Two endpoints serve our content:

• ours: https://theonchaindiary.com/api/mcp — 316 items (articles + glossary, EN/ZH), read-only, no auth

• the hub: https://mcp.jask.dev/mcp — one endpoint aggregating all our product lines (Web3 security, SEO workflow docs, Astro templates, build logs)

If you use Claude Desktop, Cursor, or any MCP client, add the URL and ask it to search 'wallet drainer' or 'permit2 exploit' — it will pull the exact article with the full text and cite the source URL.

Why this matters: security education is only useful when it reaches you at the moment of need. Putting our content where AI assistants live is the shortest path.

This guide breaks down the playbook channel by channel — X, Telegram, and email — because each channel has its own script, and the scripts are more standardized than most people think. Once you can name the step you are on, the con stops working.

The X Playbook: Fake Jobs, Fake Airdrops, Real Malware

The most dangerous message on crypto X is not "send me your seed phrase." Nobody falls for that anymore. The dangerous one offers you something that feels earned.

The fake moderator recruit

It starts with a DM or a reply: "Loved your thread on rollups. We're recruiting community moderators for [project], paid monthly in USDT. Interested?"

You say yes. There's a short interview in a Telegram group with other "staff members" who all vouch for each other. Then comes the operational step: "Moderators use our internal dashboard — download it here." The link points to an installer. Almost always Windows.

That installer is the entire point of the exercise. It is typically a remote access tool or an infostealer — malware that copies browser passwords, session cookies, and wallet extension vaults, or lets the operator watch your screen until you type something worth taking. The moderator job never existed. The interview theater existed to get one executable onto your machine.

The same structure powers the fake airdrop variant: a reply claiming you're on an eligibility list, a "claim tool" to download, a verification app to run. The bait changes; the deliverable is always software you install yourself.

Rules that hold

• Real projects recruit moderators through public posts and application forms, not cold DMs from accounts created last month.

• No legitimate airdrop requires you to install a desktop program. Claims happen in a browser, against a wallet you connect deliberately.

• If a "staff member" moves the conversation to Telegram within two messages, you are being processed. Speed is a feature of the scam, not of the job.

• On Windows specifically: a random .exe or .scr from a stranger is game over. Malware on that machine owns every wallet extension and saved password in the browser.

If you already ran something suspicious, assume the machine is compromised. Move funds from a clean device, change passwords from a clean device, and revoke approvals — not from the machine that ran the installer.

The Telegram Playbook: The Slow Burn

The X scam takes minutes. The Telegram scam takes weeks. That is its strength.

How the conversation actually goes

It follows a rhythm you can learn to hear:

1. Contact. A stranger joins a group, likes your messages, or DMs you with something innocuous. No pitch. Just chat.

2. Rapport. They ask how you got into crypto. What you're holding. Where you're from — "No way, I'm from there too." The hometown match is almost never a coincidence; it is a line from the script.

3. The shared interest. "You're in on XX too?" They mirror whatever you already trade. Agreement is the product being sold here.

4. The leak. After days or weeks of friendship: "There's this ground-floor project — local team, launching soon, not public yet. I'm already in." Sometimes framed as an offline-promotion project, a regional push, a friend's launch. Urgency is gentle: the launch is "in a few days."

5. The double kill. You buy. The token is a honeypot — you can buy, but a hidden rule in the contract blocks your sell. While you wait for the "launch," the same friendly stranger may help you "check" a contract or claim a bonus, harvesting a signature that empties the rest of your wallet through a wallet drainer.

Then the account goes quiet. The friendship was the exploit.

The scam has a name in Chinese-speaking circles — 杀猪盘, "pig butchering" — because the mark is fattened before the slaughter. The operators work from prepared dialogue trees. The hometown coincidence, the shared coin, the quiet local project: these are fields in a script, not luck. For a deeper look at the script itself, see the pig butchering breakdown.

What gives it away on-chain

The token itself can be checked before you buy. A honeypot's sell block lives in the contract — a modified transfer function, a blacklisted address list, an owner-controlled switch. Free honeypot checkers simulate a sell from your address and report whether the transaction would revert. Contract source that is unverified is its own answer: walk away.

The deeper tell is social, not technical. Real opportunities do not arrive through a stranger who spent three weeks agreeing with you. Nobody fattens a friendship to sell you a good trade.

The Email Playbook: The Lookalike Domain

Email survives in crypto because it inherits trust from domain names. The scam is simple: register a domain that looks almost right.

How the domain game works

• Typosquatting: a dropped or doubled letter — arbirrum instead of arbitrum, uniswap-clalm instead of claim.

• Hyphenation and suffixes: uniswap-airdrop.com, layer2-claims.io — official-sounding words the real project never uses.

• Homoglyphs: characters that render identically — rn looks like m, a Cyrillic о looks like o. The domain in your address bar can be visually perfect and still wrong.

• Wrong TLD: the project lives at .xyz or .org — so the scammer registers the .com.

The email itself announces an airdrop, a token claim, a security update requiring wallet re-verification. The link leads to a pixel-perfect clone of the real site. The clone asks you to connect a wallet and sign, or worse, to enter your seed phrase to "verify ownership." No real project will ever ask for a seed phrase, by email or anywhere else — that request alone identifies the scam regardless of how good the domain looks.

Rules that hold

• Read the sender's full email address, not the display name. Display names are free; domains are the tell.

• Reach projects through your own bookmarks, never through links in the email. If the airdrop is real, it will still be real after you type the official URL yourself.

• Claims never require re-entering a seed phrase. Any page that asks is a phishing page, full stop.

• Watch the signature request if you do connect a wallet. A claim should not ask for unlimited token approvals or strange message types. If you don't understand what you're signing, don't sign — see how crypto phishing actually works.

One Chain, Many Doors

The three channels look different but converge on the same goal: either software on your machine, a signature from your wallet, or a token you cannot sell. Understanding the destination makes every route obvious.

• X delivers malware. The tell is the downloadable installer.

• Telegram delivers a fake friendship and a honeypot. The tell is the stranger who agrees with you for weeks.

• Email delivers a cloned domain. The tell is the link you didn't type yourself.

The defenses stack: keep claiming activity in a browser you can afford to reset; treat every unsolicited installer as hostile; verify tokens on-chain before buying, the same way you'd check any token for rug and honeypot risk; and treat unexpected airdrop claims — on any channel — as a reason to visit the project's official page directly, not the link you were handed. The general airdrop rules in the crypto airdrop scams guide apply to all three channels here.

Scammers industrialized the scripts. Your defense doesn't need to be clever — it needs to be boring and consistent: nothing installed from strangers, nothing signed unread, no links trusted from inbound messages.

Originally published at https://theonchaindiary.com/articles/social-media-crypto-scam-playbook/. More Web3 security guides and risk-scoring tools at Onchain Diary.

From that moment, your phone number is theirs. And if your email, exchange, or banking accounts still treat SMS as a trusted channel, the takeover cascade starts. This article walks the full chain: how attackers pick targets, how the port actually happens, what they do in the first hour after the swap, real cases with real numbers, and the short list of defenses that actually break the attack.

BLUF: SIM swap is an account-takeover primitive, not an SMS problem. It defeats any account that can be reset or verified through your phone number. The fix is to remove SMS from your trust chain entirely (authenticator app or hardware key for 2FA, carrier port-out PIN), and to structure holdings so that even a total account takeover hits a small number: trading float on exchange, everything else in a hardware wallet.

What a SIM Swap Actually Is

Your phone number is not physically attached to your SIM card. It's a record at your carrier that says "route calls and texts for +1-555-… to SIM serial X." A SIM swap (also called a port-out scam when the number moves to a different carrier) is an attack on that record: the attacker convinces your carrier — or pays someone inside it — to repoint your number to a SIM they control.

Three flavors exist, and they all end the same way for you:

1. Retail social engineering. The attacker calls the carrier, poses as you with leaked personal data (name, address, birth date, last four of SSN, account PIN if they've phished it), and "reports a lost phone." A helpful agent activates a new SIM "for" you.

2. Insider fraud. Carrier store employees or support contractors are recruited and paid per successful swap. Several US prosecutions have included telco insiders as accomplices.

3. Port-out. The attacker initiates a transfer of your number to a different prepaid carrier, exploiting lax verification on port requests.

Your phone silently loses service. Theirs starts receiving your texts — including every password reset code and 2FA prompt sent to your number.

Why Crypto Holders Are the Target

An exchange account is a bank account with a market attached. Once an attacker is inside, they don't need to beat on-chain security at all — they use the exchange's own withdrawal function to send your balances to their wallet, and the withdrawal looks like any other customer transfer.

That's the uncomfortable part: no smart contract audit, hardware wallet, or seed phrase hygiene helps if the assets sit in a custodial wallet and the account can be recovered via SMS. The attack specifically selects for people who:

• Still use SMS 2FA on their exchange or email accounts

• Publicly associate their identity with crypto (founders, traders with public personas, anyone who has tweeted their holdings or been interviewed about them)

• Have personal data floating in breach dumps (which is nearly everyone)

Recon is cheap. The data brokers and breach corpora that supply carrier social engineering are the same ones that supply crypto phishing campaigns — often the same crews run both.

The Attack Chain, Step by Step

Step 1: Target selection and data gathering. The attacker assembles enough of your identity to pass carrier verification. Sources: breach databases, social media, your own posts, earlier phishing pages you may have entered data into, and sometimes insiders at the carrier who skip this step entirely.

Step 2: Pre-staging. Before touching your number, the attacker learns which exchanges you use and tries your email. Some password-reset the email first (if it can be recovered via SMS to the same number, one swap covers both); others swap first and reset everything after.

Step 3: The swap. A call to the carrier, a story about a broken phone, maybe a walk-in to a retail store. Your number moves. Your handset shows "No Service."

Step 4: Account takeover. Password reset flows are the point of the whole exercise. "Forgot password" → SMS code → new password → change the recovery email and phone → disable TOTP if they can. Within minutes they own the account, and you are locked out.

Step 5: The drain. Exchange balances are withdrawn to attacker-controlled addresses. If a withdrawal allowlist with a time lock was enabled, this step gets harder — that's why allowlists matter (see below). Otherwise, funds leave in batches, then split through hops and sometimes a mixer, following the same laundering pattern as drainer proceeds. From there, victim-side tracing looks identical to any other theft case: evidence, freeze requests, law enforcement — the pipeline described in how stolen crypto is actually recovered.

The on-chain part is almost an afterthought. That's what makes SIM swap distinct from every other attack in this library: it's the only major crypto theft vector that starts completely off-chain.

Real Cases, Real Numbers

• Joel Ortiz (2018–2019). The first widely reported SIM-swap criminal conviction: Ortiz and associates took over roughly 40 phone numbers and stole more than $5 million, much of it in crypto, including about $1.5M in one day from a startup founder who was flying and unreachable during the takeover. He pleaded guilty and received 10 years in a California court in 2019.

• Michael Terpin v. AT&T (2019). Investor Michael Terpin lost roughly $24 million in crypto after two SIM swaps on his AT&T number in 2017 and 2018; in 2019 a federal jury awarded him $135 million in damages against the carrier. The case put carriers' port-out verification practices on the public record.

• "The Community" (DOJ indictment, 2019). The US Department of Justice indicted eight members of a crew that stole millions by SIM-swapping targets and draining exchange accounts, working with accomplices who handled the number ports. Prosecutors described it as a conspiratorial structure: hackers, money movers, and telco-side enablers.

The pattern across cases: young crews, high-value crypto targets, carriers as the weak link, and sentences that finally caught up with the crime. The techniques have not gone away — they've industrialized alongside the rest of the scam economy.

The Part Everyone Misses: Your Phone Number Is a Master Key

SMS is not just "one factor among many." In most account systems, the phone number is also the recovery path — the channel that lets you back in when everything else fails. That means a number takeover can defeat even a strong password plus authenticator app, if the "account recovery" flow is willing to text a reset link.

So the honest framing is:

• SMS 2FA is worse than nothing for high-value accounts — not because SMS is easy to phish (it is), but because it gives attackers a reset path that bypasses everything else you set up.

• Email is the other master key. If your email can be recovered via SMS, then SMS compromise → email compromise → every account that sends "we've reset your password" emails.

This is why the defense stack below is ordered the way it is. It's not a checklist of equal items; it's a dependency chain.

The Defense Stack

1. Remove SMS 2FA from every account that matters. Replace it with an authenticator app (TOTP) or, better, a hardware security key (FIDO2/WebAuthn) for email and exchange logins. Hardware keys are phishing-resistant in a way codes are not — see blind signing and hardware wallet security for how the device-side piece fits.

2. Decouple recovery from your number. In every account's security settings, check the recovery options: remove the phone number where an email or second key can serve instead. If a service requires a phone number for recovery, treat that service as unsafe for meaningful balances.

3. Lock the port. US carriers offer account-level protections — AT&T's Extra Security / Number Lock, Verizon's Number Lock, T-Mobile's port validation with a separate passcode. Set it today; it costs nothing. It won't stop an insider fraud, but it defeats the casual call-center attack that makes up the bulk of volume.

4. Enable withdrawal allowlists + delay locks on exchanges. A 24-hour withdrawal-address lock means a fresh takeover can't move funds immediately, and the delay gives you a window to catch the "new address added" notification (routed to email they don't control, if you did step 1 right).

5. Structure holdings so a takeover hits a small number. Exchange accounts hold trading float. Everything else lives in self-custody — a hardware wallet, ideally with multi-sig for large amounts. A SIM swap cannot touch self-custodied funds: there is no phone number, no password reset, no customer service desk to social-engineer. This is the structural answer, and it matters more than any carrier setting.

If It Happens: The First 30 Minutes

Your phone dropping to "No Service" with no explanation is the tell. Act on the assumption of an active takeover:

1. Call your carrier from another phone (their fraud line, not general support) and ask them to suspend the port and freeze the account. Speed here constrains everything downstream.

2. Secure email first, from a clean device — change the password, revoke active sessions, re-enable 2FA. Email is the recovery path to everything else.

3. Freeze exchange accounts: change passwords, revoke sessions, disable withdrawals if the platform allows a temporary lock. Use the app over a borrowed device if needed; attackers move within minutes.

4. Document as you go: timestamps, who you spoke to at the carrier, confirmation numbers. If funds moved, capture transaction hashes and addresses — that becomes the evidence package for tracking stolen crypto and any freeze request to the receiving exchange.

5. File a police report and IC3 complaint (US) or your local cybercrime unit. SIM swap is a well-understood crime category now; the report also helps with the carrier's liability process.

One more thing: after any SIM swap, expect follow-on targeting. The same data that enabled the swap enables phishing and "recovery agent" fraud — read the recovery scam anatomy before strangers offer help.

Limitations

• Carrier protections vary by country. Port-out PINs and number locks are common in the US and uneven elsewhere; the local reality may be weaker than this checklist assumes.

• Nothing stops a corrupt insider completely. A paid store employee with system access can bypass most customer-side controls. That's why the structural defense (self-custody) outranks every carrier setting.

• Operational friction is real. Hardware keys and allowlist delays make trading marginally slower. That trade is correct for long-term holdings and a personal decision for active traders.

• This is general education, not advice for your specific carrier or platform. Check your carrier's current protection options directly — the products and their names change.

Related Reading

• How to Avoid Crypto Phishing Scams — the other major off-chain attack surface, and often the source of the personal data used for carrier social engineering

• How Stolen Crypto Is Actually Recovered — what happens after the drain, and what a usable evidence package looks like

• Crypto Recovery Scams Explained — the second scam that targets every victim within days

• How to Prevent Wallet Drainers — the on-chain counterpart: where SIM swap can't reach but signatures can

Originally published at https://theonchaindiary.com/articles/sim-swap-attacks-explained/. More Web3 security guides and risk-scoring tools at Onchain Diary.

This article breaks the scam into its operating parts: the funnel, the fake platform, the on-chain money trail, and the reporting path. It is written from an on-chain analysis perspective — for people who want to understand what the money does after the deposit, whether they are victims, researchers, or investigators.

The funnel: how the conversation actually starts

Every pig butchering case follows the same sequence, refined over millions of repetitions in scam compounds:

The contact vector matters. The wrong-number text — an apparently misdirected friendly message — is the industry standard opener precisely because it gives the victim a plausible, low-stakes reason to reply. From the scammer's side, a social engineering script like this is run at industrial scale: workers in compounds manage dozens of conversations simultaneously from templated playbooks, sometimes using AI translation and generation tools to operate across languages. The FBI has documented this industrialization in its awareness campaign, Operation Level Up, which describes pig butchering as a confidence-based scam run at population scale.

The one near-universal tell during grooming: the counterpart avoids live video calls. Voice is common (AI voice or a different worker), video is almost never available. The excuses are always mundane — a broken camera, a shy personality, a corporate policy.

The fake platform: a theater with a working cashier

The "trading platform" the victim is sent to is a fully fabricated website. It renders professional-looking charts, shows a live balance that grows exactly as promised, and even processes the first small withdrawal. The key insight for on-chain analysts: the balances are database entries in the scammer's control panel, not real positions on any exchange.

The fake platform exists to solve a single problem for the scammer — making the deposit feel like an investment rather than a transfer. To that end:

• Deposits go to addresses the scammer controls, described as "your dedicated account."

• The platform shows fake trading profits calibrated to keep the victim depositing. Modest, believable returns — 1–3% a week — are more effective than obviously impossible numbers.

• The first withdrawal request for a small amount is honored. This is the single most important trust-building step in the entire funnel, and it is deliberately budgeted as a cost of the scam.

• Fees, "taxes," or "verification deposits" appear only when the victim tries to withdraw a large amount or shows signs of stopping deposits. This is the extraction endgame: many victims pay the fake fee believing it unlocks their balance, sometimes repeatedly.

If a platform you cannot independently verify offers custody of your funds, treat it as a custodial wallet with zero accountability — because functionally, that is what it is.

What the money trail looks like on-chain

This is where on-chain analysis earns its keep, and where the story differs from the psychology-heavy mainstream coverage.

The deposit address. The victim's first transaction goes to a fresh address (or a deposit address inside a cluster) controlled by the operation. These addresses are usually clean — no prior history — because operations rotate them per victim or per small group of victims.

The collection layer. Deposits sit until they reach a threshold, then sweep into a collection wallet. This is the address worth flagging first: it aggregates inputs from many victim deposit addresses and is the operation's most identifiable on-chain entity. Tools that cluster addresses by behavioral fingerprint — the approach we cover in wallet risk scoring — often catch collection wallets before labels exist.

The laundering layer. From collection, funds typically split into peel chains, pass through cross-chain bridges to other networks, and land in nested custody services at major exchanges (small merchant accounts inside a big exchange, which are faster to open and slower to freeze than direct exchange wallets). You can trace the logic of this layer in detail in how stolen crypto is tracked.

The exit. Final conversion to fiat usually happens through over-the-counter desks in jurisdictions with weak enforcement, or through stablecoins held as a store of value by the operation itself. Stablecoin issuers can freeze funds at the contract level — one reason some operations now prefer other assets — but freezes require the issuer to receive a sufficiently specific report, fast.

A practical observation from published tracing work: speed dominates everything. Exchange compliance teams act on reports within hours when funds are still sitting at a deposit address. After the first bridge hop, the realistic recovery probability collapses.

The compounds: who is on the other side

The UN Office of the High Commissioner for Human Rights published a report in August 2023 estimating that at least 120,000 people in Myanmar and around 100,000 in Cambodia were being held in scam compounds and forced to conduct online fraud — a population largely trafficked through fake job advertisements. The workers running the grooming conversations are frequently victims themselves, working under threat, which is why the FBI and NGOs consistently frame the industry as both a fraud problem and a human trafficking problem.

For analysts, this explains a pattern visible in the scripts: conversation quality is uneven. The opening messages are polished templates; improvised responses to unusual questions are where the operation shows seams. Victims consistently report that asking for a video call or an off-script question produces delays, deflection, or a change of topic — because the worker has to escalate to a supervisor.

The recovery trap that follows the scam

A victim who loses money and posts about it publicly — in a forum, a complaint site, or social media — is often contacted within days by someone claiming to be a "blockchain investigator" or "fund recovery service" who can retrieve the stolen crypto for an upfront fee. These are almost universally follow-on scams targeting the same victim list, a category we break down separately in crypto recovery scams explained. The rule: anyone who promises recovery and asks for payment upfront is running the second half of the same playbook. Legitimate paths — IC3, exchange compliance, licensed counsel — do not charge victims a recovery fee before any result.

How to protect yourself and people around you

The protective measures are unglamorous but effective:

1. Treat any investment introduction from a stranger-met-online as presumptively fraudulent. The introduction channel, not the asset class, is the red flag.

