and platform separately and talk with someone you trust before paying. (1)

A supposed recruiter or client may borrow a company's name. Their goal may be to make you run a malicious GitHub project that steals wallet files or credentials, obtain a harmful signature, or persuade you to send funds to an address they control. Verify the assignment with the company through contact details you found independently before downloading, running software or paying anything. (2)

A message from a known contact on Telegram, Signal, WhatsApp, Discord or another messaging service deserves the same checks: the account may have been compromised or impersonated. Encryption does not establish that the person controlling the account is still your contact. For an unusual request, call the number you already had or use another known communication channel. (2)

Artificial intelligence tools can imitate a voice or face in a recording or video, known as a deepfake. Be increasingly cautious about what you see online, especially when it concerns cryptocurrencies or promises of getting rich quickly. Convincing images, videos and testimonials can be fabricated to deceive you. (2, 43)

Impersonation, fear and personal safety

Fake support agents use fear. They claim your account has been compromised and offer to move funds to a “safe wallet,” take remote control or check your recovery phrase. A supposed executive, official or relative may demand urgency and secrecy. Their goal is to obtain the funds or the access needed to take them. Never provide a recovery phrase or remote access; end the conversation and contact the official service yourself. (2)

Public balances, leaked identity documents and details about your investments can help a criminal choose a target and make a threat credible. They may seek to extort a transfer or force you to unlock a device. Limit public disclosures and avoid explaining where devices and physical copies of recovery phrases are kept. If threatened or coerced, put personal safety first and contact local emergency services as soon as you can do so without increasing the danger.

Verify the person independently

Verify unusual requests through contact details you already know or find independently. The phone number in the suspicious message is not an independent check. If someone is pressuring you, discuss the situation with a person you trust. Experienced users can be targeted successfully too.

2. Fraudulent investments and easy-money promises

Social media and promises of quick money

Be wary of offers that seem too good to be true. Social media posts, videos, ads, comments, private messages and group chats may promote a “secret method” for making money quickly. (43) High returns presented as guaranteed and risk-free are a warning sign. (42)

Imagine a video promising to double your deposit in a week using a trading bot. The presenter shows impressive profits, invites you into a private group and says you must deposit today to secure a place. In this hypothetical example, enthusiastic comments and the deadline are intended to replace your own checks. Do not send funds on that basis; take time to verify the offer and the people presenting it. (42, 43)

Fake mentors and investment groups use testimonials, profit screenshots and enthusiastic comments to make an offer seem credible. Those signs and follower counts do not establish that it is trustworthy. Verify the promoter’s identity and the investment through independent sources. Favour established, reputable platforms and investments, while remembering that a good reputation is no guarantee. (43)

Promises of AI, arbitrage or mining returns can be a pretext for deposits on a fake platform, software installation or wallet access. Fake celebrity endorsements and livestreams also offer to multiply the assets you send. Do not send money in order to receive more in return, or run a tool simply because a video recommends it. Check the offer through independent sources. (42, 43)

The Chainalysis statistics in the first guide show the scale of scams, distinguishing identified receipts from projections. (46)

Fake trading platforms and Ponzi schemes

On a fake trading platform, the dashboard can show invented trades and profits. A small withdrawal may be allowed to reassure you. Later, you must make another deposit or pay a “tax,” insurance charge or unlocking fee before withdrawing. The first withdrawal does not prove the investment is real. Stop additional payments and check the operator and terms independently; a business registration does not validate an investment. (1)

Instructions to withdraw cash and deposit it at a Bitcoin ATM may be part of the same scheme or a fake banking emergency. The supplied QR code may send assets directly to the scammer. Do not make the transfer; check the request with your institution through a known channel. In the United States, the IC3 received over 13,400 complaints involving these kiosks in 2025, with more than US$388 million in reported losses. Complaints may include other payment methods: the total is not exclusively money sent through kiosks, and it is not a Canadian statistic. (47)

