Crypto Scam and Drainer Guide

Most crypto theft does not break any cryptography: it persuades the owner to sign, approve or send something they do not understand. The FBI's Internet Crime Complaint Center (IC3) recorded 181,565 cryptocurrency-related complaints and losses of $11,366,669,732 in its 2025 Internet Crime Report, with cryptocurrency investment fraud alone accounting for $7.2 billion. This guide explains the main scam and wallet drainer patterns at a level useful for defence, then sets out controls for individuals holding their own keys, organisations running treasury wallets or crypto-facing brands, and banks whose customers are pushed into paying scammers. It covers reporting routes, the recovery-scam trap that follows most losses, metrics and a framework mapping. It deliberately does not describe how drainer kits or exploits are built.

Key takeaways

• Signatures are the attack surface. An unlimited token approval or an off-chain permit signature can hand a stranger the right to move tokens later, with no further prompt to the owner.
• Self-custody removes the safety net. Blockchain transfers are typically irreversible, and most UK crypto activity sits outside the Financial Ombudsman Service and the FSCS, so prevention matters far more than recovery.
• Investment fraud dwarfs technical theft. Long-con scams that start on dating apps, social media or text messages cause the largest losses, and they are fought with payment friction and intervention, not wallet features.
• Organisations need signing governance, not just good keys. Multisig and hardware signers only work if signers check what they are actually approving, as the Bybit theft showed.
• Every victim becomes a recovery-scam target. Anyone offering to recover lost crypto for a fee, especially claiming government links, is the next stage of the fraud.

The scam and drainer landscape

Crypto fraud falls into two families. Persuasion scams convince a victim to send funds voluntarily, often over weeks. Drainer and approval attacks trick a wallet owner into a signature that gives an attacker spending rights.

IC3's 2025 report attributes $7.228 billion to 61,559 cryptocurrency investment fraud complaints, $389 million to 13,460 complaints involving crypto ATMs and kiosks, and $17,366,758 to 971 SIM swap complaints. It describes how "The victims are enticed to send cryptocurrency to fake investment scam platforms or apps and are shown fake profits." Drainers are smaller in money terms but industrialised: the blockchain security vendor ScamSniffer reported, in its own 2024 research, $494 million stolen by wallet drainers from 332,000 addresses, with permit signatures the most common phishing signature type it observed.

How approvals, permits and drainers work

• Approvals: the ERC-20 token standard lets an owner approve a third-party address (a "spender") to move up to a set amount of a token, which the spender later collects with transferFrom. Applications rely on this. MetaMask's documentation notes that approvals often request "unlimited access to your tokens", and a malicious or exploited spender can "theoretically drain your wallet of the tokens you've allowed access to."
• Permit signatures (EIP-2612): a permit grants the same allowance through an off-chain signed message containing the owner, spender, value, a nonce and a deadline, formatted as EIP-712 typed data so wallets can display it readably. Anyone holding the signature can submit it. A free message that looks like a log-in can therefore authorise spending.
• Blind signing: where a wallet or device cannot decode a request, the user signs an opaque hash. After the Connect Kit incident Ledger argued that "clear signing, as opposed to blind signing, will help mitigate these issues."
• Drainer-as-a-service: criminal groups rent ready-made drainer kits to affiliates, who supply traffic and share proceeds with the operator. ScamSniffer names families such as Inferno, Pink, Angel and Acedrainer, and lists lures including compromised official Discord and X accounts, front-end or supply chain attacks, fake airdrops and paid search and social ads.
• Supply chain drainers: on 14 December 2023 a phished former Ledger employee's npm account was used to publish tampered Ledger Connect Kit versions which, in Ledger's words, "used a rogue WalletConnect project to reroute funds to a hacker wallet." Ledger says the file was live for around five hours. Publishing credentials for wallet-facing code are high-value non-human identities.

Defences for individuals

These wallet features and habits block most drainer and transfer mistakes. They are offered by many wallets; no product is endorsed.

• Separate wallets by purpose: keep holdings in a hardware wallet that never connects to unfamiliar applications, and use a low-balance hot wallet for mints and airdrops.
• Read every signature: treat any request mentioning approve, permit, setApprovalForAll, increaseAllowance or an ownership change as a spending authorisation. If the wallet cannot show what a request does, do not sign it.
• Cap and revoke: replace "unlimited" approvals with the amount needed, and review approvals monthly using the wallet's allowance view or a block explorer's approval checker. Revocation is an on-chain transaction that costs gas; it stops future use but does not return tokens already taken. Disconnecting a site is not revoking.
• Heed simulation and warnings: many wallets simulate expected balance changes and flag known phishing domains. MetaMask, for example, shows a blocking warning when a destination's first and last four characters match a previous address but the middle differs.
• Beat address poisoning: never copy a destination from history; use the address book, check the middle characters and confirm on the hardware wallet screen. MetaMask notes that poisoning "relies on user carelessness and haste above all else."
• Protect exchange and email accounts: use passkeys or a hardware security key instead of SMS, set a withdrawal allowlist with a delay for changes, and ask the carrier for SIM change protection. The FBI's SIM swap advisory adds: "Do not advertise information about financial assets, including ownership or investment of cryptocurrency". See the Hardware Security Keys Guide.
• Never share a seed phrase: "support" that arrives by direct message after a public question is a scam. See the Phishing Guide and the Vishing and Smishing Guide.
• Apply the FTC's rules of thumb: "Only scammers demand payment in cryptocurrency", "Only scammers will guarantee profits or big returns" and "Never mix online dating and investment advice."