2. Verify custody independently. If you cannot withdraw to your own non-custodial wallet address at will, you do not control the funds — regardless of what the dashboard shows.

3. Test withdrawals early and at size. A real platform lets a meaningful amount leave. A scam platform honors only trivial amounts.

4. Watch for the fee wall. Any "tax," "margin call," or "unlocking fee" demanded before withdrawal is the standard extraction script. No legitimate exchange charges a fee to release your own balance.

5. Keep custody hygiene separate from social apps. A hardware wallet used only for savings — never connected to anything a chat contact suggested — is immune to this entire category by construction.

If the loss has already happened: preserve everything (chat logs, platform URLs, deposit addresses, transaction hashes), report to IC3 at ic3.gov and your local police the same day, and send the deposit addresses and hashes to the compliance teams of any exchanges visible in the trail. It is not glamorous work, but it is the only sequence that has ever produced frozen funds.

Limitations of this analysis

On-chain analysis can trace the money, but it cannot recover sentiment or reverse a bridge hop, and it cannot identify compound workers behind nested accounts. Loss figures from IC3 reflect reported crime only — the true scale is understood to be larger. And the scam's structure keeps evolving: recent reporting documents AI-generated persona tools shortening the grooming phase. The fingerprint described above holds as of this writing; expect the details to keep shifting.

Related reading

• Crypto recovery scams explained — the second scam that targets pig butchering victims

• How to track stolen crypto — the tracing toolkit behind the money-trail section

• AI-powered crypto scams in 2026 — how generation tools industrialize the grooming phase

• Address risk scoring explained — how collection wallets get flagged

• How to avoid crypto phishing scams — the short-con counterpart to this long con

Originally published at https://theonchaindiary.com/articles/pig-butchering-scams-explained/. More Web3 security guides and risk-scoring tools at Onchain Diary.

You do not need to be a Solidity developer to read an audit report usefully. You need to know what questions each section answers — and which questions no audit can answer.

Why Audit Badges Mislead

A "Passed Audit" badge compresses a 40-page technical document into one pixel of information. That compression hides the three facts that determine whether the audit means anything:

1. Scope — which contracts were actually reviewed

2. Timing — whether the deployed code matches the audited code

3. Resolution — whether the findings were fixed, or just acknowledged

Projects know most users do not check these. Some exploit that. A protocol can commission an audit of one small utility contract, then display an audit badge site-wide. That is not lying, technically — but it is not security either. For a broader framework of warning signs that go beyond audits, see DeFi Protocol Red Flags.

The core concept is simple: an audit is a contract audit — a point-in-time review of a specific code snapshot by a specific team, paid for by the project. Understanding what that relationship implies is the first step to reading reports with the right skepticism.

The Standard Anatomy of an Audit Report

Most reports from reputable firms follow a similar structure. Here is what each section actually tells you:

Two of these sections do most of the work: scope and findings. The rest is context. Read those two carefully and skim the rest.

Reading the Scope Section (Where Audits Go to Die)

The scope section is the single most valuable part of the report, because it defines the boundary of the auditor's knowledge. Common patterns to recognize:

• Partial coverage. A protocol with 30 contracts may have audited 8. The unaudited 22 might include the bridge, the vault, or the upgrade logic — the exact components attackers target.

• Commit hash mismatch. The report references a specific commit. If the deployed contract on the block explorer does not correspond to that commit, the audit covers different code than what holds user funds. Projects sometimes ship "small changes" after an audit. Small changes have historically produced large exploits.

• Explicit exclusions. Scope sections often list what was not reviewed: admin functions, third-party integrations, off-chain components, deployment scripts. These exclusions are legitimate — auditors cannot review everything — but users should treat excluded components as unaudited, because they are.

• Upgradeability blind spots. If the system uses an upgradeable proxy, an audit of the current implementation says nothing about future implementations. Check whether upgrade authority sits behind a timelock and multisig. For how upgrade mechanisms get exploited, see Proxy Upgrade Attacks Explained.

A useful mental model: the scope section converts the question "is this protocol audited?" into "which parts of this protocol are audited?" The second question is the only one that has an answer.

Reading Findings and Severity Levels

Findings are typically graded Critical / High / Medium / Low / Informational. These grades estimate impact if exploited, not likelihood of exploitation:

Three reading mistakes to avoid:

Mistake 1: Counting only Critical findings. A report with zero Critical and twelve High findings is not a clean report. High findings describe realistic loss paths under specific conditions — in DeFi, specific conditions arrive eventually.

Mistake 2: Treating a long Informational list as dirt. Informational findings often just document centralization keys or known trade-offs. That is candor, not sloppiness. Conversely, a report with zero findings of any severity can indicate a shallow review — real code always has something to say.

Mistake 3: Ignoring fix status. A finding marked "Acknowledged" is a finding the project chose not to fix. Sometimes that is defensible (low impact, high fix cost). Sometimes it is the vulnerability that gets exploited later. The pattern to check: are unresolved findings concentrated in access control or fund-movement paths? Those are the ones that end lives.

To go deeper on the classes of bugs that show up in findings tables, read Reentrancy Attacks Explained and Oracle Manipulation in DeFi — understanding two or three canonical bug classes makes finding descriptions dramatically easier to parse.

The Four Questions No Audit Answers

Reports disclaim this in fine print, so make it explicit. An audit does not tell you:

1. Whether the deployed code matches the audited code. Verification is your job — check the contract address against the audited commit hash via the block explorer.

2. Whether keys are safe. Admin keys, upgrade keys, and oracle operator keys are usually out of scope. Multi-sig and timelock arrangements are governance questions, not audit questions. Centralized key control is one of the most common red flags in otherwise-audited protocols.

3. Whether future code will be safe. Post-audit changes are unaudited by definition. Continuous audit coverage (re-audits on every upgrade) is a strong positive signal; a single audit from two years ago is a weak one.

4. Whether the team is honest. Audits review code, not intentions. Insider rug paths — mint functions, pause powers, withdrawal asymmetry — may be fully visible in an audit and fully intended by the team.

For projects that take security seriously, audits are one layer among several: a public bug bounty program, formal verification on critical paths, timelocked admin actions, and incident response plans. A protocol with an audit and none of the rest is safer than one with nothing, but not by as much as its marketing implies.

A 10-Minute Checklist Before Trusting an "Audited" Project

Run this before any meaningful deposit:

1. Open the actual report — not the badge. If the full report is not publicly reachable, treat the audit as unverified.

2. Note the auditor name and date. Check the engagement size: a two-day review and a three-week review are different products.

3. Compare the scope's commit hash with the deployed contract. Mismatch = the audit does not cover live code.

4. List what the scope excludes. Ask whether excluded components touch user funds.

5. Count findings by severity, then check the status of every Critical and High: Fixed and re-tested, or Acknowledged?

6. Check upgrade mechanics: proxy? timelock? multisig? Who can change the rules, and how quickly?

7. Look for a live bug bounty program and its max payout — bounty size is a rough proxy for how much the project values finding bugs before attackers do.

8. Check whether the audit firm itself has a reputation that survives scrutiny. Unknown firms produce reports that look identical to good ones.

9. Cross-check on-chain: token flows, treasury composition, and holder concentration tell you things no document will. Start with How to Verify a Token Before Buying and How to Audit Your Wallet Activity.

10. Re-run this checklist whenever the protocol ships an upgrade — an audit ages with the code it reviewed.

Where Reports Actually Live

Legitimate projects make reports easy to find: linked from the docs security section, in the GitHub repository, or on the auditing firm's own site under published engagements. Bookmark the report itself rather than the project's claims page — the PDF cannot be quietly edited the way a website can, and firms keep their published lists independent of the projects.

If you can only find the badge and never the document, you have learned everything the project wanted you to know — and nothing you needed to know.

Limitations of This Guide

Reading an audit report well does not make you a security researcher. It makes you a harder target for lazily-marketed risk. You can still be fooled by a competent, fully-audited, intentionally malicious project — that failure mode requires on-chain monitoring and community diligence, not document literacy. Use this skill as a filter for obvious nonsense, then stack it with the other checks in your process.

Conclusion

Audit reports are one of the few genuinely free, information-dense artifacts in crypto security — most users just never open them. Scope tells you what the auditor saw. Findings tell you what they found. Fix statuses tell you what the project did about it. Everything else on the website is a compressed, curated version of those three facts. Ten minutes with the source document beats any badge.

Related Reading

• Contract Audit — what an audit engagement actually involves

• Bug Bounty — continuous security after the audit ends

• DeFi Protocol Red Flags — warning signs beyond audits

• Proxy Upgrade Attacks Explained — why upgradeability weakens audit guarantees

• Oracle Manipulation in DeFi — a canonical Critical-finding class

• Reentrancy Attacks Explained — the classic finding that keeps reappearing

• ERC-20 Token Security Check — hands-on verification workflow

Originally published at https://theonchaindiary.com/articles/how-to-read-a-smart-contract-audit-report/. More Web3 security guides and risk-scoring tools at Onchain Diary.

This article is the NFT-specific companion to our general guide on wash trading detection. Where that guide covers the shared mechanics across DEXs and NFT markets, this one goes deep on the NFT side only: the concrete patterns wash traders leave, the order to check them in, and the math that turns suspicion into a defensible conclusion.

Why NFT wash trading is its own discipline

Token wash trading on a DEX has one target: the volume rank on trackers. NFT wash trading is richer, because an NFT collection has more surfaces to manipulate:

That last row is the subtle one. NFT valuation is comparative — buyers price a token against recent sales of similar rarity. Wash traders know this: a handful of controlled sales at escalating prices re-prices every comparable token in the collection. This is why wash trading on NFTs persists even when volume rankings stop mattering.

The scale is not theoretical. Chainalysis documented collections where the same NFTs were sold back and forth at least 25 times by the same small group of wallets, and separately tracked 110 wash traders who collectively extracted about $8.9 million in profit. A 2026 study summarized by Boston University's Hariri Institute put the pattern footprint at roughly 38% of NFT trades and 60% of traded value across several major marketplaces. The baseline assumption for any unvetted collection should be that some share of its activity is staged.

The five signals, in the order you should check them

Time is the constraint. These checks are ordered by signal-per-minute: the first two catch the majority of wash trading, the rest turn a strong suspicion into a documented case.

1. Token ID recycling between a fixed wallet set

This is the master pattern. Pull the transfer history of the collection's most-traded token IDs, then look at the wallets on each side.

What organic trading looks like: a token is sold by A to B; B holds for weeks or months; eventually sells to C. Buyer and seller wallets have no prior relationship with each other around that token.

What wash trading looks like:

Token #4471:
  0xa1... → 0xb2...   0.8 ETH   (day 1)
  0xb2... → 0xa1...   1.1 ETH   (day 2)
  0xa1... → 0xc3...   1.4 ETH   (day 4)
  0xc3... → 0xb2...   1.7 ETH   (day 5)
  0xb2... → 0xa1...   2.1 ETH   (day 7)

Three wallets, one token, five sales, always rising, custody never actually leaving the group. The token ID is the giveaway — fungible-token wash loops can rotate tokens, but NFT manipulators need to re-price specific tokens, so the same IDs recur.

Check it: on a block explorer, open the collection contract, sort transfers by token ID frequency, and read the counterparty pattern for the top 5–10 most-traded IDs. Ten minutes, no tools beyond the explorer.

2. Funding forensics: who paid for the buyer

Wash wallets need gas and purchase funds, and operators are lazy about hygiene. The most common structure: the seller's wallet (or its upstream) funded the buyer's wallet days or hours before the sale. If buyer B's ETH to buy token #4471 can be traced to seller A's cash-out address, the sale was internal by construction.

This is the single strongest single-hops check available, and it is why professional investigators treat funding analysis as the backbone of wash-trading cases — the trade can lie about intent, but the money's origin cannot. We cover the wallet-clustering techniques behind this in wallet labels explained.

Check it: for a suspicious sale, click through the buyer wallet's inbound ETH transfers. One or two hops back, if you land on the seller or another member of the recycling set, you have your answer.

3. Round-trip cost math

Wash trading is a business with unit economics. Each round trip pays: gas, marketplace fee, and creator royalty. If a collection trades heavily only on zero-royalty venues or low-fee chains, that is not a coincidence — it is the cost structure the operation requires.

Rough model for a 1 ETH round trip:

An operator planning dozens of wash loops per collection cannot survive the left column; they can mass-produce the right column. So when you see a collection whose "organic surge" all routes through one particular zero-royalty marketplace, weight that heavily.

Check it: compare a collection's volume distribution across marketplaces against comparable collections. A single-venue monopoly on volume, especially a low-fee one, is a structural red flag independent of any individual wallet check.

4. Timing regularity

Humans do not trade on a metronome. Bots do. Export the sale timestamps of the suspect window and compute the intervals: wash operations frequently fire on fixed schedules — every block, every N minutes, or evenly spaced across a session — because a script drives them. Mixed in with signal 1 (recycled token IDs), metronomic timing is close to a confession.

This is the same automation signature we describe for DEX manipulation in the general wash trading guide, and it is robust: even if an operator randomizes counterparties, un-randomizing the schedule is a step most never take.

Check it: eyeball the sale list first — timestamps ending in suspiciously even spacing (exactly 60s apart, exactly one block apart) are often visible without any analysis. For rigor, compute interval standard deviation; near-zero variance means automation.

5. Volume decay after organic entry

The exit leaves a shadow. Wash volume exists to attract organic buyers; once enough real money has entered and the operators have sold their inventory, maintaining the loop has no payback. The pattern: weeks of sustained high volume, a final distribution window where holdings fan out to fresh wallets, then volume collapses 80–95% and never recovers — while the floor follows it down.

Retrospectively, this decay curve is how you confirm what a live investigation only suspects. Prospectively, it is a warning label: a collection whose volume chart shows one sustained plateau and no organic baseline is showing you the lifecycle of a wash operation, not adoption.

Check it: any NFT analytics page with a collection's 90-day volume history. You are looking for the shape, not the numbers.

A Dune-style query to start from

For analysts who want to batch the first check across a whole collection, this is the core query shape: find token IDs whose sales repeatedly involve a small fixed counterparty set.

-- Most-recycled token IDs in a collection:
-- pairs of (seller, buyer) appearing repeatedly on the same token
WITH sales AS (
  SELECT
    "contract_tokenid" AS token_id,
    "from"            AS seller,
    "to"              AS buyer,
    block_time
  FROM nft.trades
  WHERE nft_contract_address = CONCAT('\x', 'YOUR_COLLECTION_ADDRESS')
    AND block_time >= NOW() - INTERVAL '90' DAY
)
SELECT
  token_id,
  seller,
  buyer,
  COUNT(*)          AS sales_between_pair,
  MIN(price_raw)    AS first_price,
  MAX(price_raw)    AS last_price
FROM sales
GROUP BY token_id, seller, buyer
HAVING COUNT(*) >= 3
ORDER BY sales_between_pair DESC
LIMIT 50;

Rows where sales_between_pair is high, the same seller/buyer pair recurs across many token IDs, and last_price towers over first_price — that is your recycling set. From there, take the top wallets into the funding check (signal 2). The exact schema depends on the spellbook table you use, but the shape of the query — count trades per (token, pair) — is the heart of NFT wash detection.

What the tools will and will not tell you

Marketplace analytics dashboards will show you volume, floor, and holder distribution, but they aggregate over the very behavior you need to see individually. The productive division of labor:

• Explorers (Etherscan, and equivalents per chain): token-level transfer history, wallet funding chains — signals 1 and 2.

• Dune / spellbook tables: batch recycling and timing analysis at collection scale — signals 1, 3, 4.

• Holder distribution views: concentration among a small number of active wallets — the precondition for everything above; see analyzing token distribution for the general method.

• Everything else: treat as marketing surfaces until proven otherwise. A trending rank is an output that wash trading directly targets — it is evidence of nothing.

Limitations

Sophisticated operations defeat each signal individually: wallets can be freshly funded from clean sources, timing can be jittered, sales can be split across venues. What they cannot easily defeat is the conjunction — a recycling set and traceable funding and metronomic timing and single-venue cost structure at once. Absence of all five is the only near-clear bill of health, and even that decays as collections age. The 25+ sale loops Chainalysis found were the careless operators; the careful ones simply have not been caught yet.

Related reading

• Wash trading detection explained — the general guide: DEX volume inflation, volume-to-liquidity ratios, holder concentration

• Analyzing token distribution — holder concentration as the precondition check

• Wallet labels explained — how flagged entities propagate across the clustering layer

• Wash trading / Floor price / Royalty — core concepts

• How to read a blockchain explorer — the tool skills signals 1 and 2 assume

Originally published at https://theonchaindiary.com/articles/how-to-detect-nft-wash-trading/. More Web3 security guides and risk-scoring tools at Onchain Diary.

Clipboard hijacking malware attacks exactly that assumption. This article explains the mechanism, the documented campaigns, how the attack differs from its no-malware cousin address poisoning, and the verification habits that make the whole class of attacks pointless.

How the attack works, step by step

A clipboard hijacker is a small resident process — often bundled inside cracked software, fake installers, pirated games, malicious browser extensions, or trojanized "mining" and "trading assistant" apps. Its logic is minimal:

1. Monitor. The malware registers a clipboard-format listener with the operating system. Every time the clipboard content changes, the malware receives a copy of it.

2. Match. The content is tested against address patterns: Bitcoin base58 ranges, Ethereum-style 0x plus 40 hex characters, TRON T... base58, Monero addresses, XRP tags, and so on. Modern kits ship thousands of patterns covering dozens of chains.

3. Replace. If the clipboard holds an address for a supported chain, the malware overwrites it with the attacker's address for that same chain — matched by pattern, so the replacement is always format-valid.

4. Wait. The victim pastes what they believe is the copied address. Wallet clients, exchange withdrawal forms, and payment pages all accept it, because it is a syntactically perfect address.

The critical property of this attack: nothing about the resulting transaction is anomalous. It is correctly signed, correctly formatted, sent from the victim's own wallet. On-chain, it looks like an ordinary transfer to a fresh address. This is why the attack has survived a decade of blockchain security improvements — none of them are aimed at the clipboard, and the blockchain layer was never the target.

Documented campaigns and capabilities

The attack class is not theoretical:

• 2018 — the 2.3-million-address operation. In July 2018, security researchers (reported by TechCrunch) documented a Windows clipboard hijacker called Electro (Dorminet) that monitored a hardcoded list of roughly 2.3 million cryptocurrency addresses, replacing any match with the attacker's own. The list skewed toward Bitcoin and other base58 chains. The sheer size of the address list was the story: the operators precomputed every high-value address worth watching.

• Clipboard injectors as a service. Kaspersky's Securelist research ("Copy-paste heist") documented clipboard-injector malware families targeting Bitcoin, Ethereum, Litecoin, Dogecoin, and Monero, distributed as malware-as-a-service — operators rent the builder, the address list is customizable, and revenue splits mirror the drainer-kit economy. The service model explains the attack's persistence: no specialization required, just rental.

• Persistent commodity detections. Every major antivirus vendor maintains removal guidance for clipboard hijacker families, and user reports of "the address I paste is different from the one I copied" recur continuously on security forums — the predictable signature of an attack that never fully dies because the distribution channels (cracked software, fake downloads) never dry up.

The economics favor the attacker enormously. A single successful swap can redirect a life-changing transfer, and the malware's footprint is tiny enough that many infections go unnoticed for months.

Clipboard hijacking vs. address poisoning vs. drainers

These three attacks are frequently confused because they all end with "funds left to an address I didn't choose." They are different machines:

Address poisoning — covered in depth in address poisoning attacks explained — is the elegant cousin: it needs no code execution on your machine, only your transaction history and your trust in it. Attackers generate vanity addresses matching the first and last characters of an address you transact with, then send negligible dust transfers so the fake address appears in your history. Months later, the victim copies it while making a repeat payment.

Wallet drainers, by contrast, don't care where the address comes from — they go after signatures and approvals, the pattern we dissect in signature scam explained. The common thread across all three: each attack targets a moment where you delegate verification to memory or to an unexamined paste.

The two-second habit that defeats the entire class

The defense is not a product. It is a verification reflex, applied at the last moment before confirming:

1. After pasting, compare the first six and last six characters of the address on the confirmation screen against the source you copied from, character by character. Middle characters are where humans don't look and where attackers don't bother matching; the ends are cheap to check and hard to fake simultaneously. This one habit defeats clipboard hijackers, address poisoning, and typo-squatting replacement alike.

2. Use the address book. Every major wallet and exchange supports saved, whitelisted withdrawal addresses. Send a trivial test amount the first time. After that, treat any change to a saved address as a security event — not a preference update.