In a Ponzi scheme, payments to participants come from new deposits rather than the advertised activity. Recruitment pressure and a strategy nobody can verify are warning signs. Ask for verifiable information about the activity and withdrawals; walk away if you are expected to rely solely on testimonials or recruit others to recover your money. (42)

Market manipulation and assets you cannot sell

In a pump and dump, organizers accumulate an asset with low liquidity, meaning it is difficult to buy or sell a sizeable amount without moving its price sharply. They then promote it in a group or on social media to attract buyers. Imagine a group announcing a coordinated purchase at 8 p.m.: organizers already bought at a lower price, then sell as new participants drive the price up. Momentum fades and later buyers bear the price decline. Avoid groups coordinating a price increase, promising a target price or dictating a buying time. A rising chart does not demonstrate lasting demand. (7)

Imagine buying a new asset with 200 USDC. The balance appears in your wallet and the chart rises, but selling fails: the contract may block your address or charge a fee that consumes almost all the proceeds. This is a honeypot. Before buying, check the exact contract, selling restrictions and administrator powers; abstain if you cannot assess them. A simulation or small buy-and-sell test may reveal a problem, but one successful sale does not guarantee another: rules can change or target particular addresses. Increasing gas does not bypass those restrictions. (35, 36)

In a liquidity rug pull, insiders withdraw the funds that enabled trading. A liquidity pool may contain the new asset and ETH. This reserve lets users swap one for the other: when you sell the new asset, you receive ETH from the reserve under the contract's rules. If those controlling the liquidity remove almost all the ETH, your balance can remain visible while selling it yields very little. Check who can withdraw liquidity, how much is actually available and any lock's conditions. A liquidity lock does not neutralize functions that mint assets or block sales. (35)

Avoiding less established assets or those with a questionable reputation can reduce these risks. Services such as GeckoTerminal and DEX Screener display security indicators on liquidity-pool pages. Depending on the asset and network, these may be a score or automated analysis results. GeckoTerminal offers the GT Security Score, which combines security and market-activity signals. (56, 57)

A failed sale alone does not prove fraud: low liquidity or an outage can also prevent a trade. Check the cause before repeatedly submitting transactions. A familiar name, rising chart or availability on a decentralized exchange does not establish that an asset passed a listing review. Warnings and automated checks have limits. (36)

3. Fake websites, stolen accounts and malicious downloads

Fake websites and account takeover

A copied website can look almost identical to the intended service. A similar domain or search ad can lead to a fake wallet, platform or malicious download. HTTPS means the connection is encrypted, not that the operator is honest. Use a verified bookmark or open the official app yourself, then review each signing request; the correct domain alone does not establish safety. (3, 25)

Phishing messages arrive through email, text, QR codes, calendar invitations or shared documents. A withdrawal alert or supposed tax document may lead to a fake login or harmful signature. A legitimate social account, group or website may also be compromised. Open the service independently to check an alert; confirm an unusual request from a contact through another known channel. (2)

Account takeover can also involve reused passwords, misleading authentication prompts or SIM swapping, which lets someone receive codes sent to your number. Use unique passwords and a passkey or security key where supported. Reject authentication requests you did not initiate and promptly investigate an unexplained loss of mobile service. (2, 22)

A video call that needs an unexpected “fix”

Imagine being invited to discuss a partnership. The invitation looks professional, but when you join, a page says your camera or microphone is not working. The person waiting for you suggests a “fix”: install an update, add an extension or paste a command into your computer's terminal. The terminal is a tool for running system commands, including commands that install programs or change files.

