With the rise in popularity of cryptocurrencies such as Bitcoin, theA letter with a QR code arrived in your mailbox. A platform suddenly wants a “tax” before you can withdraw. Someone in your replies swears a hacker got their Bitcoin back. Every one of these is a scam, and every one of them is being reported by victims on Reddit and Bitcointalk right now.
The old warning signs of crypto scams still apply: guaranteed returns, pressure to act fast, strangers asking for your recovery words. But the methods have moved on. Below are the schemes people describe most often in scam forums today, what each one looks like from the victim’s side, and the one rule that stops it.
A letter from “Ledger” or “Trezor” arrives in your physical mailbox
This one catches people precisely because it’s paper. Since early 2026, owners of Ledger and Trezor hardware wallets across Europe and the US have received printed letters demanding a “mandatory authentication check” or, in the newest wave, a “Post-Quantum Cryptography Security Update” with a hard deadline. The letters look real. Some carry holograms, a forged signature from an actual Ledger or Trezor executive, and even your correct device model.
They know your address and your device because customer data leaked. Ledger’s 2020 breach exposed names, home addresses, and phone numbers of thousands of buyers, and that dataset still circulates. The letter itself can’t hurt you. The QR code can: it opens a convincing copy of the official site that asks for your 24 words to “verify” or “migrate” your wallet. Enter them and the wallet empties within minutes.
One detail victims mention again and again on forums: the letter felt more trustworthy than an email. That’s the whole trick.
The rule: no wallet company will ever ask for your recovery phrase, by mail, email, phone, or website. Do not enter your seed phrase into any website. If a notice worries you, type the official address into your browser yourself and check there. If your Ledger or Trezor genuinely needs attention, the device and the official app will tell you.
The address in your transaction history isn’t the one you think it is
Address poisoning is quiet, cheap for the attacker, and brutal when it lands. In December 2025, one trader lost almost $50 million in USDT this way. He even sent a $50 test transaction first and it arrived fine.
Here’s how it works. You send crypto to a contact. A bot watching the blockchain instantly generates a lookalike address that matches the first and last characters of that contact’s address; wallets shorten addresses on screen (0x6D90…2E48), so the fake looks identical at a glance. The bot then sends you a dust transaction, a transfer of a few cents, so the fake address appears in your history. Weeks later you copy “the usual address” from that history and send your funds to the attacker. Security firms now detect over a million poisoning attempts per day on Ethereum alone.
Test transactions don’t protect you here. The poison arrives after your test.
The rule: never copy a receiving address from your transaction history. Use your wallet’s saved address book, or get the address fresh from the recipient, and compare more than the first and last four characters before you confirm.
The “official site” at the top of your search results
Type a wallet or exchange name into Google and the first thing you see is often an ad. Scammers buy those ad slots. One drainer kit alone, tracked across roughly 10,000 fake sites, took about $59 million from more than 63,000 people who clicked what looked like the real Lido, Zapper, or a misspelled twin like “ceiler” instead of “celer”. The fake site asks you to connect your wallet and approve a transaction; that approval hands over your tokens.
The same trap now lives inside software. In 2025, an Ethereum core developer with ten years of flawless security lost a hot wallet to a fake code-editor extension that had a professional icon and 54,000 downloads. It read his stored keys and sent them to the attacker’s server. If it can happen to him, browser extensions and “wallet tools” deserve your suspicion too.
The rule: never reach a crypto site through an ad. Bookmark the real one once, use the bookmark forever. And before you approve any wallet transaction, read what it actually grants; “approve unlimited spending” is a red flag in itself.
The platform that shows profits but invents fees when you withdraw
This is the single most common story in scam forums, told in almost the same words every time. It usually starts with a friendly stranger: a wrong-number text, or a match on a dating app who’s oddly good at investing. After days or weeks of normal conversation, they mention the platform they invest through. You start small. The dashboard shows gains. Early on, a small withdrawal even works, which is deliberate; it’s the proof that convinces you to move serious money.