3. Check the clipboard itself. Paste into a plain text editor before pasting into anything financial. If what appears differs from what you copied, the device — not the address — is the problem.

4. Don't transact on a device you don't trust. Clipboard malware arrives with cracked software and sketchy installs. The machine you use to move life-changing amounts of crypto should be boring: minimal software, standard sources, updated OS, mainstream antivirus running.

5. Use amount tiering. Whitelisted address plus small test transaction plus delayed large transfer is a three-layer filter that defeats silent substitution — a hijacker that swaps a test transfer's address has revealed itself for the price of dust.

For custodial flows, exchange-side address whitelisting with a time-locked change process (typically 24–48 hours) means even a successful clipboard swap on your device cannot redirect funds without a waiting period you would notice.

What this looks like to an on-chain analyst

If you are tracing a victim's transaction history, a clipboard-hijack loss has a distinctive shape: a normal, correctly-formatted transfer to a previously unseen address, often followed by an immediate peel-chain sweep, with no associated approval transactions, no interaction with any contract the victim had used before, and no connection between the victim and the receiving address beyond this single transfer. That "clean single hop into a fresh address" pattern — combined with a victim who insists the address was copied from a legitimate source — is the classic post-hoc signature. From there, the tracing playbook is the standard one covered in how to track stolen crypto: cluster the receiving address, follow the sweep, identify the exit point, and report to the exchange compliance team while funds are still visible.

The receiving addresses used by clipboard operations are worth flagging in risk databases for exactly this reason — they are the operation's reusable infrastructure, and unlike one-shot drainer contracts, they often serve many victims.

Limitations

No defense habit helps if the wallet software itself is trojanized — a fake wallet app can display the right address while signing a different transaction, which is a supply-chain problem rather than a clipboard problem. And verification habits depend on the human executing them every single time; attackers need one lapse, defenders need all of them. That asymmetry is the honest reason this attack class, first documented in 2018, still earns money in 2026.

Related reading

• Address poisoning attacks explained — the no-malware version of the same attack moment

• How to audit your wallet activity — catching an unknown transfer before it compounds

• Signature scam explained — the drainer-side attack on approvals

• How to track stolen crypto — the tracing playbook after the fact

• Crypto dusting attacks explained — dust as both surveillance and poisoning fuel

Originally published at https://theonchaindiary.com/articles/clipboard-hijacking-malware-explained/. More Web3 security guides and risk-scoring tools at Onchain Diary.

Nothing about this is a gift.

Unsolicited airdrops are one of the highest-volume attack surfaces in crypto precisely because receiving an asset feels different from clicking a link. This guide covers the variants (bait tokens, bait NFTs, the import scam, dusting), what interaction actually costs you, and the only correct response. It is part of our Airdrop Safety series; for the drainer mechanics behind the claim pages, read how the biggest airdrop scams work.

Why the trick works: receiving feels like proof

The exploit is psychological inversion. When you go looking for an airdrop, some skepticism is active — you chose to visit the site. When the airdrop comes to you, the situation feels inverted: they found me, which feels like eligibility.

But sending tokens to addresses is nearly free and completely permissionless. An attacker who has your address — harvested from a previous transaction, a leaked database, or generated in bulk — can spam millions of wallets for the cost of gas on a cheap chain. Scam Sniffer documented a single wave of roughly 1,354 malicious NFTs on Polygon impersonating legitimate airdrops that stole about $1.25 million — the send cost almost nothing, the yield was enormous.

Your address is public by design. Anything can be sent to it. Receiving is not consent, and it is not evidence of anything except that your address exists.

The four payloads hiding in a spam airdrop

1. The claim link. The most common form: the token or NFT name, symbol, or metadata contains a URL — "claim your rewards at [domain]" or "visit to activate." The site behind it is a standard drainer page: connect wallet, "verify eligibility," sign an approval or permit. The signature mechanics are covered in airdrop signature scams; the short version is you grant spending rights and never see the transfer that empties you.

2. The import-token scam. The token's description tells you it will not display in your wallet until you "import" it at a linked site. The import page eventually asks for your seed phrase or private key "to sync the token." There is no legitimate version of this — no token import in any wallet requires your recovery phrase. This variant harvests wallets wholesale rather than draining them transaction by transaction.

3. Dusting and de-anonymization. In its dusting attack form, the tiny unsolicited transfer is not bait for a click — it is a tracer. If you later move that dust (or consolidate accounts), the attacker can cluster your addresses and build a profile of your holdings for targeted phishing. We cover the mechanics in crypto dusting attacks explained.

4. Address poisoning setup. Some unsolicited transfers exist to pollute your transaction history with lookalike addresses, so a future copy-paste of a "recent counterparty" goes to the attacker. The details are in address poisoning attacks explained.

What interaction costs you

Every response to a spam airdrop leaks something, in ascending order of damage:

• Claiming. Signature-based drain — potentially every asset the connected wallet holds under approval.

• Importing. Total wallet surrender if a seed phrase is typed anywhere.

• Sending it back or burning. Confirms a live, human-operated address — raising your value in targeted attack lists — and can seed poisoning patterns.

• Even browsing the linked site. Confirms a clickable target and exposes you to clipboard-hijacking style tricks; see clipboard hijacking for how copied addresses get swapped mid-paste.

The asymmetry is the point: every action pays the attacker, and inaction pays nobody.

The correct response: nothing

1. Do not click anything embedded in the token's name or metadata. The URL is the payload.

2. Do not import, sync, or "activate" the token. No real token needs this.

3. Do not sign anything to "claim" it. If you are curious whether an airdrop could be real, verify independently: find the project's official claim documentation from its own site and GitHub, then run the on-chain verification workflow — contract age, deployer history, holder distribution.

4. Read the transfer as data, not mail. If you want to know who sent it, look at the sender and token contract on a block explorer — reading is free. Learn the habit in how to read a blockchain explorer.

5. Hide the asset if you want. Most wallets let you hide spam tokens. Hiding changes nothing on-chain; it just removes the noise.

Special case: the NFT you cannot sell

Bait NFTs often show a floor-price-looking value in aggregator sites — unsellable, because no marketplace liquidity exists. Listing it is usually harmless in itself but marks the address active, and some "listing" flows on fake marketplaces are themselves signature traps. If an NFT arrived uninvited and something urges you to act on it, that urgency is the tell.

One habit that covers all of it

Treat every asset you did not consciously acquire as untrusted input — the same way you treat a DM from a stranger. The fake token glossary entry covers the token-side mechanics, and how to verify a token before buying the diligence side. For the complete pre-claim checklist, see the airdrop safety checklist.

Unwanted airdrops will not stop — sending is permissionless. The defense is a flat, boring policy: it appeared, therefore I ignore it. No exceptions for large balances, official-looking names, or limited-time language. That policy costs you nothing and breaks every variant above.

Originally published at https://theonchaindiary.com/articles/unsolicited-airdrop-tokens/. More Web3 security guides and risk-scoring tools at Onchain Diary.

Token taxes — also called transaction fees, buy taxes, or sell taxes — are programmable fees built into a token's smart contract. They are neither inherently good nor inherently evil. Legitimate projects use them to fund development, distribute rewards, or create deflationary pressure. Scammers use the exact same mechanism to trap funds, extract value, and execute rug pulls. The difference is entirely in the implementation details.

This guide explains how token taxes work at the contract level, what separates legitimate tax mechanics from predatory ones, and how to verify tax rates before you ever connect your wallet.

BLUF: Token taxes are programmable fees on buys and sells, coded into the token contract. Safe tax rates are typically 1–10%, transparent, and hard-capped in the contract code. Dangerous patterns include taxes above 25%, variable rates the owner can change at will, asymmetric buy/sell taxes (low buy, high sell), and any tax the owner can set to 100% — which creates a honeypot. Always check the contract source code on a block explorer for the tax function and the maximum rate before buying. Use honeypot detection tools like Honeypot.is or Token Sniffer to simulate the buy and sell in a sandbox.

How Token Taxes Work at the Contract Level

A standard ERC-20 token has a simple transfer function: move tokens from address A to address B, update balances, emit an event. No fees, no conditions.

A token with taxes modifies this flow. When a transfer happens — specifically when tokens move to or from a DEX liquidity pool — the contract intercepts the transfer, calculates a percentage-based fee, and redirects that fee somewhere other than the recipient.

The Modified Transfer Flow

Here is what happens during a taxed buy on Uniswap:

1. User calls Uniswap swap function
2. DEX pool sends tokens to user's wallet
3. Token contract intercepts the transfer
4. Contract checks: is the sender a DEX pool?
5. If yes → apply buy tax (e.g., 5%)
6. Deduct 5% of the transfer amount
7. Send 95% to the user, 5% to the fee wallet (or burn it)

For sells, the flow is reversed:

1. User sends tokens to the DEX pool
2. Token contract intercepts the transfer
3. Contract checks: is the recipient a DEX pool?
4. If yes → apply sell tax (e.g., 10%)
5. Deduct 10% of the transfer amount
6. Send 90% to the DEX pool, 10% to the fee wallet

The critical word is "intercepts." The token contract's _transfer function has been modified to add conditional logic. This is the same mechanism that honeypots use — the only difference is whether the condition results in "take a fee" or "block the transaction entirely."

Where the Tax Tokens Go

Taxed tokens are redirected to one of several destinations:

The destination matters as much as the rate. A 5% tax to a transparent multi-sig wallet is reasonable. A 5% tax to a single anonymous EOA is just a slower rug pull.

Legitimate Uses of Token Taxes

Not all token taxes are scams. Well-known projects have used them effectively:

Automated liquidity provisioning. Tokens like SafeMoon popularized the "auto-LP" tax: a small percentage of each transaction is used to add liquidity to the DEX pool automatically. This gradually increases price stability and reduces slippage. The mechanism is legitimate when the LP tokens are locked and the rate is modest (1–3%).

Deflationary mechanics. Some tokens burn a percentage of each transaction, reducing total supply over time. This is transparent and verifiable on-chain — you can watch the burn address balance increase with every transaction. See deflationary token for how this works.

Reflection rewards. Holder-reward tokens distribute transaction fees proportionally to all holders. This creates a passive income stream without requiring users to stake. The implementation is complex and has been the source of bugs, but the concept is valid.

Ecosystem funding. Gaming tokens, DeFi protocol tokens, and community coins often charge 1–5% to fund development grants, marketing, or ecosystem growth. This is functionally similar to a management fee in traditional finance.

What Makes a Tax Legitimate

How Scammers Weaponize Token Taxes

Token taxes become weapons when the contract owner can change the rate at will. Here are the patterns seen repeatedly in exit scams.

Pattern 1: The Bait-and-Switch

The token launches with a 2% buy tax and 2% sell tax. Users buy confidently. Trading volume increases. The community grows. Then, weeks later, the owner calls setSellTax(100) — every sell transaction now sends 100% of the tokens to the fee address. No one can exit. The owner then removes liquidity.

How to detect: Check if the contract has a setFee(), setTax(), setSellTax(), or similar function. If that function exists and has no upper-bound check, the owner can rug at any time.

// DANGEROUS — owner can set any tax rate
function setSellTax(uint256 newTax) external onlyOwner {
    sellTax = newTax; // No require(newTax <= MAX_TAX)
}

// SAFER — tax is capped
uint256 public constant MAX_TAX = 10; // 10% hard cap
function setSellTax(uint256 newTax) external onlyOwner {
    require(newTax <= MAX_TAX, "Tax exceeds maximum");
    sellTax = newTax;
}

Even the "safer" version is not risk-free — the owner can still change the rate up to 10% without notice. The safest version renounces ownership entirely or time-locks the admin key.

Pattern 2: Asymmetric Taxes

Buy tax: 1%. Sell tax: 50%. This creates a trap where entering is cheap but exiting is devastating. Users buy, the price pumps (because demand is uninhibited), and early sellers lose half their tokens to the fee. Late sellers discover the sell tax has increased further — the owner raises it as the pool fills up.

Red flag: Any token where the sell tax is more than 3x the buy tax. Legitimate projects rarely need dramatically higher sell taxes unless they are explicitly anti-speculation (even then, 10–15% is the upper bound of reasonableness).

Pattern 3: Hidden Tax via Slippage

Some contracts do not expose tax settings as obvious function names. Instead, they manipulate the _transfer function to deduct tokens silently based on internal logic that is hard to audit — dynamic taxes based on time of day, wallet size, or arbitrary conditions.

How to detect: This is where honeypot detection tools become essential. Reading the source code may not be enough if the logic is obfuscated with complex conditionals. Always run a honeypot simulation.

Pattern 4: Tax to an Unlabeled Wallet

Even a seemingly reasonable 5% tax becomes a scam when the 5% flows to a wallet the owner controls and can drain at any time. The tax is not funding development — it is a slow extraction.

How to detect: Check the fee recipient address on a block explorer. If it is an unlabeled EOA with regular withdrawals to an exchange, it is a personal drain, not a treasury.

How to Check Token Tax Rates Before Buying

Never rely on the project's website or social media for tax information. They can claim "5% tax" while the contract allows the owner to change it to 50%. Always verify on-chain.

Method 1: Read the Contract Source Code

1. Find the token contract address on a block explorer (Etherscan, BscScan, Polygonscan)

2. Go to the Contract tab and confirm source code is verified

3. Search the code for: _fee, _tax, _feeNum, buyFee, sellFee, taxFee, setFee, setTax, SWITCH, tradingEnabled

4. Check for a MAX_FEE or MAX_TAX constant — if it exists, that is the ceiling

5. Check the _transfer function for conditional fee logic

If you want a deeper guide to reading contract source code, see our ERC-20 token security check guide, which walks through every function an auditor examines.

Method 2: Use Honeypot Detection Tools

These tools simulate a buy and sell transaction in a sandbox, showing you the actual tax rates applied:

Run at least two of these tools. If they disagree, the contract may have dynamic tax logic that changes based on conditions. Treat disagreement as a red flag.

Method 3: Check Transaction History

On the block explorer, look at recent sell transactions for the token:

1. Find a recent sell transaction on the DEX

2. Check the input token amount vs. the output amount

3. Calculate the effective tax rate: 1 - (actual_output / expected_output)

4. If sells are failing (status = reverted), the token may have a 100% sell tax or is a full honeypot

Method 4: Test with a Small Amount

If you must buy, test with the minimum tradeable amount first. Buy a small quantity, then immediately try to sell. Compare the received amounts to what the DEX UI predicted. This is the most reliable test, but it costs gas and you may still lose the test amount if the token is a scam.

Tax-Related Smart Contract Patterns to Avoid

These patterns in the source code are strong indicators that the token tax is weaponized:

Real-World Example: The Anatomy of a Tax Scam

A common pattern on BNB Chain in 2023–2024:

1. Developer creates a token with a 5% buy tax and 5% sell tax, fee goes to a "marketing wallet"

2. Token is promoted heavily on Telegram and Twitter

3. Early buyers profit, the price pumps 10–50x

4. Developer waits until the liquidity pool reaches $200K–$500K

5. Developer calls setSellTax(99) — sell tax jumps to 99%

6. Panic selling begins, but every sell sends 99% to the developer's wallet

7. Developer drains the accumulated tax tokens, removes liquidity, disappears

This entire sequence is visible on-chain. The setSellTax transaction is public. The tax wallet's outgoing transactions are public. But most victims never check until it is too late. This is why checking the contract's admin functions before buying — not after — is critical.

For a broader guide on verifying tokens, see our complete token verification checklist.

Token Taxes vs. Other Fee Mechanisms

Token taxes are sometimes confused with other types of crypto fees:

Token taxes are unique because they are controlled by the token developer — not the DEX, not the network, and not the user. This is why they require the most scrutiny.

Frequently Asked Questions

Q: What is a safe token tax rate?

A: Generally, 1–10% total (buy + sell combined) is considered reasonable for legitimate projects. Anything above 15% requires strong justification. Above 25% is almost always predatory. A hard cap in the contract code (e.g., MAX_TAX = 10) is an important safety signal.

Q: Can the owner change the tax after I buy?

A: Only if the contract has a setter function (like setSellTax) and ownership has not been renounced. Always check. If ownership is renounced (the owner address is set to the burn address), the tax rate is permanent.

Q: How is token tax different from a honeypot?

A: A honeypot blocks selling entirely. A token tax reduces the amount you receive but still allows selling. However, a 99% sell tax is functionally identical to a honeypot — you can "sell" but receive almost nothing.

Q: Are token taxes visible on DEX interfaces like Uniswap?

A: Partially. Uniswap's interface shows the price impact of your trade, which includes tax, but does not break it out separately. Tools like DexScreener and Poocoin display tax rates explicitly. Always cross-reference with on-chain data.

Q: Can I avoid token taxes?

A: No. The tax is enforced by the smart contract code. If the contract applies a 10% sell tax, every sell transaction pays it. There is no workaround without exploiting a vulnerability in the contract — which would be a separate security issue.

Q: Do token taxes exist on all blockchains?

A: Token taxes are most common on EVM chains (Ethereum, BNB Chain, Polygon, Arbitrum, Base) where ERC-20-compatible contracts allow custom transfer logic. They are rare on Solana, where the SPL token standard does not natively support custom transfer fees in the same way. For chain-specific safety, see our guides for Base, Solana, and Arbitrum.

Summary Checklist

Before buying any token with a transaction tax, verify these items:

• Source code is verified on a block explorer

• Buy tax and sell tax rates are identified in the code

• Tax rate has a hard-coded maximum (MAX_TAX or equivalent)

• Buy and sell taxes are symmetric (or close)

• Fee recipient is a multi-sig wallet or burn address, not a single EOA

• Contract ownership is renounced or admin functions are time-locked

• No blacklist, trading-pause, or per-address tax functions

• Honeypot simulation (Honeypot.is or Token Sniffer) passes

• Recent sell transactions succeed on-chain with reasonable effective rates

If any item fails, treat the token as high risk. If three or more items fail, do not buy.

Token taxes are a tool. Used responsibly, they fund legitimate projects. Weaponized, they are one of the most common mechanisms for extracting value from unsuspecting buyers. The contract source code does not lie — verify before you buy. For more on protecting yourself against malicious contracts, see our guides on spotting rug pulls and honeypots and preventing wallet drainers.

Originally published at https://theonchaindiary.com/articles/token-taxes-explained/. More Web3 security guides and risk-scoring tools at Onchain Diary.

The farming itself is not the problem. Testnet tokens are worthless by design, and a genuine testnet transaction can't touch your mainnet assets. The problem is that testnet seasons create the perfect hunting ground: a concentrated population of users who are trained to connect wallets to new sites and sign things repeatedly. This guide covers what actually goes wrong and the workflow that makes it stop mattering.

What testnet scammers actually do

Three attack patterns account for nearly everything:

Seed phrase harvesting. The site presents itself as a faucet or eligibility checker and asks you to "import" or "verify" your wallet by entering the recovery phrase. Sometimes dressed up as a sync step or KYC. No legitimate service — faucet, testnet, airdrop checker, or otherwise — ever needs your seed phrase. There is no version of this that is real.

Network bait-and-switch. You connect on what looks like a testnet dashboard, click claim, and the wallet prompt is actually a mainnet transaction — an unlimited approval or permit signature to a drainer contract. The tell is in the signing prompt itself: the network field, the contract address, and what's being approved. People click through because they've signed twenty harmless testnet transactions that week and their guard is down. Muscle memory is the vulnerability.

Fake task lists and point checkers. These harvest wallet connections and build a targeting list, then DM users personalized phishing links ("you have unclaimed points, verify here"). The checker itself may even work; the follow-up DM is the weapon.

The safe testnet workflow

Four habits, in order of leverage:

1. Dedicated burner wallet. Create a fresh wallet used only for testnets and airdrop farming. It holds nothing on mainnet — or only the gas needed when a legitimate claim later requires a mainnet transaction. When a "testnet" site turns out to be a mainnet drainer, the attacker gets an empty wallet. Generate it from a separate seed phrase stored the same way as your main one.

2. The seed phrase firewall. Your recovery phrase gets typed exactly two places: when you create the wallet, and when you restore it in a wallet app you chose. Any other prompt asking for it — faucet, checker, support agent, "sync" — is a scam by definition. This rule has no exceptions in eleven years of crypto.

3. Read the signing prompt, every time. Before approving, check three fields: the network (does it say the testnet you expect?), the contract (does the address match the one in the project's official docs?), and the permission (is it a plain transfer, or an approval — and if an approval, what amount?). Unlimited approvals are the signature of drainers. Reject anything that doesn't check out, and treat "verification messages" that don't clearly state what they authorize as hostile.