The problem may be staged. In a technique known as ClickFix, a fake error persuades you to run instructions yourself. You believe you are repairing the call; the instructions can download and launch malware. Granting a website camera access and running software on your computer are very different actions. (17, 23)

Another version uses a counterfeit video-call installer. It may open a plausible meeting or login window while stealing information in the background. Unit 42 researchers documented malware disguised as MiroTalk and FreeConference applications for Windows and macOS. The names were used as cover; this does not mean that the legitimate services were responsible. (18)

The situation pushes you to act quickly: the other person is waiting, the meeting seems important, and you want to fix the problem so the discussion can continue. If the “fix” requires unfamiliar software, system commands, your computer password or weaker security settings, step away from the call. Open the app you already use yourself. If an update is needed, obtain it from its official source, and verify the contact separately before rescheduling. Suggest meeting through your usual video-call service and send the new link yourself. If the person refuses and insists on using their own link at all costs, be especially cautious. (2, 17)

An application you are asked to test or review

Now imagine a potential client asking you to review a game, trading tool or DeFi application. You receive an archive or a link to a GitHub project. The instructions ask you to install the software components the project needs, called dependencies, then run the application on your computer before giving feedback. Payment or a job offer makes the request worth considering.

The critical step is allowing the project to execute on your computer. Running npm install, commonly used to install a project's dependencies, may also run installation scripts. The malicious part can therefore start before you launch the application or review its main features. The harmful code may be in a dependency or setup script rather than the file you were asked to inspect. (4, 19)

The development tool matters too. In Visual Studio Code, trusting an unfamiliar project can enable tasks and other features capable of executing code. Microsoft has documented recruitment attacks that abuse repository tasks. Reading a project does not require giving it permission to run: keep unfamiliar folders in Restricted Mode, and do not grant trust simply because the person sending the project says it is necessary. That mode limits certain execution paths; it does not certify the project or make an untrusted extension safe. (19, 20)

This is more than a hypothetical recruitment pretext. Fireblocks described a campaign impersonating its hiring process in which candidates were given a code-review assignment for a supposed poker application. The setup instructions, including dependency installation, triggered malicious code. The apparent seriousness of the interview did not make the project trustworthy. (21)

Before testing, verify the assignment with the company through contact details you found independently. Review what the setup will execute. If execution is justified, use an environment prepared for untrusted software, without personal files, private keys, recovery phrases, financial sessions or sensitive shared folders. For company equipment, involve the IT team. A separate browser profile does not isolate software running on the computer; a virtual machine also needs a suitable configuration. (2, 19)

A supplier compromise: the Ledger Connect Kit example

A supply chain attack reaches a service through a component it uses. On December 14, 2023, compromised publishing access enabled malicious versions of Ledger Connect Kit to be distributed through npm, a platform for distributing software components. Connect Kit lets applications interact with wallets. Legitimate applications loaded the malicious versions and presented transactions designed to take users' assets. Ledger stated that the integrity of its devices and Ledger Live was not affected. Similar incidents can recur through other software components. (48, 49)

Even the correct website can therefore present a harmful request. During a disclosed incident, suspend interactions with affected applications, independently verify official guidance and wait for confirmation of a fix. If you signed, inspect the approvals and transactions; disconnecting the site is not enough. Keep funds you are not using in a wallet that does not interact with those applications and reject requests you cannot verify. (6, 50)

What malware can expose

Depending on its capabilities and access, malware can steal credentials, active sessions, wallet files or API keys. A stolen session may let the attacker use an account without logging in again. Closing the wallet is not enough. Limit installations and, if you ran a suspicious file, isolate the device and secure accounts from a trusted one, as described in section 7. (18, 19, 23)

A hardware wallet keeps private keys away from the connected computer, so malware on the computer does not automatically steal them. It can still present a harmful transaction. Review the details on the device's screen and refuse to sign if the recipient, amount or permissions are unreadable or unexpected. (22, 41)

4. Malicious signatures and spending permissions

Some scams use a permission you grant rather than a stolen private key. The tools that exploit those permissions are often called wallet drainers. To understand the trap, separate three actions. Connecting a wallet shares your address with the site. Approving spending gives another address permission to move specified assets. Signing a message can authenticate you or authorize an action that happens later, depending on its contents. The site's button may call all three “verification.” What matters is the actual request in your wallet.

