Scam Tokens and Ponzi Schemes: How to Spot a Fraudulent Crypto Project

Introduction: Why Scam Projects Thrive in the Crypto Industry

Every day, 100+ new tokens launch in the crypto world. And every day, dozens of projects turn out to be scams, stealing millions of dollars from investors. Why does this happen in an industry that should be transparent thanks to blockchain?

The crypto paradox: the technology was created for decentralization and transparency, but these very properties make it attractive to fraudsters. Anonymity, irreversible transactions, and lack of regulation — the perfect environment for financial crimes.

According to Chainalysis, investors lost over $5.6 billion to various crypto scams in 2023, with 73% attributed to fraudulent tokens and projects. This doesn't even count countless smaller scams ranging from $10,000 to $100,000.

Key Crypto Investment Principle: 90% of new tokens will die or turn out to be scams. Your job is to learn how to stay in the remaining 10%. This skill is worth thousands of saved dollars.

Types of Crypto Scams: Encyclopedia of Fraudulent Schemes

Type 1: Rug Pull

The most common and painful type of scam in DeFi. Developers create a project, attract liquidity, then disappear with all the money.

How a Classic Rug Pull Works:

1. Token creation — launch a smart contract on Ethereum/BSC/another blockchain
2. Adding liquidity — deposit tokens + ETH into a DEX pool (e.g., Uniswap)
3. Marketing — aggressive promotion on Twitter, Telegram, YouTube
4. Attracting investors — people buy the token, price rises
5. Pulling liquidity — developers withdraw all liquidity from the pool
6. Price collapse — token drops to zero, impossible to sell
7. Disappearance — team deletes website, social media, Telegram

Types of Rug Pulls:

Hard Rug Pull

• Backdoor functions built into the smart contract
• Developer can freeze trading
• Can take tokens from holders' wallets
• Can mint unlimited tokens
• Technically theft, but not prosecuted in most jurisdictions

Soft Rug Pull

• Developers gradually sell their tokens
• Price drops due to massive selling
• Technically not theft
• Team can claim "the project didn't take off"
• Harder to prove malicious intent

Liquidity Rug Pull

• Most common variant
• Developer controls LP liquidity tokens
• Withdraws all liquidity from DEX at once
• Trading stops, price drops to zero

Real Case — Squid Game Token (2021):

A token based on the popular "Squid Game" series rose 45,000% in one week, reaching a $3 billion market cap. Investors couldn't sell tokens due to an "anti-dump" mechanism. Then developers withdrew all liquidity in 5 minutes, price crashed from $2,856 to $0.0007. Approximately $3.38 million was stolen.

Type 2: Honeypot

A token you can buy but cannot sell. Investors get trapped by the smart contract.

Technical Honeypot Mechanisms:

• Hidden sell-blocking function — code only allows buying, selling returns an error
• Whitelist mechanism — only addresses on the whitelist (creators) can sell
• High sell fees — 99% fee charged when attempting to sell
• Pause function — creator can pause trading
• Blacklist — your address can be blacklisted after purchase
• Conditional logic — sales only allowed under certain conditions

What It Looks Like for the Victim:

1. You see a token up +500% in a day
2. You buy tokens without problems
3. You try to sell — transaction fails
4. You try again with higher gas — error again
5. You check the contract on Etherscan — find hidden function
6. You realize you've fallen into a honeypot

Honeypot Detection Tools:

• honeypot.is — free contract scanner
• rugcheck.xyz — for Solana tokens
• tokensniffer.com — automated security analysis
• Manually check contract code on Etherscan (if you can read Solidity)

Type 3: Pump and Dump

Organized price manipulation of a token to enrich organizers at the expense of naive investors.