4. Verify domains from official sources only. The project's X account, GitHub, or docs — never a DM link, never a sponsored search result. Lookalike domains (extra letters, hyphens, wrong TLD) are the default drainer delivery mechanism. Bookmark the real dashboards after verifying once, then only use the bookmarks.

On-chain checks before any claim

When a testnet season graduates to a real token claim, the game changes — now there are mainnet contracts involved. Before connecting anywhere:

Trace the claim contract. The official announcement links a contract address; open it on the chain's block explorer and check its age (deployed last week is a warning), verification status, and whether it holds the permissions drainers need. Check the deployer: a contract deployed by an account created two days before the announcement is not a project contract.

For token contracts, holder distribution tells most of the story — a legitimate distribution has many small holders; a scam concentrates supply in a few fresh wallets. Automated risk scanners (Token Sniffer, GoPlus) compress these checks into a score if you don't want to do them manually.

Our wallet drainer identification guide covers the approval patterns to recognize before signing, and Permit2 exploits explained breaks down the single-signature approval abuse that powers most modern drainer kits.

If something went wrong

Signed something suspicious on your burner wallet: let it go, rotate to a fresh burner, and revoke approvals on the old one for hygiene. Signed something on your main wallet: immediately revoke all token approvals via a revocation tool, move high-value assets to a fresh wallet, and check your transaction history for transfers you didn't make. The post-incident guide covers tracing next steps on-chain.

Testnet seasons will keep coming, and the scam infrastructure around them industrializes a little more each cycle. The farmers who last are not the most suspicious — they're the ones whose setup makes suspicion mostly unnecessary. An empty dedicated wallet turns almost every attack in this category into a non-event.

Originally published at https://theonchaindiary.com/articles/testnet-airdrop-safety/. More Web3 security guides and risk-scoring tools at Onchain Diary.

This is not an Ethereum problem or a Base problem. It is a Solana problem, and Solana has unique characteristics that make these scams both more frequent and structurally different from EVM chain scams. If you apply Ethereum-based verification logic to Solana tokens, you will miss the most critical risk factors.

Solana processed over $300 billion in decentralized exchange volume in Q1 2025 — more than Ethereum and Base combined. That liquidity, combined with sub-cent transaction fees and a culture that treats memecoins as legitimate investment vehicles, has created the most active scam ecosystem in crypto. This guide covers the specific risks of buying tokens on Solana, the tools that actually work on this chain, and the exact verification steps you should run before connecting your wallet to any Solana token.

BLUF: Solana is not an EVM chain — the same contract verification steps you use on Ethereum do not apply. Before buying any Solana token, check five things: (1) Is the mint authority revoked? — if not, the creator can print unlimited tokens; (2) Is the freeze authority revoked? — if not, they can lock your wallet from selling; (3) Has the liquidity pool authority been burned? — if not, the team can drain the pool; (4) What is the holder distribution? — a few wallets holding the majority of supply is a dump waiting to happen; (5) Does RugCheck flag it as high-risk? — use RugCheck, not Etherscan or Token Sniffer, which do not support Solana. Solana scams execute in under a second — do your research before buying, not after.

Why Solana Has Unique Risk Characteristics

Solana is a high-performance Layer 1 blockchain that processes over 2,000 transactions per second with sub-cent fees and 400-millisecond finality. These properties make it ideal for real-world applications — payments, decentralized exchanges, NFT marketplaces. They also make it the perfect environment for scams.

Ultra-low fees. Creating a token on pump.fun costs approximately $0.02 in network fees. On Ethereum, deploying an ERC-20 contract costs $50–500. This 2,500x cost difference means a single scammer can launch hundreds of tokens per day, test which ones gain traction, and abandon the rest. pump.fun alone has been used to create over 5 million tokens since its launch — the vast majority are abandoned within 24 hours.

Instant finality. Solana confirms transactions in approximately 400 milliseconds (one slot). On Ethereum, a transaction is not truly final for several minutes (12+ block confirmations). This means a rug pull on Solana is not just fast — it is instantaneous. By the time you see the draining transaction on Solscan, it is already final. There is no mempool to front-run, no pending transaction to cancel. The money is gone before your screen refreshes.

Non-EVM architecture. Solana does not use the Ethereum Virtual Machine. It uses its own runtime (Sealevel) and its own token standard (SPL, or Solana Program Library). Smart contracts are called "programs" and are written in Rust, not Solidity. This means EVM tools like Etherscan, Token Sniffer, and GoPlus Security do not work on Solana. You cannot verify a Solana token the same way you verify an Ethereum token — the data structures, risk factors, and verification tools are entirely different.

Memecoin culture. Solana has become the epicenter of memecoin trading. Platforms like pump.fun, Raydium, and Jupiter have made it trivially easy to create, list, and trade tokens with zero utility beyond speculation. This culture normalizes buying unverified tokens from anonymous creators — which is exactly the behavior scammers exploit. Many Solana users have been conditioned to accept risks that would be immediate red flags on any other chain.

Phantom wallet ecosystem. Phantom is the dominant wallet on Solana, and its user experience is optimized for speed. Connecting to a dApp requires a single click. Signing a transaction requires a single tap. This frictionless design is great for legitimate use — but it is equally great for phishing attacks, where a malicious site tricks you into signing a transaction that drains your wallet before you have time to read what you approved.

Solana vs. EVM: Why Different Verification Is Needed

The fundamental difference: on EVM chains, you audit the contract code for hidden functions. On Solana, the SPL token program code is always the same — the risk is not in the code but in the authorities attached to each token mint. You are not looking for hidden functions. You are looking for who retains control.

Step-by-Step: How to Verify a Solana Token

Step 1: Get the Token Mint Address

Every Solana token is identified by a mint address — a base58 string that looks like So11111111111111111111111111111111111111112 (that is Wrapped SOL). You need this address to run any verification.

Find it from:

• DexScreener (dexscreener.com) — search by token name or ticker

• Solscan (solscan.io) — search by name

• The DEX where you found the token (Raydium, Jupiter, Orca)

Copy the mint address exactly. Solana addresses are case-sensitive and one wrong character sends you to a completely different token — or to nothing at all.

Step 2: Check the Mint Authority

This is the single most important check on Solana, and it has no direct equivalent on EVM chains.

The mint authority is an address that has the power to create new units of the token. If the mint authority is still active (not burned), the token creator can print unlimited new tokens at any time, diluting the supply to zero.

To check on Solscan:

1. Search for the token mint address

2. Go to the token's main page

3. Look for "Mint Authority" in the token overview

4. Check whether it shows an address or shows "Disabled" / "Burned"

A token with an active mint authority is not automatically a scam — legitimate projects use mint authority for vesting schedules, staking rewards, or governance-controlled inflation. But for memecoins and community tokens, an active mint authority is the number one rug pull vector on Solana. If the creator can mint, they will eventually dump.

How to verify mint authority is burned: On Solscan, the mint authority field should show "None" or a burn address. You can also use the Solana CLI or a tool like RugCheck, which checks this automatically.

Step 3: Check the Freeze Authority

The freeze authority is unique to Solana's SPL token standard. It allows a designated address to freeze individual token accounts — meaning the holder cannot send, sell, or transfer their tokens. The tokens are still in the wallet, but they are locked.

This is not a theoretical risk. In 2024, multiple Solana tokens used freeze authority to trap buyers: the token pumped, new buyers rushed in, and then the creator froze every wallet except their own. Buyers watched their tokens become untradeable while the creator sold from exempt wallets.

To check on Solscan:

1. Look for "Freeze Authority" in the token overview

2. It should show "Disabled" or "None"

Legitimate stablecoins (USDC, USDT) retain freeze authority for regulatory compliance — they can freeze addresses associated with sanctioned entities or court orders. For any other token type, an active freeze authority is a red flag. If a memecoin can freeze your wallet, it is not a memecoin — it is a trap.

Step 4: Verify the Liquidity Pool Authority

On Solana, liquidity pools work differently from EVM chains. On Raydium or Orca, liquidity is provided to an Automated Market Maker (AMM) pool controlled by a pool authority. If the pool authority is not burned or removed, the creator can withdraw all liquidity from the pool at any time.

This is the Solana equivalent of an unlocked liquidity provider token on Ethereum. The mechanics are different but the outcome is the same: the team drains the pool and the token becomes untradeable.

To check:

1. Find the token's primary liquidity pool on DexScreener or Raydium

2. Copy the pool address

3. Check on Solscan whether the pool authority has been burned

4. Look for an "Authority Burned" indicator

Alternatively, use RugCheck — it automatically checks LP burn status for the token's primary pools.

LP lock on Solana: Unlike EVM chains where LP tokens can be locked in timelock contracts, Solana's standard practice is to burn the pool authority entirely. There is no widely used timelock mechanism for Solana LP tokens. If the authority is not burned, the pool is effectively unlocked. There is no partial protection — it is either burned or it is not.

Step 5: Analyze Token Holder Distribution

Go to the token's "Holders" tab on Solscan. The same distribution analysis that applies to EVM chains applies here, but Solana's low transaction costs make concentration patterns even more dangerous — a whale can dump in a single transaction that costs $0.001.

Also check for clustered wallets — multiple addresses that received tokens from the same source at the same time. These are often the creator's wallets disguised as separate holders. On Solscan, click through to individual holder addresses and check their transaction history. If 10 wallets all received tokens from the same funding source and have similar balances, they are likely controlled by the same person.

Step 6: Run a RugCheck Scan

RugCheck is the definitive Solana token risk scanner — the equivalent of Token Sniffer and GoPlus combined, but built specifically for Solana.

Enter the token mint address and RugCheck provides:

• Mint authority status (active or burned)

• Freeze authority status (active or burned)

• Liquidity pool top holders and LP burn status

• Token supply distribution

• Market cap vs. fully diluted valuation

• Whether the token is flagged by community sources

• Social links verification

• Historical mint events (has the supply been inflated?)

A RugCheck score is displayed as a risk rating from "Low Risk" to "High Risk." Treat any token rated "High Risk" or "Very High Risk" as uninvestable unless you have a specific, informed reason to believe otherwise. Even "Medium Risk" tokens warrant careful review of the specific risk factors flagged.

RugCheck also shows whether the token has been featured on known scam token lists and whether the social media links are verified. A token claiming to be from a known project (Jupiter, Pyth, Jito) should have verified social links — if they are missing or point to newly created accounts, the token is likely an impersonation.

Common Solana-Specific Scams

pump.fun Rug Pulls

pump.fun is a Solana platform that allows anyone to create a token with a bonding curve for less than $0.02. When the token's market cap reaches a threshold (currently ~$69,000), liquidity is automatically deposited into Raydium. The problem: the creator retains mint authority and LP authority until they manually burn them. Most never do.

The typical pattern: a token launches on pump.fun, gains traction through social media, crosses the bonding curve threshold, gets listed on Raydium, and then the creator mints additional tokens or drains the pool. Because the entire lifecycle happens in hours (sometimes minutes), buyers who act on FOMO have no time to verify anything.

How to protect yourself: Before buying any pump.fun token that has graduated to Raydium, check the mint authority and LP authority on RugCheck. If either is not burned, the token is one click away from being worthless.

Fake SPL Token Impersonation

Solana's SPL standard makes it trivial to create a token with any name and ticker. A scammer creates a token named "JUP" (impersonating Jupiter's governance token) or "BONK" (impersonating the popular memecoin) and lists it on a DEX. The fake token has a different mint address, but the name and ticker are identical.

Users who search by name instead of verifying the mint address end up buying the fake. This is especially dangerous on Solana because transaction fees are so low that scammers can create thousands of fake tokens for a few dollars.

How to protect yourself: Always verify the mint address against the project's official website or a trusted source. Never buy a token by searching for its name on a DEX — always use the exact mint address.

Drain-Through-Metadata Attacks

Some Solana tokens include malicious metadata in their token accounts. When a wallet like Phantom renders the token in your wallet interface, it fetches this metadata — which can include a phishing URL disguised as the project's website. Clicking the link takes you to a fake dApp that prompts you to sign a transaction draining your wallet.

This is uniquely dangerous on Solana because token metadata is automatically fetched by wallets. You do not need to interact with the token — simply receiving it as an unsolicited airdrop is enough for the metadata to appear in your wallet interface.

How to protect yourself: Never click links from tokens that appear in your wallet unsolicited. Use Phantom's "hide" feature to remove spam tokens. Do not interact with any token you did not explicitly purchase or claim from a verified source. For more on wallet-draining attacks, see our guide on how to spot wallet drainers.

Jupiter DEX Aggregator Spoofing

Jupiter is the most popular DEX aggregator on Solana. Scammers create fake Jupiter frontends (jupiterswap.io, jupiter-trade.pro, etc.) that look identical to the real jup.ag but route transactions to malicious programs. When users swap tokens through these fake sites, the transaction grants token approvals or transfers funds to the scammer.

How to protect yourself: Only use the verified Jupiter URL (jup.ag) and bookmark it. Check the URL before every transaction. For more on signature-based phishing attacks, see our guide on how to prevent wallet drainers.

Tools for Solana Token Verification

Recommended workflow: Start with DexScreener to find the token and get basic market data. Then run RugCheck for the comprehensive risk assessment. Cross-reference holder distribution on Solscan. Finally, verify the mint address against the project's official channels. If RugCheck shows low risk and the mint/freeze authorities are burned, your risk is substantially reduced — though, as always, never zero.

Solana vs. Base vs. Ethereum: Risk Comparison

The key insight: Solana's instant finality means once a scam executes, the transaction cannot be reversed, front-run, or cancelled. On EVM chains, you might have seconds or minutes to react. On Solana, the window is zero. Prevention is the only defense.

Limitations: What Verification Cannot Catch

Even after running all five checks, some risks remain:

Social engineering. A token with burned mint authority, burned freeze authority, and burned LP can still be a pump-and-dump scheme where the team holds a large supply and coordinates selling into buying pressure. On-chain verification cannot detect whether a community is organic or manufactured.

Novel program exploits. Solana's program model is still evolving. Token-2022, the next-generation SPL standard, introduces transfer fees, non-transferable tokens, and confidential transfers — each creating new attack surfaces that current tools may not fully evaluate.

DeFi composability risk. A clean token can become dangerous when paired with a malicious lending protocol, staking program, or yield farm. The token itself is safe, but the smart contract you interact with to earn yield on it may not be. Always audit the program you are depositing into, not just the token.

Cross-chain bridging. If you bridge assets between Solana and other chains, the bridge itself is an attack surface. Cross-chain bridges have been exploited for some of the largest losses in crypto history. Always use established bridges (Wormhole, deBridge) and verify bridge contract addresses independently.

For a broader understanding of on-chain risk methodology that applies across all chains, see our guide on the on-chain analysis workflow.

Frequently Asked Questions

Q: Is Solana more dangerous than Ethereum for buying tokens?

A: Solana is not inherently more dangerous, but its risks are different. Ethereum scams hide in smart contract code; Solana scams hide in token authorities (mint, freeze, LP). Solana's ultra-low fees and instant finality make scams cheaper to execute and impossible to reverse once they happen. The verification process is different but equally thorough if you use the right tools (RugCheck, Solscan).

Q: Can I use Etherscan or Token Sniffer for Solana tokens?

A: No. Etherscan only covers EVM chains. Token Sniffer supports Ethereum and Base. For Solana, use RugCheck (rugcheck.xyz) and Solscan (solscan.io). Applying EVM verification logic to Solana tokens will miss the most critical risk factors — mint authority, freeze authority, and LP burn status.

Q: What is the safest way to buy tokens on Solana?

A: Only buy tokens where the mint authority is burned, the freeze authority is burned, and the LP pool authority is burned. Verify all three on RugCheck before purchasing. Use a hardware wallet (Ledger) connected to Phantom for large transactions. Never buy tokens directly from social media links — always verify the mint address on DexScreener or Solscan first.

Q: Are pump.fun tokens ever safe to buy?

A: Some pump.fun tokens that graduate to Raydium and have their authorities burned can be legitimate community tokens. However, the vast majority are speculative plays that go to zero. If you choose to buy pump.fun tokens, treat them as high-risk speculation, never invest more than you can afford to lose, and always verify that mint and LP authorities are burned after graduation.

Q: What should I do if I bought a scam token on Solana?

A: If you can still sell, sell immediately. If the token has freeze authority active and your account gets frozen, your tokens are locked permanently — there is no recovery mechanism. Do not interact further with the token contract. If your wallet was drained through a malicious approval, revoke the approval immediately in Phantom Settings > Connected Apps, and move remaining assets to a new wallet. For tracking stolen funds, see our guide on how to track stolen crypto.

Q: What is Token-2022 and does it change the risks?

A: Token-2022 is Solana's next-generation token standard that adds features like transfer fees, permanent delegates, and confidential transfers. These features introduce new risk vectors — for example, a permanent delegate can transfer tokens out of any account at any time. RugCheck is being updated to handle Token-2022, but always check whether a token uses the new standard and review what extensions are enabled.

Key Takeaways

• Solana is not an EVM chain — the verification process is fundamentally different. You check token authorities, not contract source code.

• Mint authority is the #1 risk — if it is not burned, the creator can print unlimited tokens and dump them. Always verify it is revoked.

• Freeze authority is unique to Solana — it lets the creator lock your wallet from selling. Legitimate stablecoins need it; no other token should have it.

• LP authority must be burned — unlike EVM chains where LP tokens are locked in timelocks, Solana's standard is to burn the pool authority entirely.

• Use RugCheck, not Etherscan — RugCheck (rugcheck.xyz) is the definitive Solana token scanner. Solscan is the primary explorer.

• Instant finality means no recovery — once a Solana transaction is confirmed, it is final in under a second. Prevention is your only defense.

• Low fees enable mass scam deployment — a scammer can create thousands of tokens for a few dollars. Always verify before buying.

• Never click links from unsolicited tokens — metadata in spam tokens can contain phishing URLs that drain your wallet.

For more on protecting yourself from token scams across all chains, see our guides on how to verify a token before buying, Base chain token safety, and how to check if liquidity is locked. You can also check any token or address risk in real time using our free our address risk scoring guide.

Originally published at https://theonchaindiary.com/articles/solana-token-safety/. More Web3 security guides and risk-scoring tools at Onchain Diary.

This is that workflow. It assumes you have already read enough of the threat model — how fake claim sites work, how they reach you, what signatures can do — and now want the operational version. Five stages, in order of execution.

Stage 1: verify the airdrop exists — from two independent sources

Before any wallet is involved, establish that the airdrop is real, using sources you navigated to yourself:

• Official documentation. Type the project's domain yourself. Look for claim mechanics, snapshot dates, eligibility rules.

• GitHub / governance. Real programs leave engineering and governance traces: contract deployments, snapshot proposals, merkle root publications. See what a merkle tree is and why claim programs publish them.

The two sources must agree independently. A random blog repeating an announcement is not a second source — it is an echo, and echoes are cheap to fake. If documentation and on-chain/governance records do not corroborate each other, stop here; there is nothing to claim.

Anti-signal at this stage: any "airdrop" that exists only as an announcement in your DMs, a reply thread, or an ad. The channels that deliver fake airdrops are precisely the places real ones are never exclusively announced.

Stage 2: fix the URL before the frenzy

Once verified, decide the destination now — before claim day, before urgency exists.

• Bookmark the official claim URL from the documentation page.

• Note the official claim contract address alongside it, if published.

• On claim day, navigate only via that bookmark.

This one habit deletes the entire distribution layer of the attack: paid search ads on branded keywords, lookalike domains, reply phishing, fake eligibility checkers. All of them depend on you navigating from a channel at the moment of maximum hurry. A bookmark has no channel. Related rule from fake eligibility checker phishing: if you find yourself searching for the claim site, you have already left the safe path.

Stage 3: the dedicated claim wallet

The single highest-leverage habit in this entire guide.

Setup:

1. Generate a fresh wallet from a new seed phrase — not a derived account of your main phrase, a separate phrase entirely.

2. Store the phrase exactly as seriously as your main one (hardware wallet backup or equivalent paper/metal practice — see cold wallet).

3. Fund it with only the gas the claim needs, on the chain the claim happens.

Usage rules:

• This wallet claims. It does not hold. Airdropped tokens either stay here (if small) or get swept out to your holding setup (if meaningful).

• Your main wallet — savings, positions, non-custodial long-term holdings — never connects to a claim site. Not once, not "just to check."

Why this works: drainers exploit approvals, and approvals can only take what the approving wallet holds. An empty wallet is not a smaller loss; it is a rounding error for the attacker and a non-event for you. The same logic applies to testnet farming, as covered in testnet airdrop safety.