These examples concern Ethereum and compatible networks; other account models can work differently. ERC-20 is the standard defining transfers and spending approvals for many interchangeable assets, such as USDC. An NFT represents an individually identified asset, such as an item in a collection. (24, 27)

A small swap with an unlimited spending approval

Imagine wanting to swap 50 USDC. An application may need permission to move those USDC to complete the trade. An ERC-20 approval identifies an authorized address, often labelled spender, and a spending limit. Granting the approval is separate from making the swap: it does not necessarily move the assets immediately. (24)

A fake site instead asks for unlimited access to your USDC. You have 800 USDC and assume the approval covers only the advertised 50 USDC swap. If the authorized address can misuse that access, all 800 USDC may be taken. A later deposit of 300 USDC may also be exposed while the permission remains active. Standard ERC-20 approvals do not automatically expire when you close the page. Limit the allowance to the actual need and remove unneeded approvals; a 50 USDC swap does not justify unlimited access. (6, 24)

The permission applies to that asset, account and network; one USDC approval does not itself grant access to every other asset or network. Check the authorized address and cap, not just the site's name. A smaller cap limits exposure, but a fraudulent recipient can still take the amount you authorize.

“There is no fee: just sign in”

A message can genuinely be used to sign in. Sign-In with Ethereum, for example, identifies the requesting domain and account and includes information to prevent reuse of the login request. That authentication is different from granting spending rights. A page saying “prove you own this wallet” does not establish which kind of message it is requesting. (37)

Imagine a fake rewards page asking for a free signature. On an asset that supports a permit, the message may actually authorize an address to spend 999,999 USDC. A third party can submit the signed permission to the network and pay the transaction fee. The authorized address can then use the resulting allowance to move assets within its limits. You have not shared your recovery phrase or paid gas, yet you have granted access. Do not sign merely because the message is free: check the authorized spender and amount. (5, 25)

Permit2 manages some spending permissions through an intermediary contract. It first needs an ERC-20 approval for the asset concerned, which you may have granted during an earlier legitimate interaction. A later signature can authorize a particular application to spend through that contract. Depending on the request, the permission may cover a single transfer or repeated spending within an amount and time limit. Seeing a recognized Permit2 contract does not tell you that the requested spender or amount is appropriate. (26)

Look for the asset, authorized spender, amount and dates. In an ERC-2612 permit, deadline is the deadline for submitting the signature; it is not an expiry date for the resulting allowance. Signing now and seeing no immediate transfer does not mean the signature cannot be used later. (5, 29)

One NFT to check, permission over a whole collection

Imagine a page offering a free NFT upgrade. You expect it to check one item, but the wallet displays setApprovalForAll. Under the ERC-721 standard, that gives an operator permission to move all NFTs you hold from the specified collection, including ones you acquire later while the permission remains active. It does not cover every collection in your wallet, but its scope is already much wider than checking one item. Reject that approval if the stated purpose is only to check your NFT. (27)

A different trap uses a sale order. You already approved a marketplace contract during a legitimate sale. A fake page then describes a new signature as an identity check, while the signed order actually offers a valuable NFT for 0.001 ETH. If the order is valid and the required approval remains in place, it can be fulfilled without another confirmation from you. The marketplace contract may be genuine; the price and assets in the signed order are the problem. Before signing, check the NFT being sold, the price and the payment recipient. (28)

A recent case: old approvals over Bored Apes

In its analysis with a September 25, 2026 cutoff, Bitquery identified 11 addresses holding Bored Apes affected by transfers exploiting a marketplace contract flaw. They had granted approvals between February and June 2024 and had never revoked them. No new owner signature was needed. This illustrates a previously granted approval becoming exploitable, rather than a new signature obtained through phishing. (51)