Defences for organisations holding crypto

The FBI attributed the theft of approximately $1.5 billion in virtual assets from Bybit, on or about 21 February 2025, to North Korea's "TraderTraitor" activity. The Bybit hack began with a wallet software developer's AWS session tokens and ended with multisig signers approving a transaction presented through a tampered web interface: the keys were safe, the signing process was not.

Treasury wallet governance

• Tier the wallets: cold, warm and hot wallets with value limits per tier and a documented refill process.
• Require m-of-n approval: multisig or multi-party computation (MPC) so no single person or device can move funds, with signers in different teams.
• Verify outside the interface: each signer checks destination, amount, contract call and any owner or module change on the hardware device or a separate verification tool, not only in the application that proposed it. Ban blind signing on treasury wallets.
• Dedicated signing devices: no email, chat or general browsing on signer machines.
• Encode policy: destination allowlists, transaction and daily limits, time locks on large movements and waiting periods for changes to signer sets or thresholds.
• Govern approvals and keys: inventory allowances granted from corporate wallets, cap and revoke them, run documented key ceremonies and remove signers on role change. Ledger's post-incident letter stressed that "Any employee who leaves the company has their access revoked from every Ledger system." See the Cryptographic Key Management Guide.

Custody models compared

Small organisations usually do best with a qualified custodian or a simple multisig with hardware signers and a written signing procedure. Larger operations need policy engines, segregation between those who propose and those who approve, and continuous wallet monitoring.

Brand impersonation and corporate social accounts

Fake airdrops and giveaways are pushed through look-alike domains, cloned apps, paid ads and, most effectively, genuine accounts that have been taken over.

• Publish a single source of truth: one official page listing genuine domains, social handles, contract addresses and support channels, stating that staff never message users asking them to connect wallets or share seed phrases.
• Monitor and take down: watch for look-alike domains, cloned app listings, fake accounts and ads using the brand, with an agreed takedown process, and report confirmed phishing domains to wallet and browser blocklists. See the DNS Security Guide.
• Expect synthetic endorsements: fake celebrity and executive videos are common in investment scam ads. See the Deepfake and AI Impersonation Guide.

Where identity fits

A hijacked corporate X, Discord or Telegram account is an identity failure with a fraud payload. Treat social accounts as privileged systems.

• Phishing-resistant sign-in: passkeys or hardware security keys on every admin, no SMS second factor or recovery, and the same controls on recovery inboxes. See the Account Takeover Prevention Guide.
• Named admins: role-based business access with named individuals, no shared passwords, and quarterly removal of dormant moderators and former agencies.
• Govern connected apps and bots: scheduling tools and community bots hold OAuth grants and bot tokens that can post as the brand. Inventory, scope and revoke them. See the SaaS and OAuth App Governance Guide and the API Key Management Guide.
• Harden recovery: attackers target platform support and recovery flows, as the Meta AI Instagram account takeover showed. See the Account Recovery and Help Desk Security Guide.
• Prepare a hijack playbook: platform contacts, a way to warn followers on other channels, and steps to delete scam posts and check for new admins, apps and changed recovery details.

Controls for banks and payment firms

Most investment scam victims fund the fraud from a bank account, usually by buying crypto on an exchange account in their own name and sending it on.

• Risk-score crypto-bound payments: first payments to an exchange, rapid value increases, new payees after a changed phone or device, and older customers moving savings are strong signals. Apply proportionate friction: dynamic warnings, cooling-off holds and a human conversation for the highest risk. See the Authorised Push Payment (APP) Fraud Guide.
• Ask scenario questions: "Has someone you met online recommended this investment?" works better than a generic confirmation, because scammers coach victims to dismiss warnings.
• Understand reimbursement scope: the UK Payment Systems Regulator's mandatory APP reimbursement rules (in force since 7 October 2024) cover payments to accounts controlled by someone else; transfers to a customer's own exchange account generally fall outside them, so prevention at the first leg matters.
• Detect mule and onboarding fraud: fake or borrowed identities open the accounts that receive and cash out proceeds. See the Identity Fraud Prevention Guide and the Fraud Prevention Guide for Digital Businesses.
• Share intelligence: exchange scam wallet, platform and domain data with exchanges, banks and law enforcement. After Bybit the FBI asked services to "block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets." Card teams should also watch the patterns in the Payment Fraud Guide.