Pump and Dump Phases:

Phase 1: Accumulation

• A group of insiders quietly buys a cheap token
• Usually an obscure token with low market cap
• They accumulate 30-60% of supply
• Price remains stable or rises slightly

Phase 2: Pump

• Launch coordinated marketing campaign
• Post in Telegram "signal" groups
• Mass buying creates artificial growth
• FOMO among retail investors
• Price skyrockets 500-2000%

Phase 3: Dump

• Insiders start selling massively
• Price drops sharply
• Late buyers try to sell — panic
• Price returns to original or lower
• Organizers profit, everyone else loses

Where Pump and Dump Happens:

• Telegram pump groups — "VIP signals", "100x gems"
• Discord servers — coordination through voice channels
• Low cap altcoins — easier to manipulate price
• New listings — on obscure exchanges

Signs of Pump and Dump:

• Sudden sharp increase in trading volume (300%+ per hour)
• Aggressive social media messages "buy now or miss out!"
• Telegram groups with names like "Moonshot Gems", "1000x Calls"
• Promises of specific dates "pump at 15:00 UTC"
• No fundamental reasons for growth

Important to Understand: Only organizers profit from Pump and Dump. Even if you bought "on time," selling at a high price is difficult — no liquidity, huge slippage. By the time you see the signal in the group, organizers are already selling.

Type 4: Ponzi Scheme

A classic financial pyramid disguised as a crypto project. Payouts to old investors come from new investors' deposits.

How a Crypto Pyramid Works:

1. Promise of unrealistic returns — "20% per month guaranteed"
2. Complex backstory — "AI trading bot", "arbitrage between exchanges", "staking protocol"
3. First payouts — early investors actually receive profits
4. Referral system — bonuses for bringing new people
5. Pyramid growth — newcomers' money pays old participants
6. Collapse — when new deposits aren't enough, the system crashes

Signs of a Ponzi Scheme:

• Guaranteed returns — 10-50% per month "risk-free"
• Hard to explain income source — vague answers to "how do you make money?"
• Aggressive referral program — pays more for referrals than investments
• Requirement to recruit friends — pressure to invite new participants
• Withdrawal difficulties — can only withdraw after N days/with reinvestment condition
• Anonymous team — nobody knows who actually runs the project
• No registration — illegal activity

Famous Crypto Pyramids:

BitConnect (2016-2018)

• Promised up to 40% per month through a "volatility trading bot"
• Peak market cap — $2.6 billion
• Collapsed in January 2018 — token fell from $370 to $0.20
• Investor losses — approximately $1 billion

PlusToken (2018-2019)

• Chinese pyramid promising 10-30% per month
• Attracted 3 million users
• Stole $2.9 billion in cryptocurrencies
• Organizers arrested, but most money not recovered

OneCoin (2014-2017)

• Wasn't a real cryptocurrency (no blockchain)
• Stole $4-15 billion by various estimates
• Founder Ruja Ignatova on FBI's wanted list

Type 5: Fake ICO/IDO/IEO

Fraudulent projects that raise money through public token sales, then disappear.

How a Scam ICO Works:

1. Creating an impressive website — professional design, whitepaper, roadmap
2. Fake team — stock photos, made-up biographies
3. Unrealistic promises — "blockchain revolution", "Ethereum killer"
4. Creating hype — fake partnerships, fake endorsements
5. Fundraising — presale, public sale
6. Disappearance — after collecting money, project dies or token never lists

Red Flags of Fake ICOs:

• Anonymous or fake team — can't find on LinkedIn, stock photos
• No working product — only promises in whitepaper
• Copied whitepaper — text stolen from other projects
• Unrealistic goals — "raise $100M in a month"
• No audit — contract not verified by independent company
• Urgency pressure — "only 48 hours", "exclusive presale"
• No vesting — team can sell tokens immediately after listing

Type 6: Scam Tokens with Malicious Code

Tokens that appear in your wallet without your knowledge and contain malicious logic.