Review and remove unneeded approvals even after you stop using a market. Its closure does not erase permissions recorded on the blockchain. Revocation can limit future transfers without undoing those already executed. (6, 51)

Permissions for repeated actions

Some wallets allow permissions for repeated actions. “10 USDC per day for 30 days” can authorize 300 USDC in total, without daily confirmation. Check the recipient, frequency, total amount, end date and how to withdraw the permission. These delegated permissions work differently from a basic ERC-20 approval. (38)

An unexpected reward that sends you elsewhere

Imagine an unsolicited NFT promising a 2,000 USDC reward. Its image or description links to a page asking you to “activate” the reward. The next request may be an approval, a harmful signature or a demand for your recovery phrase. The NFT is an advertisement for the trap, not proof that a reward exists. Fake migrations use similar pressure: act before a deadline or supposedly lose access to your assets. (30)

Receiving an unsolicited asset does not itself give the sender permission to spend your other assets. Avoid following its instructions or using the linked site to sell, exchange or burn it. You can hide an unwanted item in the wallet interface without accepting a transaction suggested by its sender. (30)

Check the scope before accepting

Describe the result in plain words: “this address can spend this much of this asset” or “this NFT can be sold for this amount.” Then compare that result with what you intended:

The action: a login, transfer, spending permission or sale order?
The scope: which account, network, asset or NFT collection?
The recipient and limits: who gets authority, how much, and for how long?
The expected result: what leaves, what comes back, and to which address?

If the request is unreadable or does not match the intended action, reject it rather than guessing. An AI tool may help explain the public information in a request, but it can make mistakes and cannot guarantee that the request is safe. Use the official service and never share a private key or recovery phrase with it. A wallet warning or simulation can help, but an absence of warnings does not validate the request. A hardware wallet protects its keys; it still needs you to check the authorization. (22)

5. Transfer traps and compromised keys

Look-alike addresses and clipboard malware

Imagine sending funds to your own exchange deposit address. Later, you copy what looks like the same address from your transaction history. A scammer has inserted a tiny or zero-value transfer involving an address with matching first and last characters. You confirm a new transfer, but it goes to the scammer. This is address poisoning: the earlier entry plants a convincing address for you to copy. It does not itself authorize a withdrawal. (16, 31)

Clipboard malware changes the address after you copy it. You copy the correct deposit address from the exchange, paste it into the transfer form and unknowingly get a different destination. This route involves software on the device, so it connects with the download scams above. (32)

Retrieve the destination independently, such as from your authenticated exchange account, and verify the complete address after pasting and again before confirmation. Check the destination on the hardware wallet's own screen when it displays it. Comparing only the beginning and end is exactly the shortcut that a look-alike address exploits. (31, 32)

A stolen recovery phrase

A recovery phrase can recreate several private keys; it is different from an individual key. Its physical copy, such as the words written on paper, contains the same information and must remain secret. (55)

Never share your recovery phrase with another person or service. A fake alert or supposed support agent may request it to “verify,” “synchronize” or “restore” your wallet. Entering it on their page can expose the relevant private keys and let an attacker move the funds they control without having your hardware wallet. Changing the wallet app password or revoking a spending approval does not remove that access. Restoring a wallet is a separate operation, performed in wallet software or a device you have independently verified, not a requirement for claiming a reward. (34)

A recovery phrase offered as free money

Another lure reverses the request: someone gives you a recovery phrase. Imagine seeing 1,000 USDT with too little ETH for fees. You add ETH, but an automated sweeper bot takes it before you can use it. The visible balance is the bait. Do not fund the wallet to test it or race the bot: other people have the same access. (33)

6. Protocols, markets and lost access

A genuine service can have a vulnerability, and a position can lose money even when the software works as intended. Understanding the cause helps you judge which precautions are relevant.

Before committing funds, identify what the position depends on, how you could exit and what loss you could afford. Protecting your keys and checking for an audit only address some of these risks. Careful checks can reduce DeFi risks, but cannot eliminate them.