Stage 4: claim — and read the signature as a contract

At the moment of signing, slow down and read three fields, in this order:

1. Function. A genuine claim usually is a simple call to the distributor contract. approve, permit, permit2, increaseAllowance, or an unrecognizable function on a claim page means you are granting, not receiving. The taxonomy lives in airdrop signature scams; the EIP-7702 delegation variant — one signature that can hand an EOA to attacker code — is in EIP-7702 airdrop phishing.

2. Spender / contract. Paste it into a block explorer. Contract deployed days ago? No verified source? Deployer address with a history of drainer patterns? Walk away. The deeper checks — holder distribution, deployer history — are in airdrop scam checking in 5 steps and how to spot wallet drainers.

3. Allowance. Anything unlimited on an unfamiliar contract is an automatic decline. See infinite approvals explained.

If your wallet shows raw, undecoded data, you are blind signing — decline by default and use a wallet/tool that decodes or simulates before confirming. If you use a hardware wallet, remember: it guards your keys, not your judgment; the screen confirms what you are about to authorize, so read it the same way.

Stage 5: after the claim — close the loop

Claiming is not the end of the workflow.

1. Revoke what you granted. Approvals persist after the transaction that created them. Sweep your claim wallet's approval list — token approval safety covers tools and cadence.

2. Move the tokens if they matter. If the airdrop has real value, send it out of the claim wallet to your holding setup. Keep the claim wallet near-zero by policy.

3. Audit periodically. A quick approval-and-balance review of the claim wallet before each new claim season — the mechanics are in how to audit your wallet activity.

4. Expect the follow-up wave. A real claim on-chain is public. After any major distribution, fake "phase 2 claim" and checker sites bloom; treat them exactly as the first wave — verify via the bookmark path, not via announcements that find you.

The workflow, compressed

For the fridge door:

1. Airdrop verified from two independent official sources? No → stop.

2. Claim URL bookmarked from documentation, contract address noted? No → do it now.

3. Dedicated claim wallet funded with gas only? No → make one.

4. Signature read: function, spender, allowance all sane and decodable? No → decline.

5. After: revoke approvals, sweep value, audit.

All twelve pre-claim checks in one printable page: the airdrop safety checklist. This article is part of our Airdrop Safety series.

Originally published at https://theonchaindiary.com/articles/how-to-claim-airdrops-safely/. More Web3 security guides and risk-scoring tools at Onchain Diary.

This is a rug pull, and the single most important question you should ask before buying any new token is: is the liquidity locked? If the answer is no, or if you cannot verify it independently, you are sending money to a potential exit scam.

Liquidity locking is the practice of placing the liquidity provider (LP) tokens — which represent the funds deposited into a decentralized exchange pool — into a smart contract that prevents withdrawal for a specified period. A legitimate project locks its liquidity to prove to investors that the team cannot drain the pool. But not all locks are real, and not all real locks are meaningful. Some are too short. Some cover only a fraction of the pool. Some are faked entirely.

This guide walks through exactly how to verify whether a token's liquidity is genuinely locked, how to read lock contracts, the tools that make this process faster, and the red flags that separate a real lock from a convincing illusion.

BLUF: Before buying any new token, verify that 100% of the liquidity pool's LP tokens are locked in a verifiable smart contract for a meaningful duration (at least 3–6 months, ideally longer). Check four things: (1) Is the LP token contract the actual pool? — scammers sometimes lock a fake pool; (2) What percentage is locked? — anything below 100% means developers can still drain the unlocked portion; (3) When does the lock expire? — a 24-hour lock is worthless; (4) Is the lock verifiable on-chain? — you must be able to see the LP tokens sitting in the timelock contract yourself, not take a project's word for it. Use tools like Token Sniffer, GoPlus Security, or the DEX's own pool page to verify.

What Is Liquidity and Why Does Locking Matter?

When a project launches a token on a decentralized exchange (DEX) like Uniswap, PancakeSwap, or Raydium, it must deposit a pair of assets into a liquidity pool — typically the new token paired with a stablecoin (USDC, USDT) or a major coin (ETH, BNB, SOL). This pool is what enables trading. Without liquidity, no one can buy or sell the token.

When you deposit assets into a liquidity pool, you receive LP tokens in return. These tokens are like a receipt — they represent your share of the pool and can be redeemed for the underlying assets at any time. Whoever holds the LP tokens controls the liquidity. If the project team holds them, they can withdraw all the funds whenever they want.

Here is the critical insight: the LP tokens are the keys to the treasury. If the developer can withdraw them at any moment, the token is a ticking time bomb. A liquidity lock takes those keys away — temporarily — by depositing the LP tokens into a timelock smart contract that rejects withdrawal calls until a specified unlock date.

The Anatomy of a Liquidity Lock

A liquidity lock involves three smart contracts working together:

1. The DEX Pair Contract (e.g., Uniswap V2 Pair)
   - Holds the actual token reserves (e.g., TOKEN + ETH)
   - Issues LP tokens to liquidity providers
   - Anyone holding LP tokens can call removeLiquidity()
     to withdraw the underlying tokens

2. The LP Token (ERC-20)
   - Represents a proportional share of the pool
   - Transferable like any token
   - Balance determines who can withdraw liquidity

3. The Timelock Contract
   - Holds the LP tokens
   - Has a releaseTime / unlockTimestamp
   - Withdrawal function reverts until unlock time is reached
   - After unlock, the beneficiary can claim the LP tokens

When you "check if liquidity is locked," you are verifying that the LP tokens for the token's trading pair are sitting inside contract #3, and that the unlock date is far enough in the future to provide real protection.

Step-by-Step: How to Check if Liquidity Is Locked

Step 1: Find the Token's Liquidity Pool

Start by finding the token contract address. If you're on a DEX like Uniswap, PancakeSwap, or Trader Joe, the token page usually shows the liquidity pair. If not, use a block explorer (Etherscan, BscScan, Solscan) or a DEX aggregator to find it.

On Etherscan:

1. Search for the token contract address

2. Go to the "Token" tab or check the token's profile on the DEX

3. Look for the main trading pair (usually the pair with the highest TVL)

The pair contract address is what you need. For Uniswap V2-style DEXes, each pair has its own contract. For Uniswap V3, liquidity is in a non-fungible position (NFT), which changes the locking mechanism (more on this later).

Step 2: Identify the LP Token Supply

On the pair contract's page in the block explorer:

1. Find the LP token (it has the same address as the pair contract on Uniswap V2)

2. Check the total supply of LP tokens

3. Note this number — it represents 100% of the pool's liquidity

Example:
  Pair contract: 0xABC...123 (TOKEN/WETH pair on Uniswap V2)
  Total LP token supply: 1,000.00 LP tokens
  
  If 1,000 LP tokens = 100% of the pool,
  then any lock must cover all 1,000 to be fully locked.

Step 3: Check Who Holds the LP Tokens

Go to the LP token's holder list (the "Holders" tab on the block explorer). You should see one of these patterns:

The holder list is your first signal. If the majority of LP tokens are in an externally owned account (EOA) — a regular wallet address — there is no lock. The developer can withdraw at any time.

Step 4: Verify the Timelock Contract

If LP tokens are in a contract, you need to verify that the contract is actually a timelock and not a backdoor. This is where many investors get fooled — scammers deploy a contract that looks like a timelock but has a hidden withdrawal function.

Legitimate timelock contracts have these characteristics:

• A public releaseTime or unlockTimestamp variable you can read

• A withdraw() or claim() function that checks block.timestamp >= releaseTime

• No admin override or setReleaseTime() function that lets the owner change the unlock date

• Verified source code on the block explorer

Red flags in timelock contracts:

• The contract is not verified (source code hidden)

• There is a function to change the unlock time (setUnlockTime, updateReleaseTime)

• There is a withdraw() function callable by the owner without a time check

• The contract was deployed minutes before the token launch (could be a custom backdoor)

• The contract has onlyOwner modifiers on critical functions beyond basic admin

To check the source code:

1. Go to the timelock contract address on the block explorer

2. Click the "Contract" tab

3. Check if the source code is verified (green checkmark)

4. Read the withdrawal function — confirm it requires the unlock time to have passed

5. Check for any suspicious admin functions

Step 5: Check the Lock Duration

The unlock date matters as much as the lock itself. A 24-hour lock is not a lock — it is a marketing gimmick. Here is a practical risk assessment:

Pay attention to whether the lock expires around a major event — token unlock, vesting cliff, or exchange listing. Some projects time their liquidity unlock to coincide with other sell pressure, creating a double dump.

Step 6: Cross-Reference with Lock Verification Tools

Manual checking is thorough but time-consuming. Several tools automate parts of this process:

Token Sniffer (tokensniffer.com): Automatically detects and scores liquidity lock status for Ethereum and BNB Chain tokens. Shows LP token lock percentage, unlock date, and contract audit score. Free to use.

GoPlus Security API: Provides real-time token security data including lp_holders count, lp_total_supply, and whether LP tokens are locked. This is the same data engine used by many DEX aggregators and wallet security plugins. You can use our free our token safety checklist to query GoPlus data for any contract.

DEX Tools (dexscreener.com, dextools.io): Shows the liquidity pool page with LP token holder breakdown. DEXTools specifically flags "Locked" liquidity with a lock icon and shows the unlock countdown.

RugCheck (rugcheck.xyz for Solana): Specialized tool for Solana tokens that checks for locked liquidity, mint authority, freeze authority, and other risk factors. Essential for anyone buying Solana tokens.

Pinksale / DxSale lock pages: If the token launched via a presale platform, the lock may be visible on the platform's lock page. These platforms use standardized timelock contracts that are well-audited. Always verify independently — do not rely solely on the presale platform's own page.

Common Liquidity Lock Scams

Knowing how to check liquidity locks also means knowing how scammers try to fake them.

Fake Lock Contract

The most common scam. The project deploys a custom contract, transfers LP tokens into it, and claims the liquidity is locked. But the contract has a hidden function that lets the owner withdraw immediately. The block explorer shows LP tokens in a contract, which looks like a lock, but it is actually a trap.

How to spot it: Verify the source code. If the contract is unverified or has suspicious functions, it is not a real lock. Legitimate projects almost always use well-known lock platforms (Team Finance, PinkLock, Unicrypt, Mudra) whose contracts are publicly audited.

Partial Lock

The project locks 50% of the LP tokens and keeps 50% in a team wallet. They advertise "liquidity locked" on their website and social media. When you check the timelock, the lock is real — but it only covers half the pool.

How to spot it: Always check what percentage of LP tokens are locked. The lock page on DEXTools or Token Sniffer shows this. If it is less than 95-100%, the unlocked portion can be drained at any time.

Short Lock with Renewal Promise

The project locks liquidity for 7 days and promises to re-lock it when it expires. After the first lock period, they re-lock for another 7 days, building trust. After several renewals, they stop re-locking and drain the pool.

How to spot it: Treat short locks as no locks. A 7-day lock provides zero real protection. Only count locks that extend months into the future. If a project claims they will re-lock, wait until they actually do before investing.

Burned Then Re-Minted

Some projects "burn" LP tokens by sending them to the dead address (0x000...dEaD). This permanently locks the liquidity because no one can access the dead address. However, if the token contract has a minting function, the developers can mint new tokens to themselves and create new liquidity — effectively creating a parallel pool they control.

How to spot it: Check whether the token contract has a mint() function. If the supply is mutable, burned LP tokens only protect the original pool, not the entire token economy. Use our guide on how to verify a token before buying to check for mint authority.

Uniswap V3 NFT Liquidity

Uniswap V3 uses non-fungible positions — each liquidity position is an NFT, not a fungible LP token. This changes how locking works. A project can lock the NFT position in a timelock, but they can also create multiple positions and only lock one of them. Some projects lock a tiny position while the real liquidity sits in unlocked positions.

How to spot it: Check the NFT holder for the Uniswap V3 position manager contract (0xC364...b5f). Find all positions for the token pair. Verify that the largest positions are locked. This is more complex than V2 and requires careful analysis.

Liquidity Locking on Different Chains

The mechanics of liquidity locking vary by blockchain:

Ethereum and EVM Chains (BNB Chain, Polygon, Arbitrum, Base)

Liquidity is locked using timelock smart contracts. The LP tokens (ERC-20 on Uniswap V2, or ERC-721 NFTs on Uniswap V3) are transferred to the timelock contract. Common lock providers:

• Unicrypt (UNCX): Long-standing lock platform on Ethereum and BNB Chain

• PinkLock (Pinksale): Popular on BNB Chain and Polygon

• Team Finance: Multi-chain lock provider

• Mudra: BNB Chain-focused lock platform

These platforms use audited, standardized contracts. If a project uses one of these, the lock is likely legitimate. If they use a custom contract, verify it manually.

Solana

Solana does not use LP tokens in the same way EVM chains do. Liquidity is in Raydium or Orca pools, controlled by the pool authority. On Solana, the key risk factors are different:

• Mint authority: Can the team mint unlimited new tokens?

• Freeze authority: Can the team freeze your wallet from transacting?

• LP burn: Has the LP provider's authority been burned?

Use RugCheck to analyze Solana tokens. If the mint authority is not burned and the freeze authority is still active, the project can rug you regardless of liquidity lock status.

Base

As a Layer 2 on Ethereum, Base inherits EVM mechanics. Uniswap V2 and V3 pools on Base work identically to mainnet. The same tools (Token Sniffer, GoPlus) work for Base tokens. Base's lower gas costs mean locks are cheaper to set up, but also cheaper for scammers to fake. Apply the same verification steps as Ethereum.

Practical Example: Checking a Token on Etherscan

Let's walk through a real verification process for a hypothetical token:

Token: ExampleToken (EXT)
Chain: Ethereum
DEX: Uniswap V2
Pair: EXT/WETH
Pair Contract: 0xDEF...789

Step 1: Go to the pair contract on Etherscan
  → Navigate to 0xDEF...789
  → This is also the LP token contract (Uniswap V2 pattern)

Step 2: Check total LP supply
  → Read contract → totalSupply()
  → Result: 500.00 LP tokens

Step 3: Check holders
  → Go to Holders tab
  → 0xAAA...111 (timelock contract): 475 LP tokens (95%)
  → 0xBBB...222 (EOA wallet): 25 LP tokens (5%)
  
  Analysis: 95% locked, 5% unlocked in team wallet
  Risk: The team can drain 5% of the pool immediately

Step 4: Verify the timelock at 0xAAA...111
  → Go to Contract tab → check if verified
  → Read releaseTime() → returns: 2027-01-15
  → Check for admin functions → none found
  → Lock duration: ~18 months from now → Strong

Step 5: Cross-reference with Token Sniffer
  → Search EXT on tokensniffer.com
  → Liquidity lock: 95% locked until Jan 2027
  → Contract score: 75/100 (some centralization concerns)
  
  Verdict: Liquidity is mostly locked with a strong duration,
  but 5% is unlocked. Evaluate whether 5% is acceptable
  based on the pool size and project maturity.

Liquidity Lock Checklist

Before buying any new token, run through this checklist:

1. Find the pair contract — locate the main liquidity pool for the token

2. Check LP token holders — where are the LP tokens? In a contract or in an EOA?

3. Verify the lock contract — is it a legitimate timelock with verified source code?

4. Check lock percentage — is 100% locked? Anything less is partial protection

5. Check unlock date — is it far enough out? Minimum 3 months, ideally 6+

6. Cross-reference tools — verify with Token Sniffer, GoPlus, or DEXTools

7. Check for mint authority — can the team mint new tokens and create parallel pools?

8. Check for hidden functions — does the token contract have backdoor withdrawal or pause functions?

9. Read the lock platform — is it a reputable provider (Unicrypt, PinkLock) or a custom contract?

10. Check on-chain, not on the website — never trust a "locked" badge on a project website; always verify on the blockchain

What If Liquidity Is Not Locked?

If you discover that a token's liquidity is not locked, this is not automatically a scam — but it is a critical risk factor. Some legitimate projects have legitimate reasons:

• Established tokens with deep liquidity (over $1M TVL) may not need locks because the pool is too large to drain profitably

• Tokens with burned mint authority and decentralized holdings face lower rug risk even without locks

• Some projects use alternative trust mechanisms like multisig governance or DAO-controlled treasury

However, for any new or low-market-cap token, unlocked liquidity is a dealbreaker. The risk-reward ratio is not favorable. If a project refuses to lock liquidity, they are either incompetent (they don't understand basic security) or malicious (they intend to rug). Neither is a good investment.

For more on identifying scam tokens and rug pulls, see our guides on how to spot rug pulls and honeypots and ERC-20 token security checks.

Frequently Asked Questions

Q: Can liquidity be "partially locked"? What does that mean?

A: Yes. The project may lock 80% of LP tokens and keep 20% in a team wallet. This means 80% of the pool is protected, but the team can still drain the remaining 20%. Always check the exact percentage — some projects advertise "liquidity locked" while only locking a small fraction.

Q: What happens when the liquidity lock expires?

A: The timelock contract releases the LP tokens to the beneficiary (usually the project team). At that point, they can withdraw the underlying assets from the pool. Legitimate projects re-lock before expiration. Some lock platforms offer auto-relock features. Always check the unlock date and monitor projects approaching their unlock.

Q: Is burning LP tokens better than locking them?

A: Burning LP tokens (sending them to a dead address) is stronger than locking because it is permanent — no one can ever access those funds. However, burned LP tokens cannot be recovered by the team even for legitimate purposes. Locking is more flexible and is the standard for legitimate projects. Both are valid; burning provides maximum investor protection.

Q: Can a locked liquidity pool still be drained?

A: Not through the LP tokens directly, since they are in the timelock. But the token contract itself may have backdoor functions — a transferFrom override, a pause function, or a fee mechanism that sends tokens to the developer. Locking liquidity protects against one specific rug pull vector (draining the pool), not against all scam techniques. Always audit the token contract alongside checking the lock.

Q: How do I check liquidity lock on Solana?

A: Solana uses a different model. Use RugCheck (rugcheck.xyz) to check whether the LP mint authority is burned and whether the token has mint or freeze authority. If the LP tokens are burned and both authorities are revoked, the risk of a liquidity rug pull is very low.

Q: What is a liquidity lock certificate?

A: Some lock platforms (PinkLock, Team Finance) issue a "certificate" — a URL showing the lock details (amount, unlock date, beneficiary). These are useful for quick verification, but always cross-reference with the on-chain data. A certificate from a reputable platform is a strong signal; a screenshot from the project's website is not.

Key Takeaways

• Liquidity locking places LP tokens in a timelock contract, preventing the team from draining the pool until a specified unlock date.

• Always verify on-chain — never trust a "locked" badge on a project website. Use a block explorer to confirm LP tokens are in a timelock contract.

• Check four things: lock percentage (should be near 100%), lock duration (minimum 3-6 months), lock contract source code (verified, no backdoors), and lock platform reputation (known providers like Unicrypt or PinkLock).

• Partial locks are partial protection — if 20% of LP tokens are unlocked, the team can drain 20% of the pool at any time.

• Short locks are marketing gimmicks — a 7-day lock provides no real protection and may be used to build false trust before a rug pull.

• Beware fake lock contracts — scammers deploy custom contracts that look like timelocks but have hidden withdrawal functions. Only trust verified, audited lock contracts.

• Different chains have different mechanics — EVM chains use LP token timelocks; Solana relies on mint/freeze authority burns.

• Locking protects against one vector only — always check the token contract for backdoors, mint functions, and other scam indicators alongside the liquidity lock.

For more on protecting yourself from token scams, see our guides on how to verify a token before buying, DeFi protocol red flags, and how to spot wallet drainers. You can also check any token or address risk in real time using our free our address risk scoring guide.

Originally published at https://theonchaindiary.com/articles/how-to-check-liquidity-locked/. More Web3 security guides and risk-scoring tools at Onchain Diary.

The problem is that most of these interactions leave permanent on-chain permissions. A token approval you signed six months ago is still active right now. A WalletConnect session from a sketchy dApp might still have access. And if any of those contracts get compromised tomorrow, your funds are gone with no further action required from you.

This guide walks through a complete on-chain audit of your own wallet. Every step uses free, publicly available tools. By the end, you will know exactly which contracts have permission to touch your tokens and which interactions pose a risk.

BLUF: Audit your wallet in five steps — (1) list every contract you have ever interacted with, (2) check active token approvals and revoke unused ones, (3) review all signed messages for blind signatures, (4) identify suspicious or unknown contracts in your history, (5) verify your wallet labels and exposure. Do this quarterly. If you find approvals to contracts you do not recognize, revoke them immediately.

Why You Need to Audit Your Wallet

Most wallet security advice focuses on prevention: use a hardware wallet, never share your seed phrase, avoid phishing links. These are important, but they do not address the permissions you have already granted.