Types of Malicious Tokens:

Address Poisoning

• Token created with an address very similar to yours
• Sends you a micro-transaction (e.g., 0.000001 ETH)
• In transaction history, you see a similar address
• You might accidentally copy it instead of yours
• If you send funds to that address — you lose them

Dust Attack

• Mass distribution of junk tokens to thousands of addresses
• Goal — deanonymization through analysis of subsequent transactions
• Not directly dangerous, but compromises privacy

Approval Phishing Tokens

• Token with a name like "Claim Your Reward"
• When trying to "claim reward," asks for approval
• Actually gives permission to drain all your tokens

How to Protect Yourself:

• Ignore unknown tokens in your wallet
• Don't try to sell or swap them
• Use the "Hide token" function in MetaMask
• Never approve unknown contracts
• Manually verify addresses, don't copy from transaction history

Project Verification Checklist Before Investing: DYOR

DYOR (Do Your Own Research) — the sacred rule of crypto investing. Never invest money without conducting your own research.

Level 1: Basic Check (5 minutes)

Website and Social Media Check

• Is the website professionally made or looks templated?
• Are there grammatical errors?
• Do social media links work?
• When was the domain registered? (via whois.com)
• Is there activity on Twitter/Telegram/Discord?

Team Verification

• Is the team public or anonymous?
• Can you find team members on LinkedIn?
• Do they have blockchain experience?
• Check photos through Google Images (not from stock sites?)
• Do founders have previous projects?

Listings and Market Cap

• Is the token on CoinGecko/CoinMarketCap?
• Which exchanges is it trading on?
• What's the market cap and trading volume?
• How many token holders are there?

Level 2: Deep Dive (30 minutes)

Smart Contract Analysis

• Is the contract verified on Etherscan?
• Has it passed a security audit? (CertiK, PeckShield, OpenZeppelin)
• Check contract owner (shouldn't have mint/burn functions for owner)
• Check for honeypot via honeypot.is
• Look at token distribution (aren't top holders holding too much?)

Tokenomics

• What's the total supply?
• What's the circulating supply?
• Is there vesting for team and investors?
• What percentage does the team hold? (more than 20% — bad)
• Is liquidity locked? (via Unicrypt, Team Finance)
• How long is it locked? (minimum 6 months)

Whitepaper and Technology

• Is there a whitepaper?
• Is the problem and solution clearly described?
• Is there uniqueness or is it a copy of other projects?
• Are development plans realistic?
• Check through plagiarism checker (is the text copied?)

Community and Activity

• How many followers on Twitter/Telegram?
• Is the community alive or bots?
• How does the team communicate with the community?
• Are there critical questions and how are they answered?
• Look for discussions on Reddit, Bitcointalk

Level 3: Professional Analysis (2+ hours)

Competitive Analysis

• Who are the main competitors?
• What advantages over them?
• Is capturing market share realistic?
• What's the product-market fit?

Partnerships and Investors

• Who invested in the project?
• Verify claimed partnerships (contact directly)
• Are there mentions in major media?
• Are known industry figures involved?

GitHub and Development

• Is there a public repository?
• Is development active? (commits in recent weeks)
• How many developers contribute?
• Code quality (if you understand programming)

Legal Compliance

• Is the company officially registered?
• Are there legal documents (Terms, Privacy Policy)?
• Does the project comply with regulatory requirements?
• Have there been warnings from SEC or other regulators?

Red Flags: When to Definitely NOT Invest

Some signs are absolute deal-breakers. If you see even one — run.

🚩 Red Flag #1: Anonymous Team with No Track Record

Legitimate projects don't hide their founders. Anonymity is only acceptable for projects with fully decentralized governance (and even then, rarely).

Exceptions: Bitcoin (Satoshi Nakamoto), Monero — but these are mature projects with years of history.

🚩 Red Flag #2: Guaranteed Returns

"20% per month guaranteed", "Fixed APY 300%" — this is a pyramid. There are no guarantees in crypto. Even legitimate Ethereum staking yields 3-5% annually.