Contracts, operators and shared dependencies

Contract flaws. Coding, accounting or integration errors can release, freeze or misallocate funds. An audit covers a particular scope and version; vulnerabilities may remain. Check the audited version, report qualifications and subsequent changes; limit exposure because an audit cannot cover everything. (9)
Administrative powers. Some keys allow the contract's code to be replaced; emergency controls may pause functions such as withdrawals. If a few people hold enough votes or signatures to decide on their own, their mistakes or compromised access can affect all users. (9) Review who can change the rules, any implementation delay and whether you can withdraw before a change; reduce exposure if these powers are poorly explained.
Oracles and connected services. An oracle supplies information to a contract, such as prices for assets deposited as collateral. Incorrect or manipulated data can make that collateral appear insufficient and trigger liquidation: a forced sale to repay the debt. A service outage can also disrupt the contract that depends on it. Check where prices come from and what happens during an outage; avoid borrowing if you cannot assess the consequences of bad data. (11, 52)
Bridges and wrapped assets. A wrapped asset represents another asset held in a contract, on another network or by a custodian. Failures in custody, validation or backing can undermine that representation. (10) Identify the backing and how to redeem the underlying asset; limit the amount and time exposed when an exit depends on a bridge.
Network disruption. Congestion, high fees, outages or censorship can delay withdrawals. Some networks use a sequencer, a service that determines transaction order. If it fails or delays a request, your withdrawal or loan repayment may also be delayed. Allow a margin for fees and avoid positions that need an urgent transaction to remain viable. A different website does not bypass a network outage.
Custodians and shared dependencies. A company holding assets can block withdrawals or fail. Several investments may also depend on the same issuer, oracle, bridge or operator, exposing them to the same failure. Identify common dependencies before assuming your investments are diversified. Keep records outside the platform and limit reliance on one operator.

Prices, loans and trade execution

Volatility and liquidation. Collateral can lose value while the debt remains. A position may be forcibly sold before you can get a transaction included on the network. (11) Use less leverage, retain a collateral margin and set alerts; do not count on a last-minute deposit during congestion.
Stablecoins. These assets target a reference value, such as one US dollar per unit, but their price can diverge from it. Reserve quality, redemption rights and issuer restrictions matter; a reference to the dollar does not guarantee your capital. (12) Review published reserves, redemption terms and your actual eligibility to redeem; avoid treating all stablecoins as one risk category.
Liquidity and slippage. Liquidity is the funding available for trades. A trade that is large relative to those funds can move the price against you: this is price impact. Slippage is the difference between the expected price and the price obtained at execution, for example when other trades execute before yours. Review the minimum amount you will accept and set the tolerance accordingly. Increasing it to force a trade through without examining the outcome may worsen the loss. (13, 53)
Transaction ordering. Maximal extractable value, or MEV, includes profits obtained through transaction ordering or inclusion. In a sandwich attack, an actor may buy an asset just before your purchase and sell it afterwards. The surrounding trades profit from the price movement and may leave you paying more. (15) Limit slippage and assess the service's MEV protections. They may reduce some attacks without guaranteeing a price.

Risks attached to yield strategies

Liquidity pools. Pools combine users' funds to enable trading. In some two-asset pools, trades change the quantities making up your deposit. As prices move, your share may become worth less than the original assets would have been worth if you had simply held them: this difference is called impermanent loss. Fees may not make up the difference, and “impermanent” does not promise that it will disappear. (13, 54) Compare the two outcomes and check withdrawal conditions before depositing.
Staking and restaking. Staking commits assets to help secure a network. Depending on the arrangement, risks include penalties, deductions from staked assets known as slashing, operator failures, withdrawal delays and contract vulnerabilities. Restaking uses staked assets to secure additional services, adding conditions and possible losses. (14) Check the operator, penalty rules, additional services secured and exit delays; keep funds you may need soon outside these strategies.