Then you try to withdraw the real amount, and the platform suddenly requires a “tax” or “liquidity fee” of 10 to 30 percent, paid separately, before release. People pay it. Then comes another fee. The dashboard was fiction from the first day; your money left the moment you deposited it. US authorities logged $9.3 billion in crypto fraud losses in 2024, up 66 percent in a single year, and this scheme drives a large share of it.
Real exchanges deduct fees from your balance. They never ask you to send extra money before you’re allowed to withdraw your own.
The rule: any platform that demands an upfront payment to release your funds is a scam, without exception. Stop paying immediately; every further payment is gone too.
“Support” that contacts you first
Post any wallet question publicly and watch what happens. Within minutes, replies and DMs arrive from “MetaMask support”, “a Ledger engineer”, or a helpful stranger whose cousin had the same problem. Researchers who posted 25,000 fake help requests on X lured over 9,000 scammers this way. The script barely varies: they move you to Telegram or WhatsApp, then either ask for your recovery phrase to “sync” or “validate” your wallet, or send a link to a fake support form that asks for it.
A cousin of this scam runs on video: AI deepfakes of Elon Musk and other famous figures “announcing” giveaways on YouTube livestreams, promising to double whatever you send. The face is cloned and the stream is scripted; nobody’s money doubles.
The rule: real support never DMs you first, never asks for your recovery phrase, and never continues on WhatsApp. Anyone who does all three has told you exactly what they are.
The “recovery expert” who appears after you’ve lost money
This one deserves the hardest warning, because it targets people at their lowest point and steals from them a second time. Post anywhere about lost or stolen crypto and the recovery offers pour in: a “certified crypto recovery hacker”, a “blockchain lawyer” claiming FBI or CFPB approval, an “exchange compliance officer” who says your funds are located and frozen, pending a release fee.
The evidence trail is manufactured. Review sites and Reddit threads fill up with word-for-word identical testimonials praising the same “hacker”, posted by fresh accounts across a dozen languages. The FBI has warned about fake law firms running this exact play; victims reported nearly $10 million in additional losses to them in a single year.
Here is the fact that cuts through all of it: blockchain transactions can’t be reversed. No hacker or lawyer can do it, and neither can we. Whoever claims otherwise is describing something that does not exist. To be equally clear about our own scope: Crypto Recovers does no scam tracing and no stolen-fund recovery. Our work is technical reconstruction of access for owners who still hold their wallet, their file, or part of their credentials, and simply can’t get in.
The rule: never pay anyone who found you first and promises to get stolen crypto back. A legitimate service charges nothing upfront and guarantees nothing.
If a scam has already caught you
Act in this order. Stop all payments to the scammer now, including any “fee” they say will fix things. If any wallet credential was exposed (a seed phrase entered on a site, a malicious approval signed), move whatever remains to a brand-new wallet you create yourself, with a fresh recovery phrase, before the attacker gets to it. Then report: in the US through the FBI’s ic3.gov, and elsewhere through your national police’s cybercrime channel. Tell your exchange too; a fast report occasionally freezes funds still sitting on a platform.
And expect the second wave. Reporting publicly puts you on the recovery scammers’ radar, so treat every incoming offer of help as the scam it almost certainly is.
We’d rather say it plainly than let false hope cost you more: once crypto reaches a thief’s wallet, no honest company can pull it back.
Where legitimate help does exist
Scams are one way to lose crypto. Far more people simply lock themselves out of a wallet they still own. Those cases are frequently solvable, because the funds never moved. They sit on the blockchain exactly where you left them; only the access is broken. That’s the work wallet recovery actually does.
Locked out of your own wallet? Crypto Recovers has been performing recoveries since 2019 — forgotten passwords, damaged wallet files, incomplete seed phrases, 200+ wallets recovered. No Cure No Pay, and the model is the reverse of the scams above: we never touch your coins or take our cut out of them. You move the funds to a wallet you created, and you pay the 20% fee in the same session, with both of us present. Start a free assessment — you’ll get an honest picture of what’s possible, including a clear no if it isn’t.