Every time you interact with a DeFi protocol, you create two types of lasting exposure:

A wallet drainer does not need to hack your wallet. It needs you to sign one bad transaction, once. After that, the permissions you granted do the rest — silently, sometimes months later.

Real-World Scenario

In January 2024, a user connected their wallet to what appeared to be a legitimate staking dApp. They signed a single transaction they did not fully understand. Six months later, the dApp's contract was upgraded via a proxy pattern, and the attacker drained 12 ETH from the wallet using an approval the user had completely forgotten about.

The approval was visible on-chain the entire time. A 10-minute wallet audit would have caught it.

Step 1: Map Your Contract Interactions

The first step is to create a complete inventory of every smart contract your wallet has ever interacted with.

Using a Block Explorer

1. Go to Etherscan (or the appropriate explorer for your chain — Basescan, Arbiscan, Solscan)

2. Search your wallet address

3. Go to the Internal Transactions tab — this shows every contract that called your wallet or was called by your wallet

4. Note the contract addresses you do not recognize

Using Arkham Intelligence (Free Tier)

Arkham provides a visual interface for wallet activity that makes it easier to spot anomalies:

1. Go to arkhamintelligence.com and search your address

2. Review the Transfers tab for any tokens sent to addresses you do not recognize

3. Check the Platforms tab to see which protocols your wallet has interacted with

What to Look For

Step 2: Audit Active Token Approvals

Token approvals are the single most dangerous lingering permission. Every approval gives a smart contract the right to move your tokens without asking again.

How to Check Your Approvals

Option A: revoke.cash (Recommended)

revoke.cash is a free tool that aggregates all active approvals across multiple chains:

1. Connect your wallet (read-only — no signature required)

2. Review every active approval, sorted by token and contract

3. Click Revoke next to any approval you do not need

Option B: Etherscan Token Approval Checker

1. Go to Etherscan and search your address

2. Navigate to the More dropdown → Token Approvals

3. You will see a table of every contract with an active allowance

What to Revoke

For a deeper explanation of why unlimited approvals are dangerous, see our token approval safety guide.

Step 3: Review Signed Messages and Blind Signatures

Token approvals are on-chain transactions. But many attacks use off-chain signatures — messages you sign that do not cost gas but grant permissions in other ways.

The Blind Signing Problem

When you sign a transaction on a hardware wallet or mobile wallet, the screen shows you what you are approving. But if the data is not human-readable — just a hex string — you are blind signing. This is how most signature scams work.

How to Check Your Signatures

Signing history is harder to audit than approvals because off-chain signatures are not always stored on-chain. However, you can check:

1. Etherscan → Internal Txns: Look for transactions where your wallet called permit() or permitMulti() — these are signature-based approvals that bypass the normal approve() flow

2. Your wallet's signing history: MetaMask and Rabby store a local log of signed messages. Check your wallet settings for a signature history or activity log

3. Arkham Intelligence: Look for interactions with known signature-phishing contracts

Red Flags in Signature History

If you find any of these, the approval may still be active. Check revoke.cash and revoke any Permit2 permissions to unknown contracts.

Step 4: Identify Suspicious Contracts

Your transaction history is a map of every smart contract that has ever touched your wallet. Most are legitimate. A few might be dangerous.

How to Screen a Contract

For each unknown contract in your history, run this checklist:

1. Is the source code verified?

Go to the contract on Etherscan. If the Contract tab shows verified source code, it is a legitimate deployer. If it shows only bytecode, the contract is opaque — higher risk.

2. Does the contract appear on known-phishing databases?

Check the contract address against:

• Chainabuse — community-reported scam addresses

• ScamSniffer — real-time phishing detection

• Your wallet's built-in scanner (Rabby, MetaMask with security plugins)

3. What does the contract do?

If verified, read the contract code. Look for:

• transferFrom() calls that can move tokens without explicit per-transaction approval

• delegatecall to an upgradeable implementation — the logic can change

• Functions named claim(), sweep(), or drain() — common in malicious contracts

4. Who else has interacted with it?

On Etherscan, check the contract's transaction history. If hundreds of wallets interacted with it within a short window and many subsequently sent tokens to the same address, it is likely a drainer.

Contract Risk Classification

Step 5: Check Your Wallet Labels and Exposure

Wallet labels are tags assigned by on-chain analytics firms to categorize addresses. If your wallet has been labeled, it affects how protocols treat you — and how attackers target you.

How to Check Your Labels

1. Arkham Intelligence: Search your address and check the Labels section

2. Etherscan: The address page may show a name tag if you have interacted with labeled entities

3. Nansen (paid): Comprehensive labeling, but the free Arkham tier covers most needs

Why Labels Matter for Security

Labels reveal your wallet's exposure profile:

Understanding your wallet's public profile helps you calibrate your security posture. A whale wallet with 50 active approvals is a sitting duck. A small wallet with 3 approvals to major protocols is low risk.

Building a Wallet Audit Habit

A one-time audit is better than nothing, but wallet security is ongoing. Every new dApp interaction adds to your attack surface.

Recommended Audit Cadence

Wallet Segmentation Strategy

The most effective security practice is to use separate wallets for different risk levels:

If your experimental wallet gets drained, your cold storage is untouched. This segmentation is more effective than any single security tool.

Tools Summary

Limitations

This audit covers on-chain activity only. It cannot detect:

• Off-chain malware: Keyloggers, clipboard hijackers, or browser extensions that replace addresses

• Social engineering: Someone convincing you to send funds voluntarily

• Address poisoning attacks that trick you into sending to a look-alike address

• Custodial risk: Funds on exchanges are not protected by wallet auditing

For comprehensive security, combine regular on-chain audits with hardware wallet usage, a dedicated browser for DeFi activity, and healthy skepticism toward unsolicited messages.

Frequently Asked Questions

How often should I audit my wallet?

At minimum, run a full approval check on revoke.cash once a month. Do a complete 5-step audit quarterly. Always audit immediately after interacting with a new or unfamiliar dApp.

Can auditing my wallet prevent all hacks?

No. Audits catch lingering permissions and suspicious past interactions, but they cannot prevent real-time phishing attacks or zero-day contract exploits. Audits reduce your attack surface — they do not eliminate it. Combine auditing with hardware wallet usage and transaction simulation.

What if I find an approval to a contract I do not recognize?

Revoke it immediately on revoke.cash, then investigate the contract address on Etherscan. If the contract is unverified or appears on phishing databases, consider moving your funds to a fresh wallet address.

Does revoking an approval cost gas?

Yes. Revoking is an on-chain transaction that sets the allowance to zero. On Ethereum mainnet, this typically costs $5–20 in gas depending on network conditions. On Layer 2 networks like Base or Arbitrum, the cost is usually under $0.10.

Is it safe to connect my wallet to revoke.cash?

Yes. revoke.cash only needs read access to your approval data. It does not request token transfers or permission to spend. When you revoke, the transaction is initiated from your wallet — revoke.cash cannot act without your explicit confirmation.

Originally published at https://theonchaindiary.com/articles/how-to-audit-your-wallet-activity/. More Web3 security guides and risk-scoring tools at Onchain Diary.

That is what crypto recovery actually looks like. Not a chargeback, not a support ticket, not a "blockchain recovery expert" messaging you on Reddit. It is a forensic and legal process — slow, evidence-driven, and largely out of the victim's hands. Understanding how it works matters for two reasons: it tells you what to do in the hours after a theft, and it inoculates you against the recovery scam industry that swarms every victim within hours.

The Short Answer

A confirmed blockchain transaction cannot be reversed, disputed, or clawed back by anyone — including the network itself. When people say stolen crypto was "recovered," they mean one of four things happened:

1. Funds were frozen at an exchange. Stolen crypto moved into a regulated exchange account, and that exchange — responding to law enforcement or its own risk team — locked the account before withdrawal.

2. Funds were seized on-chain. Investigators obtained the thief's private keys (through arrest, search warrant, or plea cooperation) and moved the funds to a government-controlled wallet.

3. A court ordered forfeiture and restitution. Seized assets were liquidated or distributed back to victims through a legal claims process.

4. The thief was forced to return funds. Negotiated returns, plea deals, or hacks where the attacker returned most of the loot under pressure (rare, but it happens — the Poly Network return of 2021 is the canonical example).

Every real recovery in history fits one of these four buckets. If a "recovery service" claims a fifth method — AI transaction tracing that "freezes" coins on the blockchain, hacking the scammer's wallet, special blockchain "reversal" protocols — that method does not exist.

Why Recovery Is Possible at All

Irreversibility and traceability are different properties. The blockchain cannot undo a transfer, but it never forgets one either. That permanent, public ledger is what makes recovery conceivable:

Stolen funds need exits. Crypto is only useful to a thief once it becomes spendable. The largest off-ramps — centralized exchanges with banking relationships — all run KYC programs. When stolen funds land at a regulated exchange, the trail jumps from pseudonymous on-chain data to a verified human identity. That jump is where most recoveries begin.

Private keys are physical evidence. Unlike a bank account number, control of a private key is control of the money. When law enforcement arrests a suspect and seizes their devices, they can sometimes take the keys themselves — which is exactly how the Bitfinex seizure worked.

Chain analysis has industrialized. Firms like Chainalysis and TRM Labs build attribution databases that cluster addresses by real-world entity — exchanges, mixers, sanctioned actors — and sell that intelligence to exchanges, banks, and governments. The same wallet labeling techniques you can use for free to understand a counterparty are used at nation-state scale to follow stolen funds across chains and years.

Stablecoins add a control point. Major stablecoin issuers can freeze their own tokens at any address. Circle froze USDC connected to the Ronin Bridge hack within days in 2022, and in 2025 Tether and Chainalysis launched a joint initiative to freeze USDT linked to theft on secondary-market venues. Stablecoin theft is not beyond reach — it has a built-in kill switch the issuer can pull under legal process.

The Actual Recovery Pipeline

Recovery is a relay. The victim runs the first leg; everything after that belongs to institutions. Here is what the full pipeline looks like:

Two things stand out about this table. First, your actionable window is steps 1–3 — the first 48 hours, before you have any professional help. Second, everything after step 3 runs on timescales measured in months and years, not days.

Real Recoveries, Real Numbers

The public record includes enough completed recoveries to see the pattern:

The pattern in these cases: recovery tracked the funds' movement toward identifiable people. Colonial Pipeline worked in weeks because the attackers' wallet was found before funds dispersed. Bitfinex took six years because the thieves sat on the coins and laundered them slowly through mixers and fake identities — but sitting on stolen coins creates its own risk, since the keys must be kept and any slip (a cloud account, an exchange login, an informant) hands investigators everything.

The Bitfinex case also shows the last mile: seizure is not the same as getting money back. After the arrests, a court-run restitution process for the exchange and its users took years more, including a claims procedure that was still winding through courts long after the headline seizure. Recovery is slow at every stage, and that slowness is exactly what recovery scammers exploit when they promise results in days.

What To Do in the First 48 Hours

The hours right after a theft are when you can still influence the outcome. Speed matters because funds that reach an exchange can be frozen — funds that reach a mixer are far harder to touch.

Hour 0–2: Stop the bleeding.

• Disconnect the compromised wallet from any dApp; if the seed phrase is exposed, move remaining assets to a fresh wallet from a clean device.

• Do not keep transacting from the compromised wallet — you are feeding the attacker your new addresses.

Hour 2–24: Build the evidence package.

• Transaction hash(s) of the theft, receiving address(es), chain, asset, amount, and block timestamp.

• The full story: how contact started, URLs visited, what you signed, chat logs, payment demands.

• Any addresses you can see the funds moving to afterward (a block explorer's view of the wallet drainer's collection wallet is enough — you don't need to trace it yourself; that is a discipline of its own).

Day 1–2: Report and request freezes.

• File with the FBI's Internet Crime Complaint Center (IC3) if you are US-based or the theft touches US entities, plus your local cybercrime unit elsewhere. Keep the complaint number — cases get aggregated, and your evidence may join an existing investigation.

• If you can identify the exchange where funds landed (its deposit address matches a labeled exchange wallet), send that exchange's abuse/fraud channel a concise freeze request: hashes, addresses, timestamp, your IC3 number.

• If you paid through your own bank or exchange account (fiat on-ramp fraud), report there too — traditional chargeback rails sometimes apply to the fiat leg.

The one rule that overrides everything: during all of this, strangers will contact you offering to recover the funds — on Reddit, Telegram, even in the comments of complaint threads. They watched you post. The recovery scam economy exists because victims are findable and desperate. No upfront fees, no seed phrases, no "recovery agent" wallet access — ever.

What Determines Whether Your Case Gets Worked

Honesty matters here: the pipeline above is real, but it is not equally available to everyone. Investigators prioritize by:

• Aggregate size. A $500M hack becomes a multi-agency task force. A $5,000 theft becomes one row in an IC3 database that may match against a larger pattern.

• Aggregation potential. Complaints against the same scam operation get bundled. Ten thousand victims of one drainer campaign are a case; one victim is an anecdote. This is why filing matters even when you expect nothing — your row is what makes the pattern visible.

• Trace quality. A complaint with clean hashes and addresses can be joined to an active investigation automatically. A complaint that says "I lost my crypto to a fake site" cannot.

• Jurisdictional nexus. Stolen funds that touch US exchanges or US persons bring the case into reach of US law enforcement, which has the most developed crypto seizure practice. Pure cross-border flows between non-cooperating jurisdictions often stall.

None of this is fair to a small victim, and pretending otherwise would be false comfort. But the trajectory is improving: seizure totals have grown year over year as agencies build dedicated teams, exchanges automate freeze workflows, and stablecoin issuers centralize a choke point that did not exist five years ago. The system that recovered nothing in 2016 now recovers billions annually — mostly in large cases, with spillover benefits to aggregated smaller ones.

Where Victim Tracing Ends

A common mistake is spending weeks personally chasing the funds through block explorers, hop after hop, into a mixer and out the other side. Victim tracing has a role — producing the initial map of where funds went in the first hours — but professional tracing is a different job: attribution databases, exchange cooperation, subpoena power, and seizure authority. You cannot subpoena anyone. Your tracing job ends at a clean, timestamped evidence package.

The division of labor is simple. You do steps 1–3 of the pipeline: evidence, reports, freeze requests. Everything beyond that belongs to people with legal power — and the more precisely you document the first 48 hours, the more usable your case is to them, and the better your odds if your theft turns out to be part of a bigger, chargeable operation.

Limitations

• Most small thefts are never recovered. The honest base rate for individual cases under a few thousand dollars is close to zero, absent aggregation into a larger case.

• Recovery is not compensation for bad opsec. Prevention — hardware wallets, approval hygiene, phishing awareness — remains orders of magnitude more effective than any recovery path. A recovered hack is the exception; an avoided hack is a decision.

• Timelines run long and can end empty. Seizures can be overturned in court, forfeiture proceedings can take years, and restitution may return a fraction of the loss.

• This is not legal advice. Procedures differ by country; a local lawyer familiar with crypto asset recovery can help navigate freeze orders and civil claims in ways this general map cannot.

Related Reading

• Crypto Recovery Scams Explained — the second scam that targets every victim, and the red flags that expose it

• How to Track Stolen Crypto — the victim-side tracing workflow that produces the evidence package described here

• Wallet Labels Guide — how addresses get attributed to exchanges and services, the foundation of all fund tracing

• How to Avoid Crypto Phishing Scams — prevention, the recovery strategy that actually works

Originally published at https://theonchaindiary.com/articles/how-stolen-crypto-is-recovered/. More Web3 security guides and risk-scoring tools at Onchain Diary.

The page is a commodity — rented from a drainer kit, deployed on a lookalike domain in minutes. What separates a $50 scam from a $500,000 one is traffic quality: getting the link in front of people who (a) hold assets, (b) expect an airdrop, and (c) are in a hurry. This guide maps the five distribution channels that actually deliver victims, using documented incidents, and shows where each one breaks — both technically and psychologically.

If you have already read how the biggest airdrop scams work, this is the traffic layer of that machine.

Channel 1: Hijacked X accounts

X remains the primary distribution channel for fake airdrops because it concentrates both projects and their followers.

Three variants dominate:

• Full account takeover. The attacker seizes a project account — through credential reuse, SIM swaps, or a compromised employee — and posts the fake claim to an audience that has spent years being trained to trust it. The larger and more legitimate the account, the more efficient the drain.

• Reply phishing. Under every real announcement, cloned accounts with near-identical handles reply "portal is open" or "claim window extended" with a link. The reply piggybacks on the legitimate signal. This is a volume game: post under hundreds of announcements, harvest the clicks.

• Verified impersonators. Verification badges are purchasable, and social engineering works better with a checkmark. Users read the badge as an authenticity signal when it is only a payment signal.

The failure mode to internalize: the account is a messenger, not a destination. Any account can be taken over tonight. When a claim link appears, the question is never "who posted it" but "where does it go and what does the claim contract do" — which you can verify with the on-chain airdrop verification workflow.

Channel 2: Discord and Telegram — the fake announcement bot

Discord is where airdrop anticipation lives, and fake bots imitate the real announcement infrastructure.

The pattern is studied: legitimate projects announce things through bots with distinctive names and avatars. Attackers register bots that copy the naming convention — "OfficialAnnouncements" with a nearly identical avatar — then either DM members directly or post in general channels when moderators are asleep. The most effective variant replies to the real announcement within seconds: "Claim portal now open," with a link.

Discord's DM-from-strangers setting should be off by default in any server you use for airdrop hunting. The rule that never breaks: no legitimate project distributes claims via DM. If a claim link arrives by DM, it is hostile — not probably hostile, certainly.

Telegram adds the fake-support variant: after you post a question in a project group, impostors DM you "helpfully" with a wallet-connect "diagnostic" page. That page is a phishing attack dressed as customer service.

Channel 3: Paid search ads on branded keywords

Attackers buy ads. Search any major wallet, bridge, or airdrop claim brand and the top result is frequently a paid placement — sometimes the scammer, sometimes the official site, and it rotates.

Scam Sniffer's 2024 reporting attributed a meaningful share of drainer victims to paid-ad clicks: users searching for a wallet or claim site, clicking the first result, and connecting on a pixel-perfect clone. The ad platforms pull malicious ads when reported, but the economics favor the attacker — a few dollars of ad spend against a potential five-figure drain, on a domain that can be swapped when flagged.

Defense is a habit, not a skill: never click ads for anything crypto. Type the domain directly or use a bookmark. For airdrop claims specifically, get the URL from the project's official documentation and cross-check it against their GitHub and announcement channels — two independent sources minimum, as detailed in how to claim airdrops safely.

Channel 4: Fake live streams

The format: a "live" event — often a fake version of a real conference appearance or project AMA — on a video platform, with the airdrop link pinned in the description or overlay. The footage is usually a looped recording of a real executive; the QR code or URL in the corner is the payload.

Streams work because they manufacture urgency and legitimacy at once: something is happening right now, authority figures are on screen, and the comment section (frequently bot-populated) celebrates the claim. They also survive longer than a phishy-looking page because the video platform's domain is legitimate; only the outbound link is malicious.

If a stream is promoting a claim and the URL is not one you can verify against official documentation, treat the entire event as packaging. The address poisoning lesson applies at the URL level too: attackers bet on you glancing instead of reading.

Channel 5: Compromised media and tooling

The highest-trust channel is the victim's trusted reading surface itself.

On June 23, 2025, CoinDesk reported that Cointelegraph's front end had been exploited to inject fake "CTG token" airdrop pop-ups urging readers to connect wallets. The same weekend, CoinMarketCap was compromised to serve similar pop-ups. These were not lookalike sites — they were the actual properties, serving attacker content through a front-end exploit.

This channel breaks the standard advice loop completely. "Only trust official sources" assumes the source is intact. When the delivery layer is compromised, verification must move to the only layers the attacker cannot easily fake:

• The destination contract. Look it up on a block explorer; check deployer history and holder distribution before connecting. See how to spot wallet drainers.

• The signature request. Whatever the page says, the wallet prompt shows what you are actually authorizing. Blind signing is how these incidents convert readers into victims.

• Independent confirmation. A real airdrop exists in multiple independent places — docs, GitHub, explorer history — not only in the pop-up in front of you.

The channel-agnostic rules

Every channel above delivers the same payload: a URL. Strip away the delivery mechanism and the defense collapses into four habits:

1. Bookmark your claim destinations. Decide the URL from official documentation before the frenzy, not during it.

2. Treat urgency as evidence of attack. Countdown timers, "last chance" claims, and "portal closes in X minutes" are pressure tools. Real distributions run for days or weeks.

3. Isolate the blast radius. Use a dedicated wallet for claims so that even a perfect fake only reaches an empty account — the workflow is in how to claim airdrops safely.