Mistakes and lost access

A lost key, forgotten passphrase, unavailable signer or poorly prepared inheritance plan can make funds inaccessible. Test recovery before holding substantial amounts, keep physical copies of recovery phrases in separate locations and arrange a replacement signer or suitable multisig procedure. For transfers, check the network, full address and required memo; a small test can limit the amount exposed to a mistake without guaranteeing the next transfer. Recovery options depend on the system and recipient involved.

7. What to do if you suspect an incident

If you suspect an incident, stop further payments and signatures and preserve evidence. Describe what you shared, installed, signed or paid, rather than only saying that you were “hacked.” Follow the incident-response section of the security guide to assess the exposure and the next steps. Do not accept a new “verification” request from the same person offering to fix the incident.

If you ran unfamiliar software

Stop using the affected device for financial activity and disconnect it from the network. Preserve the invitation, messages, filenames and time of execution, then coordinate the response from another trusted device. Deleting the app or obtaining a clean antivirus result alone does not prove the incident is resolved. (2, 19)

If you granted a spending approval

Disconnecting the site does not revoke spending permissions. For ERC-20 assets and NFTs, you can inspect and revoke active approvals through a service such as Revoke.cash or approval-management features in wallets such as Rabby Wallet. Find the tool's official website independently or open the extension already installed. Select the affected account and network, and check that the revocation transaction was confirmed. The revocation transaction incurs network fees; it does not recover assets already transferred. (6, 39, 40)

If you signed a message or sale order

An unused signature needs separate attention. Because it was signed off chain, it may not appear in an approval list yet. Depending on the mechanism, it may need to be invalidated or the relevant order cancelled; reducing a current allowance to zero does not universally cancel a still-valid signed permit. The response depends on what you signed. Preserve the message details and transaction references, without disclosing private keys or recovery phrases. (5, 28, 29)

An empty approval list therefore does not establish that every risk is gone.

If your keys or recovery phrase were exposed

Stop new deposits to the affected addresses and assess all accounts controlled by the exposed keys. Do not add funds merely to pay network fees without assessing the risk: a sweeper bot may take those deposits too. Protecting remaining assets requires addressing the compromised keys, not just revoking approvals. (33, 34)

Rabby Wallet’s GasAccount offers another way to pay those fees: you deposit USDC into an account with the service, separate from the compromised address’s balance, then select that payment method in Rabby. You can then request a transfer without sending the crypto needed for fees to the address yourself. This may help move remaining assets to a new wallet created with different keys, where the network, account and transaction are supported. (44)

GasAccount does not guarantee that you can beat a sweeper bot. The service may send the crypto needed for fees, such as ETH, to the address before your transaction executes, so that funding can be swept too. This kind of failure has been documented on an address containing malicious code. Assess the situation before committing more funds. (44, 45)

In that test, the malicious code allowed transfers without a fresh owner signature. This mechanism does not necessarily involve a stolen key: an earlier authorization had associated that code with the account. It is a specific case and does not establish that every recovery attempt using GasAccount will fail. (45)

Get help and preserve records

After a loss, recovery scams may follow. A supposed investigator, lawyer or hacker promises to retrieve funds for an advance fee or wallet access. The original fraudster may return under another identity. Verify qualifications and the engagement independently, reject guaranteed recovery promises and never provide a recovery phrase. Preserve evidence and contact authorities and relevant providers through verified channels. (8)

Save messages, URLs, transaction references, addresses and timestamps, without including private keys or recovery phrases in a public report. Complete records also help with accounting, tax compliance and investigating the loss.

Sources

Original sources consulted on October 28, 2026. The technical scam scenarios were expanded using sources checked on October 29, 2026. Examples introduced with “imagine” are hypothetical, including all amounts and sale prices; named research cases are identified separately. References are explanatory and do not constitute endorsements.

ScamsPhishingDeFi risks

Dominic Nadeau