🚩 Red Flag #3: Unlocked Liquidity

If the team can withdraw liquidity at any moment — it's a future rug pull. Check via:

• Unicrypt.network — view locked liquidity
• Team.finance — alternative service
• Etherscan — check LP token ownership

🚩 Red Flag #4: Too-Good-to-Be-True Promises

"We'll kill Ethereum", "10000x guaranteed", "The next Bitcoin" — marketing fluff with no substance.

🚩 Red Flag #5: Aggressive Marketing Without a Product

If they spend more on advertising than development — it's a scam. Legitimate projects build the product first, then attract users.

🚩 Red Flag #6: Copying Famous Projects

"Elon Moon Mars Inu Floki" — obvious attempts to ride the hype. No value, only speculation.

🚩 Red Flag #7: Inability to Ask Critical Questions

Getting banned in Telegram for questions? Team doesn't respond to criticism? Only positive comments? Run.

🚩 Red Flag #8: No Smart Contract Audit

Serious projects undergo security audits. It costs $5-50K but protects millions of investors. No audit = they don't believe in the project or are hiding vulnerabilities.

🚩 Red Flag #9: Large Percentage of Tokens Held by Team

If team/founders hold >30% of supply — they can crash the market anytime. Optimal: <15% with long vesting.

🚩 Red Flag #10: Pressure to "Invest Urgently"

"Presale closes in 24 hours!", "Only first 100 investors" — classic manipulation. Legitimate projects give time for due diligence.

Tools for Project Verification

Security Scanners

• TokenSniffer.com — automated contract analysis, security rating
• Honeypot.is — honeypot check for Ethereum/BSC
• Rugcheck.xyz — for Solana tokens
• BscScan Token Tracker — BSC token analysis
• De.Fi Scanner — portfolio monitoring and permission checking

Smart Contract Auditors

• CertiK — most well-known auditor
• PeckShield — DeFi specialization
• OpenZeppelin — also library developers
• Trail of Bits — for complex protocols
• ConsenSys Diligence — from MetaMask creators

Analytics Platforms

• Nansen — on-chain analytics, smart money tracking
• Dune Analytics — custom project dashboards
• DefiLlama — TVL and DeFi protocol metrics
• CoinGecko — basic metrics and ratings
• Messari — deep analytics and research

Communities and Resources

• Reddit r/CryptoCurrency — discussions and scam warnings
• Bitcointalk.org — oldest crypto forum
• CryptoScamDB — database of known scams
• Scam Alert Twitter — @CryptoWhale, @zachxbt (investigators)

Investor Psychology: Why Smart People Fall for Scams

Understanding cognitive biases helps you avoid becoming a victim, even knowing all the technical signs.

FOMO (Fear of Missing Out)

How it manifests: "Everyone's buying, I'll miss out, need to act now!"

How to fight it:

• Set a rule: no investments without 24 hours of consideration
• Remember: there are thousands of opportunities, miss one — another will come
• If it's "urgent" — it's manipulation

Confirmation Bias

How it manifests: Looking for information confirming your desire to buy, ignoring warnings.

How to fight it:

• Actively seek negative reviews
• Read project criticism, not just praise
• Play devil's advocate for your investment ideas

Authority Bias

How it manifests: "If Elon Musk (actually fake) recommends it, it must be good"

How to fight it:

• Verify sources of claims
• Remember: celebrities aren't financial advisors
• Influencers often get paid for promotions

Sunk Cost Fallacy

How it manifests: "I already invested $1000, can't exit now at a loss"

How to fight it:

• Past investments shouldn't influence future decisions
• Ask: "Would I buy this now at the current price?" If no — sell
• Better to lose 50% than 100%

Conclusion: Paranoia as a Survival Strategy

In crypto, 90% of projects are garbage, scams, or pump and dumps. Your job isn't to find the next Bitcoin, but to not lose money on obvious scams.

Remember the survival formula:

Distrust + Verification + Patience = Capital Protection

Miss 100 potential "10x" opportunities — no big deal. Lose money once on a scam — you might be out of the game forever.

In the next lesson, we'll cover two-factor authentication and why SMS codes are the worst thing you can use to protect crypto accounts.