4. Never let the messenger authenticate the destination. Account, DM, ad, stream, or even the news site itself — all of them are channels, none of them are proof.

The full pre-claim verification list lives in the airdrop safety checklist. This article is part of our Airdrop Safety series.

Originally published at https://theonchaindiary.com/articles/fake-airdrop-distribution-channels/. More Web3 security guides and risk-scoring tools at Onchain Diary.

EIP-7702 lets a regular account — an EOA — attach smart contract code to itself. Signed once, the delegation gives the account superpowers it never had: batch a dozen actions into one transaction, let someone else sponsor your gas, recover a lost key through social recovery. Wallets and account abstraction projects built on it immediately.

So did drainer kits. Within weeks of Pectra going live in May 2025, Scam Sniffer documented the first case of the new surface being weaponized: on May 24, 2025, a MetaMask user lost approximately $146,600 after signing a malicious 7702 batched transaction. This guide explains the mechanism, why it is qualitatively scarier than approval phishing, and the discipline that neutralizes it. It is part of our Airdrop Safety series because claim pages are the primary delivery vector.

What a 7702 delegation actually grants

Understand the mechanism in one paragraph: an approval grants a contract limited rights over specific assets — it can transferFrom tokens up to an allowance. A 7702 authorization goes further: it makes designated contract code execute as your account. Your address, your balances, your NFTs, your signing power — routed through logic the delegate contains. Where an approval-style drainer must work asset by asset through allowances, a malicious delegate can act with the account's full authority in one batched transaction.

That is why security teams treated the May 2025 incident as a category change, not another variant. The batched transaction executed under the victim's account can move holdings that approval-phishing victims would have considered safe — assets sitting outside any allowance.

To be precise about scope: the delegation binds while active and the malicious batch typically executes immediately (attackers do not wait), and the victim's signature is the only authorization step. No seed phrase, no later confirmation. One click, full account.

Why airdrop pages are the delivery vector

The feature is opt-in — the attack requires a signature from a context where signing feels routine. Airdrop season is engineered for exactly that:

• Users are trained to connect and sign on unfamiliar sites (testnet seasons are the training camp).

• Claim flows already involve unfamiliar contract interactions, so an "authorization" step does not stand out.

• Urgency ("claim window closing") shortens the read-the-prompt phase to zero.

Fake claim pages and eligibility checkers thus became the natural carriers for 7702 payloads. The pattern to burn in: a claim that wants an "authorization" or "upgrade" signature is not a claim. Receiving tokens does not require delegating your account, ever.

What the prompt looks like — and how wallets responded

After the first exploits, wallet developers moved fast. MetaMask and other major wallets added dedicated 7702 warning UI: delegation payloads are flagged distinctly from ordinary transactions and signatures, typically surfacing the delegate address with explicit account-level language.

Your reading of the prompt, though, remains the control loop:

1. The label. Any wording about authorization, delegation, upgrading, or adding code to your account — on a page you came to for an airdrop — is a takeover attempt. Full stop.

2. The delegate address. If you are genuinely completing a 7702 flow with a wallet app you trust, verify the delegate against that app's published documentation. On a claim site, there is nothing to verify against — which is the answer.

3. The transaction shape. A legitimate claim is a call to a distributor contract. A batch that includes a delegation plus transfers you did not compose is attacker-authored code. If your wallet shows a multi-action batch you did not build, you are reading someone else's plan for your account.

For the general discipline of reading prompts — function, spender, allowance, decodability — see airdrop signature scams and blind signing.

Defense: the same three layers, reweighted

The 7702 era does not change the defense stack; it raises the stakes on each layer:

1. Isolation. The dedicated claim wallet from how to claim airdrops safely now matters more: a malicious delegate on an empty wallet delegates nothing. This layer alone converts the attack from catastrophic to irrelevant.

2. Navigation discipline. The bookmark-the-official-URL habit from fake airdrop distribution channels keeps you off carrier pages entirely. Most 7702 victims never interacted with the real project at all — only its phishing clones.

3. Prompt literacy. The signature taxonomy in airdrop signature scams now has a fifth member. Learn the smell of all five: approve, permit, Permit2, raw eth_sign, and delegation/7702.

One nuance worth keeping straight: 7702 itself is not a vulnerability in Ethereum — it is a capability with a sharp edge, like approvals before it. The incidents of 2025 were phishing incidents; the mechanism was the payload, not the cause. The same user discipline that defeats wallet drainers generally defeats this class.

If you signed something suspicious

• Immediately: move remaining assets out of that wallet to a fresh one — delegation or approval, assume the account's future is not yours to control.

• Check the damage: explorer review of the account's transactions and approvals — how to audit your wallet activity.

• Trace and report: how stolen crypto is tracked and how recovery actually works — expectations should be modest, but early reporting improves the odds.

The complete pre-claim check list — including the 7702-specific prompt read — is the airdrop safety checklist. This article is part of our Airdrop Safety series.

Originally published at https://theonchaindiary.com/articles/eip-7702-airdrop-phishing/. More Web3 security guides and risk-scoring tools at Onchain Diary.

This is the social engineering layer that follows almost every crypto theft. It is not a bug or a side effect — it is a parallel criminal industry that feeds on the desperation of people who have already been victimized. If you have lost cryptocurrency to a scam, or if someone you know has, understanding how recovery scams work is the most important thing you can learn right now.

BLUF: No legitimate fund recovery service can "hack back" stolen cryptocurrency, "freeze" it on the blockchain, or recover it without law enforcement involvement. Anyone who contacts you offering to recover stolen crypto — especially if they found you through a public post, charge upfront fees, or guarantee results — is almost certainly running a recovery scam. The only genuine recovery paths are: (1) Report to law enforcement (FBI IC3, local cybercrime units) who can coordinate with exchanges. (2) Report to the exchange where funds were deposited. (3) Use blockchain analytics to trace funds for law enforcement — not to recover them yourself. Never pay an upfront fee. Never share your seed phrase. Never grant wallet access to a "recovery agent."

Why Crypto Recovery Scams Exist

Blockchain transactions are irreversible by design. Once a transaction is confirmed, it cannot be reversed, disputed, or charged back — there is no customer service number to call. This irreversibility is the core security feature of blockchain networks. It is also the reason recovery scams are so effective.

When a victim loses money in a traditional banking scam — a fraudulent wire transfer, a credit card charge — there are established channels: banks can reverse wires within certain windows, credit card companies offer chargeback protection, and consumer protection laws provide recourse. Crypto has none of these mechanisms. A victim who loses $10,000 in USDC to a rug pull has no bank to call, no chargeback to file, and no consumer protection agency that can force a reversal.

This creates a massive audience of desperate people actively searching for recovery solutions. Type "how to recover stolen crypto" into any search engine and you will find thousands of results — blog posts, YouTube videos, forums threads, and sponsored ads — most of which are bait for recovery scams. The demand is enormous because crypto theft is enormous: in 2024 alone, over $2.2 billion was stolen across 303 incidents tracked by Chainalysis. Every one of those victims is a potential target for a secondary scam.

How Recovery Scammers Find Victims

Recovery scammers do not need to find victims randomly. The victims announce themselves publicly.

Public forum monitoring. Scammers actively monitor Reddit (r/CryptoScams, r/CryptoCurrency, r/ethtrader), Telegram groups, Discord servers, X/Twitter, and Facebook groups for posts about stolen funds. When someone posts "I was scammed out of 5 ETH, please help," the scammers send private messages within hours — sometimes within minutes. They use multiple accounts to create the appearance of a consensus ("This service helped me too!").

Search engine optimization. Recovery scam services invest heavily in SEO. They create websites optimized for search terms like "recover stolen bitcoin," "crypto recovery service," and "hire a hacker to recover crypto." These sites rank alongside legitimate blockchain forensics firms in search results, making it difficult for victims to distinguish between real and fake services.

Social media advertising. Some recovery scammers run paid ads on Google, Facebook, and X targeting keywords related to crypto scams. The ads lead to professional-looking landing pages that mimic legitimate blockchain analytics companies.

Data broker lists. Scam operators buy and sell lists of known scam victims. If you have been scammed once, your contact information may circulate among criminal networks, leading to unsolicited emails, phone calls, and messages offering recovery services.

Impersonation of real firms. The most sophisticated recovery scammers impersonate actual blockchain forensics companies — Chainalysis, Elliptic, TRM Labs — by creating fake websites, email addresses, and social media profiles. A victim who has heard of Chainalysis and receives an email from "recovery@chainalysis-support.com" may not notice the fake domain.

The Five Stages of a Recovery Scam

Stage 1: Contact and Trust Building

The scammer reaches out — typically via direct message on a social platform where the victim posted about their loss. The approach is empathetic, professional, and urgent:

"I saw your post about losing funds to a phishing attack. I work with a blockchain forensics team that specializes in tracing and recovering stolen crypto. We have a 90% success rate and have recovered over $50 million for victims this year. Can I schedule a consultation?"

The scammers use professionally designed websites, fake credentials (e.g., "Certified Blockchain Forensics Investigator"), and fabricated case studies. Some create LinkedIn profiles with stolen photos and fake employment histories at real companies. Others display logos of real exchanges (Binance, Coinbase) implying partnerships that do not exist.

Stage 2: The "Assessment" Phase

The scammer asks the victim to provide details about the theft: the transaction hash, the scammer's wallet address, the amount lost, and the type of scam. This information is used to:

• Assess how much the victim lost (to calibrate the "recovery fee")

• Determine how desperate the victim is (how long ago the loss occurred, whether they have tried other recovery methods)

• Build a convincing narrative ("I can see your funds — they moved to Binance 3 hours ago")

In some cases, the scammer inputs the wallet address into a public block explorer and reads back the transaction history, making it appear as though they have specialized tracing tools. Any person can look up a wallet address on Etherscan — the scammer simply narrates the data as if it requires expert analysis.

Stage 3: The Upfront Fee

This is where the actual theft occurs. The scammer quotes a "recovery fee" — typically 10–20% of the stolen amount, or a flat fee of $500–5,000 — and demands payment upfront before any "recovery work" begins. Common justifications:

The fee is always requested in cryptocurrency — usually Bitcoin or USDT — and sent to a wallet address controlled by the scammer. Some scammers use escrow services that they also control, creating the illusion of a secure transaction.

Stage 4: The Stalling Phase

After the fee is paid, the scammer provides updates to maintain the illusion of progress: "We've traced the funds to a Binance wallet and submitted a freeze request." "Our legal team is processing the paperwork." "The recovery will take 5–7 business days." These updates are fabrications designed to keep the victim quiet while the scammer moves on to the next target.

If the victim becomes suspicious and demands results, the scammer may:

• Request an additional "expedited processing fee"

• Claim an unexpected complication ("The funds moved to a mixer — we need more resources")

• Blame the victim ("You didn't provide the correct information")

• Simply stop responding and disappear

Stage 5: The Wallet Drain (Worst Case)

The most dangerous recovery scammers do not stop at the upfront fee. During the "assessment" phase, they ask the victim for wallet access under the guise of tracing or recovering funds:

• "Send me your seed phrase so I can trace the incoming transactions"

• "Connect your wallet to our recovery portal so we can verify ownership"

• "Sign this transaction to authorize the recovery — it's just a verification step"

These requests are identical to the initial phishing attack that stole the victim's funds. The seed phrase gives full access to the wallet. The "recovery portal" is a wallet drainer that empties remaining assets. The "verification transaction" is a token approval that grants the scammer unlimited spending access.

A victim who survived the initial scam with some funds remaining can lose everything in the recovery scam. For more on these attack vectors, see our guides on how to prevent wallet drainers and signature scams explained.

Red Flags: How to Identify a Recovery Scam

Any one of these indicators should be treated as a confirmed scam. You do not need multiple red flags — a single one is sufficient to walk away.

What Legitimate Recovery Actually Looks Like

Genuine cryptocurrency recovery is not a service you hire. It is a law enforcement and exchange coordination process. Here is what actually works:

1. Report to Law Enforcement

File reports with every relevant agency. Law enforcement can issue subpoenas to exchanges, coordinate with international partners, and pursue criminal charges that may lead to asset recovery through seizure warrants.

Provide the transaction hash, the scammer's wallet address, the amount and type of cryptocurrency stolen, the date and time of the theft, and any communication records with the scammer. Law enforcement uses blockchain analytics tools (Chainalysis, TRM Labs, Elliptic) to trace funds and identify exchange deposit addresses where stolen crypto can be frozen.

2. Flag the Address on Blockchain Analytics Platforms

You can report the scammer's wallet address to blockchain analytics firms. These firms maintain databases of known scam addresses that are used by exchanges to flag and freeze incoming funds:

• Chainalysis — Submit reports through their Crypto Crime Hotline

• TRM Labs — Address reporting through their public portal

• Elliptic — Contact their investigations team

• GoPlus Security — Community address flagging (free)

If the scammer deposits stolen funds into an exchange that uses these analytics providers, the deposit may be flagged and the exchange account frozen. This does not guarantee recovery — but it increases the chances that law enforcement can pursue the frozen assets.

3. Contact the Receiving Exchange (If Identified)

If blockchain tracing reveals that stolen funds were deposited at a specific exchange, you can contact that exchange's compliance or legal team directly. Exchanges are subject to KYC/AML regulations and can freeze accounts in response to law enforcement requests. They will not freeze accounts based on a private individual's claim alone — you need a law enforcement request or court order. But reporting to the exchange ensures they have the information when law enforcement does contact them.

4. Trace the Funds Yourself

You can trace stolen cryptocurrency using free tools. This does not recover the funds, but it provides valuable intelligence for law enforcement and helps you understand where the money went:

• Etherscan / Arbiscan / Basescan — Follow transaction history of any wallet address

• DexScreener — Track if stolen tokens were swapped on a DEX

• Arkham Intelligence — Free wallet labeling and transaction graph

• OXT Research — Transaction clustering and entity identification

For a detailed walkthrough of this process, see our guide on how to track stolen crypto.

Why "Hacking Back" Does Not Work

Many recovery scam victims are drawn in by the promise of "hacking the scammer's wallet." This is a fundamental misunderstanding of how blockchain security works.

A crypto wallet's private key is a 256-bit number. Brute-forcing a private key is computationally impossible — it would take longer than the age of the universe with current technology. If the scammer's wallet is protected by a standard private key (not a brain wallet with a weak passphrase, and not a compromised multi-sig setup), no one can access it without the key.

Even if a "recovery hacker" had the skills to exploit a smart contract vulnerability or a mixer weakness, they would have no incentive to share recovered funds with you. If they could steal crypto from scammers, they would keep it — not charge you a fee to do it.

Recovery Scams by the Numbers

These numbers are estimates based on available reporting. Underreporting is significant — many victims are too embarrassed to report losses or secondary scams. The actual figures are likely higher.

What to Do Immediately After a Crypto Theft

If you have been scammed, take these steps before considering any recovery option:

1. Stop engaging with the scammer. Do not respond to further messages. Do not click any links they send. Do not connect your wallet to any site they recommend.

2. Revoke all token approvals. If the scam involved a malicious smart contract approval, use revoke.cash or Etherscan's token approval checker to revoke spending permissions immediately. This prevents the scammer from taking more tokens.

3. Move remaining assets to a new wallet. Create a fresh wallet with a new seed phrase. Transfer all remaining cryptocurrency to the new wallet. Assume the compromised wallet is permanently tainted.

4. Document everything. Save all communications with the scammer (screenshots, emails, chat logs), transaction hashes, wallet addresses, and the URL of the scam website. This evidence is critical for law enforcement.

5. File law enforcement reports. File with the FBI IC3 (ic3.gov) if you are in the US, or your national cybercrime unit. Include all documentation. Request a case number.

6. Report the scammer's address. Submit the wallet address to blockchain analytics platforms (Chainalysis hotline, TRM Labs) and community databases (GoPlus, ScamSniffer).

7. Do not post details publicly. Posting your exact loss amount, wallet address, and transaction details on public forums is what recovery scammers use to target you. If you need community support, share your story without the specific financial details.

Frequently Asked Questions

Q: Can stolen cryptocurrency ever actually be recovered?

A: Yes, but rarely and not through private "recovery services." Recovery happens when law enforcement traces stolen funds to an exchange, obtains a seizure warrant, and the exchange cooperates with asset return. The 2024 Chainalysis report documented $1.3 billion in stolen funds seized by law enforcement globally. This represents legitimate recovery through official channels — not private hackers or recovery firms.

Q: Are there any legitimate crypto recovery services?

A: Legitimate blockchain forensics firms (Chainalysis, TRM Labs, Elliptic) work with law enforcement and exchanges — not directly with individual victims. They do not solicit victims through social media, do not charge upfront fees to individuals, and do not guarantee results. If a firm contacts you directly offering recovery, it is a scam. If you want professional help, hire a lawyer who specializes in crypto litigation — they can engage forensics firms and coordinate with law enforcement through proper legal channels.

Q: What if the recovery service has good reviews?

A: Recovery scammers fabricate reviews extensively. They create fake Trustpilot profiles, fake Reddit accounts, and fake testimonial videos. A recovery service with a polished website and glowing reviews can be a scammer who invested $500 in web design. The only credible reviews would come from verified law enforcement referrals, not from anonymous internet accounts.

Q: Is it possible to hire a hacker to recover stolen crypto on the dark web?

A: No. "Dark web hacker" services that claim to recover stolen crypto are themselves scams. They take your payment (usually in Bitcoin or Monero) and disappear. Engaging with dark web services also exposes you to additional criminal liability, malware infections, and further financial loss.

Q: I already paid a recovery scammer. What do I do?

A: Stop all communication with the recovery scammer immediately. Do not pay any additional fees, even if they threaten legal action or claim they have "already started work." Document the recovery scammer's wallet address, website, and communications, and add this information to your original law enforcement report. Move any remaining crypto to a new wallet. Accept that the recovery fee is also lost — chasing it will only lead to deeper losses.

Q: How long do I have to act after being scammed?

A: For the immediate steps (revoke approvals, move assets, document evidence), act within minutes — every hour increases the chance of further loss. For law enforcement reporting, file as soon as possible, but reports are accepted even months later. The faster stolen funds are traced to an exchange, the higher the chance that the exchange can freeze them before the scammer withdraws. For more on tracing methodology, see our guide on how to track stolen crypto.

Key Takeaways

• Recovery scammers target existing scam victims — they monitor forums, social media, and search engines for desperate people who have already lost money.

• No private service can recover stolen crypto — blockchain transactions are irreversible. Only law enforcement with exchange cooperation can freeze and seize stolen funds.

• Upfront fees are the primary red flag — legitimate firms do not charge individual victims upfront for recovery work.

• Never share your seed phrase or connect your wallet to any "recovery portal" — these are secondary wallet-draining attacks that exploit your desperation.

• Report to law enforcement immediately (FBI IC3 at ic3.gov, or your national cybercrime unit) with full documentation — transaction hashes, wallet addresses, and communication records.

• Trace funds with free tools (Etherscan, Arkham) to build intelligence for law enforcement, but do not attempt DIY recovery.

• Do not post exact loss details publicly — this is the signal recovery scammers use to target you.

• "Hacking back" is not real — no one can brute-force a private key or magically reverse a confirmed blockchain transaction.

If you want to check whether a wallet address or token contract is associated with known scams before interacting, use our free our address risk scoring guide. For comprehensive safety practices before you ever get scammed, see our guides on how to prevent wallet drainers, how to avoid crypto phishing scams, and address poisoning attacks explained.

Originally published at https://theonchaindiary.com/articles/crypto-recovery-scams-explained/. More Web3 security guides and risk-scoring tools at Onchain Diary.

A dusting attack is not a hack. No private keys are compromised, no smart contracts are exploited, and no funds are stolen directly. It is a surveillance technique — one of the most effective and least understood privacy threats in the cryptocurrency ecosystem. Attackers, blockchain analytics firms, and law enforcement agencies all use variants of dusting to trace wallet activity across the blockchain. Understanding how it works is essential for anyone who values financial privacy on a public ledger.

This guide explains how dusting attacks work, why they are particularly effective on Bitcoin's UTXO model, how they differ on Ethereum and other account-based chains, and the specific steps you can take to protect your wallets from being de-anonymized.