Responding to a loss and avoiding recovery scams

Most stolen crypto is not recovered. The FCA warns that UK consumers generally cannot use the Financial Ombudsman Service for crypto and "won't be protected by the Financial Services Compensation Scheme (FSCS)".

1. Contain: move remaining assets to a new wallet created on a clean device, and revoke approvals the drainer obtained. If a seed phrase was exposed, abandon that wallet.
2. Secure accounts: reset exchange and email credentials from a clean device, re-enrol MFA and call the carrier if a SIM swap is suspected.
3. Notify exchanges: both the sending exchange and any that received funds, which may be able to freeze them.
4. Report: in the US to IC3 (ic3.gov), the FTC (ReportFraud.ftc.gov) and, by scheme, the CFTC or SEC; in the UK, check the FCA Financial Services Register and Warning List, report to the FCA (0800 111 6768) and to Report Fraud at reportfraud.police.uk (England, Wales and Northern Ireland; Scotland via 101). Keep transaction hashes, addresses, screenshots and messages.
5. Expect follow-up approaches: IC3 notes that "Victims are also targeted in recovery scams, claiming to help recover lost funds." An August 2025 FBI advisory on fictitious law firms lists red flags: claimed government partnership ("There are no law firms which are officially authorized partners of US Government agencies."), invented regulators, knowledge of the victim's past transfers, and requests for payment in crypto or gift cards.

Organisations run their incident response plan in parallel: preserve on-chain evidence, engage law enforcement early and warn users before scammers impersonate any "compensation" process. See the Incident Response Guide.

Rolling out a crypto fraud programme

1. Inventory exposure: wallets, signers, custodians, approvals, social accounts and admins, brand domains, and payment flows to crypto services.
2. Fix the highest-value path first: m-of-n signing with hardware or MPC and destination allowlists on treasury wallets; phishing-resistant MFA on exchange, email and social admins.
3. Write and test the signing procedure: run dry runs that include a deliberately wrong destination or unexpected owner change and confirm every signer rejects it.
4. Pilot payment interventions: run new scam rules in monitor-only mode, measure alert volume and true positives, then enable warnings and holds for a pilot segment, keeping the previous rule set ready for rollback.
5. Stand up brand monitoring: publish the official channels page, then add domain, app and social monitoring with takedown targets.
6. Review quarterly: signers, social admins, connected apps, outstanding approvals and new scam typologies.

Detection and measurement

What to monitor: transfers from corporate wallets to non-allowlisted addresses; proposals to change multisig owners, thresholds or modules; new or enlarged approvals; inbound zero-value transfers from look-alike addresses (poisoning attempts against staff); new admins or apps on social accounts; look-alike domain registrations; and, for banks, first-time and escalating payments to exchanges.

Common failure patterns

• Trusting the signing interface: signers who approve what the web application shows can all be deceived at once, which is how the Bybit hack became a $1.5 billion loss.
• Forgotten unlimited approvals: an allowance granted years ago is exploited when that protocol or its front end is compromised.
• Unprotected publishing credentials: the Ledger Connect Kit drainer shipped from a phished former employee's npm account. See the CI/CD Pipeline Identity Security Guide.
• SMS recovery on social and exchange accounts: a SIM swap or help-desk reset hands over the brand's voice or the exchange balance.
• Generic bank warnings: one-click "are you sure?" screens that coached victims click through.

Framework mapping

Practitioner checklist

• Hold treasury assets under m-of-n multisig or MPC with dedicated signing devices, destination allowlists and time locks.
• Ban blind signing on corporate wallets and require on-device verification by every signer.
• Inventory and cap token approvals from corporate wallets and revoke unused ones on a schedule.
• Remove signers and publishing rights on the day a role changes or a person leaves.
• Put passkeys or hardware security keys on every social, exchange and email admin account and remove SMS recovery.
• Inventory and scope OAuth apps and bot tokens connected to corporate social and community accounts.
• Publish an official channels page and run look-alike domain, app and social monitoring with takedown.
• For banks: risk-score crypto-bound payments and use scenario warnings and human intervention for the highest risk.
• Give customers and staff reporting routes (IC3, FTC, FCA, Report Fraud) and a recovery-scam warning.
• Rehearse a treasury compromise and a social account hijack at least once a year.

Standards and references

• FBI IC3: 2025 Internet Crime Report
• FBI IC3: Fictitious Law Firms Targeting Cryptocurrency Scam Victims Combine Multiple Exploitation Tactics While Offering to Recover Funds
• FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack
• FBI IC3: Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public
• FTC: What To Know About Cryptocurrency and Scams
• FCA ScamSmart: Cryptoasset investment scams
• Ethereum Improvement Proposals: ERC-2612 Permit Extension for EIP-20 Signed Approvals
• MetaMask Support: How to revoke smart contract allowances/token approvals

Related NHI Mgmt Group resources: Authorised Push Payment (APP) Fraud Guide · Fraud Prevention Guide for Digital Businesses · Account Takeover Prevention Guide · Cryptographic Key Management Guide · Phishing Guide