How to Spot Crypto Scams and Rug Pulls — Beginner's Guide 2026

Verify the token contract on Etherscan before you buy

Open Etherscan (a block explorer that shows every Ethereum transaction and token contract) and paste the token's contract address into the search bar. Look for the blue checkmark badge next to the contract name — it means the source code is public and readable.

If you see a red warning icon or a message saying "This token has a poor reputation score," do not buy it.

Over 300,000 scam tokens have been created since DeFi began, defrauding more than 2 million investors — more victims than the FTX, Celsius, and Voyager collapses combined, according to Solidus Labs research.

Pro tip: Scroll down to the "Comments" section on the token's Etherscan page. If multiple users have posted "SCAM" warnings, believe them. One investor ignored those warnings and lost several hundred dollars.

Check the liquidity lock and holder concentration on DexTools

Go to DexTools (a platform that tracks decentralized exchange data) and enter the token address. Check the "Liquidity" section. If the liquidity isn't locked for at least 12 months, the developers can withdraw all funds and disappear at any moment.

Then check the "Holders" tab. If one wallet holds more than 5-10% of the total supply, that single person can dump on you and crash the price to zero. Rug pulls drained an estimated $1.8–2.8 billion in 2025, according to NFT Plazas tracking, and 62% of meme coins launched that year were flagged as potential scams within 30 days.

Pro tip: On DexTools, click the "Top Holders" list. If the top 10 wallets control over 50% of supply, walk away immediately.

Move your funds to a non-custodial hardware wallet for storage

Download a non-custodial wallet like MetaMask (a browser extension wallet where you control your private keys) for small active balances. Store the majority of your crypto on a hardware wallet like Ledger or Trezor (physical devices that keep your private keys offline).

Never leave large amounts on an exchange — exchanges are custodial, meaning they hold your keys, not you. In 2025, about 70% of attacks targeted the human factor, tricking users into giving up access, rather than hacking the underlying blockchain technology.

Pro tip: When you set up your hardware wallet, write your 24-word recovery phrase on paper with a pen. Never type it into any computer, phone, or app. Store that paper in a safe or bank deposit box.

Enable 2FA with an authenticator app, not SMS

On every exchange account (Binance, Coinbase, Kraken), go to Security Settings and enable Two-Factor Authentication using Google Authenticator or Authy (apps that generate time-based codes). Skip SMS for 2FA — SIM card hijacking caused approximately $410 million in losses in 2025, according to CoinLaw estimates.

Use a password manager like Bitwarden or 1Password to generate and store unique, 20-character passwords for each platform. Never reuse passwords across sites. Phishing attacks caused $306 million in losses in Q1 2026 alone, per Hacken data.

Pro tip: On Binance, set up an "Anti-Phishing Code" — a custom word that appears in every legitimate email from them. If an email lacks that code, it's a phishing attempt.

Never share your seed phrase or private key with anyone

Your seed phrase (12 or 24 random words) is the master key to your wallet. Anyone who has it can take every coin you own, permanently, with no reversal. No legitimate platform, wallet, or customer support agent will ever ask for your seed phrase.

If someone sends you a direct message on Telegram, Discord, or X claiming to be "support" and asks for your phrase, block and report them immediately. The FBI IC3 reported $9.3 billion in crypto-related losses in 2024 alone, with projections exceeding $17 billion for 2025, and impersonation scams surged 1,400% year-over-year.

Pro tip: Bookmark the official URL of every exchange and wallet you use right now — type it once, save it, and never click crypto links sent through messages. Scammers create fake sites like "Blnance.com" instead of "Binance.com" — one letter difference can cost you everything.