Scam Radar
Wallet drainers stole over USD 500M in 2024. Pig-butchering investment scams added another USD 4B according to FBI IC3. This page tracks active drainer kits, rug-pulled tokens and known scam wallet addresses our corpus indexes.
Scammers build polished lookalike crypto-to-gift-card storefronts that mimic real platforms (dark theme, trust badges, "Pay with crypto" buttons) to steal your Bitcoin or Ethereum. Victims either...
Hackers compromised a third-party frontend vendor used by Polymarket and injected malicious JavaScript into the legitimate trading site. Visitors were prompted to sign fraudulent wallet transactions...
Approval phishing is a crypto scam where victims are tricked into signing a wallet transaction that grants attackers standing permission to spend or transfer tokens. Unlike classic phishing, victims...
A convincing clone of OpenAI's ChatGPT download page at openew[.]app is tricking Windows and Mac users into installing info-stealing malware. The site mirrors OpenAI's branding, dark theme, and...
Reverse trick: scammer posts on Reddit/Discord 'how do I withdraw $50k USDT from this wallet?' and shares a seed phrase. Victim imports seed; wallet shows $50k USDT (real). When victim adds ETH to...
Solana drainer asks user to sign a tx with Cross-Program Invocation (CPI) to a malicious program. Phantom simulation may not flag if program is unknown. Drainer transfers SOL + SPL tokens in one tx....
Telegram trading bots (Maestro, BananaGun, Bonkbot) are popular for memecoin sniping. Scammers clone these ('Maestro-Pro-Bot', 'BananaGun Sniper2') and demand seed or private key import. Indicators:...
User unknowingly interacts with OFAC-sanctioned addresses (Tornado Cash, Sinbad, Garantex, Lazarus wallets) and faces account freeze by Circle/Coinbase/Kraken. OFAC sanctioned Tornado Cash...
Malware (ClipBanker, CryptoShuffler) monitors clipboard. When user copies a wallet address, malware silently replaces it with attacker's address sharing same length/format. CryptoShuffler stole...
Projects launch 'algorithmic stablecoin' with high yield via seigniorage (USDD, USDN, BEAN, BasisCash). When trust falters, peg breaks irreversibly (Terra/UST $40B collapse May 2022). Often paired...
Attacker bridges drained proceeds via Wormhole/Allbridge/deBridge to obscure trace. Some drainer kits exploit cross-chain accounts (Phantom multi-chain mode) — one signature drains both SOL and ETH...
Attacker uses flash-loan (Aave/Balancer/dYdX) to manipulate AMM price → exploit a lending protocol's price oracle → drain pool of collateral. Examples: Mango Markets ($114M, 2022), Euler ($197M,...
Drainer offers 'free conversion' of legacy USDC.e (Avalanche/Optimism bridged) to native USDC. Or fake 'USDC v2 migration'. User signs permit on real USDC; attacker drains. Indicators: (1) real USDC...
Clone protocol forks Aave/Compound, adds backdoor in price oracle or admin function. User deposits, dev exploits to drain pool. Examples: Swaprum ($3M, 'CertiK audited'), CompounderFinance ($10M)....
Phishing clones (wormhole-bridge[.]io, multichain-bridge[.]live, stargate-defi[.]app). User connects wallet to 'bridge' but signs approval/permit; assets drain instead of bridging. Indicators: (1)...
DeFi farm advertises 10,000-1,000,000% APY (Anchor 20% was suspicious; 50k% is impossible). Once TVL hits target, dev drains via emergencyWithdraw/admin function. Indicators: (1) APY 500% with no...
Site sells 'crypto trading bot' subscription ($199-2000/mo) promising 5-30% monthly via 'proprietary AI'. Bot does nothing, runs random trades, or signals push victim into pump-dump. Often...
Telegram 'pump groups' (5k-200k members) coordinate buying microcap token at announced time. Insiders pre-buy hours earlier and dump on the rush. 'BSC Pump Signals', 'Solana Whale Club' patterns....
Open Mythos and paste it. Free triage in seconds. Court-grade forensic dossier from CHF 29/month when you need a defensible trail.