BLUF: A dusting attack sends microscopic amounts of cryptocurrency ("dust") to thousands of wallet addresses, then monitors the blockchain to see when recipients combine that dust with their main balances. When a victim spends dust alongside regular funds, the transaction reveals that all those inputs belong to the same person — linking previously separate addresses. The attack is most effective on Bitcoin and other UTXO-based chains (Litecoin, Bitcoin Cash), because the UTXO model physically mixes inputs in each transaction. Account-based chains like Ethereum are less vulnerable to dusting but can still be tracked through token transfers and address poisoning variants. Protection is straightforward: (1) Don't spend the dust — most wallets let you mark specific UTXOs as unspendable; (2) Use coin control — manually select which UTXOs go into each transaction; (3) Use separate wallets for different activities so a single cluster compromise doesn't reveal your entire footprint; (4) Consider privacy wallets (Wasabi, Sparrow) or privacy coins (Monero, Zcash) if anonymity is critical. If you receive an unsolicited tiny deposit from an unknown address, ignore it — the dust itself is harmless unless you consolidate it.

How Dusting Attacks Work

The mechanics of a dusting attack follow a predictable pattern. An attacker — who could be a criminal group, a commercial analytics firm, or a government agency — selects a set of target addresses. These might be all addresses holding more than a certain balance, all addresses that recently interacted with a specific exchange, or addresses associated with a particular service or protocol.

Phase 1: Target Selection
  - Attacker identifies target addresses (e.g., all wallets holding > 1 BTC)
  - Targets are grouped by patterns (exchange users, DeFi participants, etc.)
  - Attacker funds a wallet dedicated to dusting

Phase 2: Dust Distribution
  - Attacker sends tiny amounts (e.g., 500 satoshis / 0.000005 BTC) to each target
  - These amounts are below the "dust limit" — too small to spend economically
  - Distribution happens across many transactions to avoid raising alarms

Phase 3: Monitoring
  - Attacker watches the blockchain for when dust UTXOs are moved
  - When a victim creates a transaction that includes the dust as an input
    alongside other UTXOs, the attacker learns those inputs share an owner

Phase 4: Clustering
  - Attacker builds a graph linking addresses that have been combined
  - Cluster grows as more dust is consolidated
  - Once a cluster is linked to a real-world identity (via an exchange KYC leak,
    a public transaction, or a known address), the entire cluster is de-anonymized

The genius of the attack is its cost asymmetry. Sending dust to 10,000 Bitcoin addresses costs roughly $50–200 in transaction fees. The intelligence gained — a mapped cluster of linked addresses — can be worth thousands of dollars to criminals, analytics firms, or state actors.

The UTXO Problem: Why Bitcoin Is Vulnerable

To understand why dusting works, you need to understand the UTXO (Unspent Transaction Output) model that Bitcoin uses.

In Bitcoin, your wallet doesn't hold a "balance" — it holds a collection of UTXOs, which are discrete chunks of bitcoin received in previous transactions. Think of them as individual dollar bills in a physical wallet. When you send bitcoin, your wallet selects one or more UTXOs to use as inputs, creates an output for the recipient, and returns any change to a new address you control.

Here is the critical vulnerability: when multiple UTXOs are combined in a single transaction, the blockchain publicly reveals that all those inputs belong to the same entity. This is called the "common input ownership heuristic," and it is the foundation of blockchain analysis.

Imagine you have:

• Address A: 1.5 BTC (your main savings)

• Address B: 0.3 BTC (your trading wallet)

An attacker sends 0.00000547 BTC (the dust) to Address A. Weeks later, you make a payment. Your wallet software automatically selects the most efficient UTXOs — and if it includes the dust along with your main balance, the transaction shows inputs from both the dust and your real funds. Now the attacker knows that Address A belongs to the same person who received the dust. If Address B later interacts with Address A, the attacker can link B to the same cluster.

Repeat this across dozens or hundreds of addresses, and you can map a user's entire wallet footprint — even if they carefully used different addresses for every transaction.

The Dust Limit

Bitcoin defines a "dust limit" — the minimum output value that is considered economically spendable. Below this threshold, spending the output would cost more in transaction fees than the output is worth. On the Bitcoin network, the dust limit is calculated as:

dust_limit = fee_rate × input_serialized_size

For standard P2PKH outputs:
  dust_limit ≈ 546 satoshis (at 1 sat/vB fee rate)

For SegWit outputs:
  dust_limit ≈ 294 satoshis

Dusting attacks deliberately use amounts at or just above this limit — enough to be a valid output, but small enough that spending it costs the victim money. This creates a dilemma: the dust sits in your wallet, and if your wallet software auto-selects it during a future transaction, your privacy is compromised.

Dusting on Account-Based Chains

Ethereum and most modern blockchains use an account-based model instead of UTXO. In this model, each address has a single balance, and transactions simply debit one account and credit another. There are no discrete "inputs" to combine.

This makes dusting far less effective on Ethereum:

However, Ethereum is not immune to privacy attacks. While dusting in the UTXO sense doesn't work, attackers use related techniques:

• ERC-20 token dusting: Sending tiny amounts of tokens (often fake tokens or airdropped tokens) to addresses. These appear in transaction history and can be used for address poisoning attacks, where the fake token contract or transfer is designed to trick users into interacting with malicious contracts.

• Transaction graph analysis: Without input mixing, analysts still build transaction graphs by tracking which addresses transact with each other. Tools like Chainalysis and Arkham use machine learning to cluster Ethereum addresses based on behavioral patterns — timing, gas price preferences, interaction with specific DeFi protocols, and more.

• ENS and metadata leakage: Ethereum addresses linked to ENS names, Twitter profiles, or GitHub accounts are trivially de-anonymized without any dusting at all.

Privacy Coins Are Different

Privacy-focused cryptocurrencies are designed to resist all forms of transaction tracing, including dusting:

• Monero uses ring signatures, stealth addresses, and RingCT to hide the sender, receiver, and amount in every transaction. Dusting is completely ineffective because the attacker cannot determine which output in a ring belongs to the target.

• Zcash offers shielded transactions using zk-SNARKs. When both sender and receiver use shielded addresses, the transaction is invisible on the public ledger — no amount, no addresses, no metadata.

Notable Real-World Dusting Campaigns

Dusting attacks are not theoretical. Several large-scale campaigns have been documented:

Binance Dusting (2018): The exchange publicly warned users about a dusting attack that targeted Bitcoin addresses. The attacker sent 0.00000547 BTC to approximately 48,000 addresses. This remains one of the most widely reported dusting incidents and triggered widespread awareness of the attack vector.

Litecoin Dusting (2019): An attacker dusted roughly 300,000 Litecoin addresses, sending 0.000011 LTC to each. The scale suggested a commercial analytics operation or a state-sponsored surveillance program, though the perpetrator was never identified.

Ethereum Token Dusting (2020–2024): Thousands of Ethereum addresses received tiny amounts of unsolicited ERC-20 tokens. Many of these were phishing operations — the token contract included a fake "claim" mechanism that directed users to malicious websites designed to drain their wallets through blind signing or token approval scams.

BSC Dusting (2023): Binance Smart Chain's low transaction fees made dusting nearly free. Researchers identified campaigns sending micro-amounts of BEP-20 tokens to over 100,000 addresses, primarily to build wallet clusters for subsequent phishing or rug pull operations.

Dusting vs Legitimate Micro-Transactions

Not every small transaction is an attack. The blockchain is full of legitimate micro-transactions, and distinguishing between them requires context:

Common legitimate sources of small transactions include:

• Exchange test withdrawals — Exchanges sometimes send a small test transaction before a large withdrawal to verify the destination address

• Mining pool payouts — Pools distribute mining rewards to thousands of workers, often in small amounts

• Token airdrops — Projects distribute tokens to many wallets as a marketing or governance mechanism

• Lightning Network activity — Opening and closing payment channels generates small on-chain outputs

If you receive a small deposit from a recognized exchange or mining pool, it is almost certainly legitimate. If it comes from an unidentified address and matches the amount sent to thousands of other addresses, treat it as dusting.

How to Detect If You've Been Dusted

Detecting dusting requires monitoring your wallet for unsolicited small deposits. Here is a practical detection workflow:

Step 1: Check Your Transaction History

Open your wallet in a block explorer like mempool.space (Bitcoin) or Etherscan (Ethereum). Look for incoming transactions with:

• Amounts below 0.0001 BTC or equivalent

• Senders you don't recognize

• Transaction timestamps that coincide with known dusting campaigns

Step 2: Check the Sender's Activity

Click on the sender address in the block explorer. If it shows outgoing transactions to hundreds or thousands of addresses with similar small amounts, you have been dusted.

Step 3: Monitor for Cluster Linking

Use a blockchain analytics tool (Arkham Intelligence, OXT Research for Bitcoin) to check whether your addresses have been grouped into a cluster. If your previously separate addresses now appear in the same cluster, a dusting attack may have succeeded.

Step 4: Review UTXO State

For Bitcoin wallets with coin control (Electrum, Sparrow), view your UTXO list. Dust will appear as a small UTXO from an unknown source. Mark it immediately to prevent accidental spending.

How to Protect Yourself

Protection against dusting falls into two categories: preventing the dust from being linked, and reducing your overall traceability.

1. Don't Spend the Dust

The simplest and most effective defense. If you notice an unsolicited tiny deposit, do not include that UTXO in any future transaction. Most Bitcoin wallets support marking UTXOs as unspendable:

• Electrum: Right-click the UTXO → "Mark as spent" (it won't be selected for future transactions)

• Sparrow Wallet: Go to UTXOs tab → select the dust → "Freeze" it

• Wasabi Wallet: The wallet automatically isolates dust inputs

As long as the dust UTXO is never combined with your main funds, the attacker cannot link your addresses through that transaction.

2. Use Coin Control

Coin control is a wallet feature that lets you manually select which UTXOs to include in each transaction. Instead of letting the wallet auto-select inputs (which may accidentally include dust), you explicitly choose only the UTXOs you intend to spend.

Wallets with coin control support:

3. Use Separate Wallets

Maintain separate wallets for different purposes — one for savings, one for daily transactions, one for exchange interactions. If one wallet gets dusted and linked, the attacker only sees activity within that wallet, not your entire financial footprint.

For maximum separation, use a fresh address for every transaction. Most modern Bitcoin wallets generate a new address for each incoming payment by default. This is a Bitcoin best practice that limits the information an attacker can gain even if they successfully dust one address.

4. Use Privacy Wallets and Techniques

If financial privacy is critical, consider these tools:

• CoinJoin: A mixing technique where multiple users combine their transactions into a single collaborative transaction, breaking the link between inputs and outputs. Wasabi Wallet and Samourai Wallet implement CoinJoin for Bitcoin. The mixed UTXOs are untraceable to specific inputs.

• Mixers: Services like Tornado Cash (Ethereum) allow users to deposit funds and withdraw from a different address, breaking the on-chain link. Note that mixers face intense regulatory scrutiny — Tornado Cash was sanctioned by the US Treasury in 2022.

• Privacy coins: Monero and Zcash provide privacy at the protocol level, making all forms of tracing — including dusting — ineffective by design.

5. Use a Hardware Wallet for Cold Storage

Hardware wallets like Ledger and Trezor keep your private keys offline. While they don't prevent dusting (anyone can send to your public address), they protect against the more dangerous follow-up attacks — phishing campaigns and wallet drainers — that often accompany dusting operations. Combined with proper address management, a cold wallet setup significantly reduces your attack surface.

Dusting in Law Enforcement and Compliance

It is important to understand that dusting-like techniques are not exclusively used by criminals. Blockchain analytics firms — including Chainalysis, Elliptic, and TRM Labs — perform sophisticated versions of transaction clustering for law enforcement and compliance purposes. Their tools go far beyond simple dusting:

• Heuristic clustering: Combining the common input ownership heuristic with temporal analysis, behavioral fingerprinting, and known-address databases to build comprehensive wallet maps.

• De-anonymization through off-chain data: Linking on-chain addresses to real-world identities via exchange KYC records, IP addresses from node connections, and public transaction disclosures.

• Real-time surveillance: Monitoring the blockchain in real-time for specific address patterns, flagging transactions involving sanctioned entities, and generating alerts for suspicious activity.

Law enforcement agencies use these tools to trace ransomware payments, identify money laundering networks, and map criminal wallet clusters. The same techniques that protect your privacy against a criminal dusting attack also protect criminals from law enforcement — creating an inherent tension between personal privacy and public security that the crypto community continues to debate.

For most legitimate users, the concern is not law enforcement but rather commercial surveillance. Companies build wallet profiles to sell to advertisers, insurers, and lenders. A dusting attack by a commercial analytics firm can result in your wallet activity being included in a dataset sold to third parties without your knowledge or consent.

Frequently Asked Questions

Q: I received a tiny deposit from an unknown address. Was I dusted?

A: Check the amount and sender. If it is below 0.0001 BTC (or equivalent on other chains) and the sender address has outgoing transactions to many other addresses with similar amounts, it is likely a dusting attack. If it is from a known exchange or mining pool, it is probably legitimate. Either way, do not spend that specific UTXO until you are certain.

Q: Can dusting attacks steal my funds?

A: No. Dusting is a privacy attack, not a theft attack. The dust sits in your wallet harmlessly. The risk is only that spending it alongside other funds reveals that those addresses belong to the same person. The actual danger comes from follow-up attacks — phishing campaigns targeting dusted addresses, or address poisoning attacks that exploit users who copy addresses from their transaction history.

Q: Does dusting work on Ethereum?

A: Minimally for ETH itself, because Ethereum's account model doesn't mix inputs the way Bitcoin's UTXO model does. However, ERC-20 token dusting is common and is typically used for address poisoning or phishing rather than transaction tracing. If you receive unsolicited tokens, do not interact with any contract those tokens link to — see our guide on how to prevent wallet drainers.

Q: How much does a dusting attack cost the attacker?

A: Very little. Sending 546 satoshis to 10,000 Bitcoin addresses costs roughly 0.0546 BTC in dust ($35 at $65K/BTC) plus transaction fees of approximately 0.01–0.05 BTC ($650–$3,250). On low-fee chains like BSC or Polygon, the cost is under $10. The intelligence gained is worth far more.

Q: Can I report a dusting attack?

A: There is no central authority to report dusting to, since sending cryptocurrency to someone is not illegal. You can report it to your wallet provider or post about it on community forums to warn other users. If the dusting is accompanied by phishing links or malicious tokens, report those to the relevant blockchain security firms (e.g., Chainalysis, TRM Labs) and your wallet provider.

Q: If I've already spent dust by accident, is my privacy gone forever?

A: Not necessarily, but the affected addresses are now linked in any transaction graph built from that transaction. The best response is to move remaining funds to new addresses and treat the old addresses as compromised for privacy purposes. Going forward, use coin control to prevent accidental dust inclusion, and consider using a privacy wallet for sensitive transactions.

Key Takeaways

• Dusting attacks send tiny amounts of crypto to thousands of addresses, then monitor the blockchain to link wallets when the dust is consolidated with main balances.

• The UTXO model used by Bitcoin is the primary vulnerability — combining UTXOs in a single transaction publicly reveals shared ownership through the common input ownership heuristic.

• Account-based chains like Ethereum are less vulnerable to traditional dusting but face related threats like ERC-20 token dusting and address poisoning.

• Detection is straightforward: check transaction history for unsolicited micro-deposits from addresses that sent similar amounts to many recipients.

• Protection is primarily about not spending the dust: use coin control to manually exclude dust UTXOs, freeze them in wallets that support it, and use separate wallets for different activities.

• Privacy wallets (Wasabi, Sparrow) and privacy coins (Monero, Zcash) provide protocol-level protection against dusting and other tracing techniques.

• Law enforcement and analytics firms use dusting-like techniques for legitimate purposes — the same technology that catches criminals also compromises ordinary users' financial privacy.

• The dust itself is harmless — the real danger is in follow-up attacks (phishing, address poisoning, wallet drainers) that target dusted addresses, and in the loss of pseudonymity that comes from wallet clustering.

For related reading on protecting your crypto from surveillance and scams, see our guides on address poisoning attacks explained, how to track stolen crypto, and how to prevent wallet drainers.

Originally published at https://theonchaindiary.com/articles/crypto-dusting-attacks-explained/. More Web3 security guides and risk-scoring tools at Onchain Diary.

When Scam Sniffer published its 2024 annual report, the headline number was $494 million stolen through wallet drainers that year — a 67% increase over 2023 — with more than 300,000 wallet addresses targeted. In 2025, better wallet warnings and growing user awareness cut losses by 83%, to $83.85 million across roughly 106,000 victims. Both years, a large share of that machinery ran on the same fuel: pages that looked like airdrop claim sites.

This article takes the machine apart. Not the folklore version ("greedy users got phished") but the operational version: who builds these sites, how they acquire victims, what actually happens at the moment of the fake claim, and what the biggest documented operations looked like. If you understand the supply chain, the defense becomes obvious — and it is never "read the page harder."

The supply chain of a fake claim site

A modern airdrop scam has four layers, and they are usually different actors:

1. The kit developer. Drainer kits are rented, not built. The developer maintains the phishing page templates, the wallet drainer contracts, signature-bait logic, and infrastructure that adapts to wallet security warnings. According to reporting from The Record on Inferno Drainer, the service took a cut of around 20% of stolen funds — a commission structure that explains why kits keep improving.

2. The operator. The renter picks a narrative (an upcoming token claim, a points program, a testnet reward), deploys the kit on stockpiled domains, and drives traffic. Operators are the customer-facing layer; they absorb the risk and keep most of the proceeds.

3. The traffic supplier. Fake claim sites need eyes. Traffic comes from hijacked X accounts, compromised Discord and Telegram communities, paid search ads on branded keywords, and — in the most damaging cases — compromises of trusted media properties themselves.

4. The cash-out layer. Stolen assets move through fresh wallets and mixers, then to exchanges. This layer is why recovery odds are poor; see our guide on how stolen crypto gets traced and recovered.

Users only ever see layer 2: a polished page with a countdown, a "connection strength" meter, and a claim button. Everything behind it is invisible.

Case study 1: Inferno Drainer — the franchise model

Inferno Drainer became the textbook example of the franchise model. Security researchers documented its rise through 2023: by June 2023 it had extracted roughly $6 million from almost 4,900 victims, and by November 2023, The Record reported the operation had surpassed $80 million by spoofing real blockchain projects — cloning the branding of legitimate protocols and standing up fake claim pages on lookalike domains.

In January 2024, Group-IB published analysis tying roughly 16,000 malicious domains to Inferno Drainer's infrastructure. The scale is the point: a fake claim site is not a one-off artifact but a replaceable edge node in a domain arsenal. When one domain gets flagged or taken down, the operation rotates to the next.

The operation "retired" in late 2023, but that was a rebrand, not an exit. Check Point Research documented its return in 2025 with upgraded infrastructure — better at evading malicious-transaction warnings that wallets had added. The lesson: kit names come and go; the franchise model persists.

Case study 2: the $1.25M Polygon NFT airdrop phishing wave

Not every airdrop scam is a website. Scam Sniffer documented a campaign on Polygon where victims received unsolicited NFTs in their wallets — about 1,354 malicious NFTs impersonating legitimate airdrop campaigns. The NFTs' names and metadata contained instructions and URLs: claim your reward here, verify your eligibility there.

The psychological trick is inversion. The user did not go looking for an airdrop; the airdrop found them. Receiving an asset feels like evidence of legitimacy ("how would a scammer know my address?"), when in reality bulk-minting NFTs to harvested addresses costs almost nothing. Anyone who followed the link landed on a drainer page.

We cover this vector in depth in our guide to unsolicited airdrop tokens — the short version: an airdrop you never signed up for is not a gift, it is bait with your address on it. Related: crypto dusting attacks.

Case study 3: when the news site itself is the phish

The most efficient traffic source is one victims already trust. On June 23, 2025, CoinDesk reported that Cointelegraph's website had been hit by a front-end exploit that injected fake "CTG token" airdrop pop-ups urging readers to connect wallets. The same weekend, CoinMarketCap was compromised to serve similar pop-ups.

These incidents matter because they break the standard advice loop. "Only trust official announcements" assumes the official channel is intact. When a compromised media property or a hijacked project account serves the scam directly, verification has to happen one layer deeper — at the contract and signature level, not the page level. Our guide on how fake airdrops reach you maps every major distribution channel and its failure mode.

What actually happens at the "claim"

The claim button is where social engineering turns into a transaction. The sequence:

1. Connect. You connect a wallet — this alone leaks nothing but hands the site your address and confirms a live target.

2. The pre-check. Many kits run a live balance scan. Wallets with no approved assets get a "not eligible" message; fat wallets get the full theater.

3. The signature. The claim triggers not a transfer but a signature request — typically a Permit2 approval or a permit signature — that authorizes the drainer contract to move your tokens later. See airdrop signature scams explained.

4. The sweep. Off-site, the attacker's contract transfers every approved asset. You never see a "send" confirmation because no send ever appears in your wallet UI.

That fourth step is why victims describe the theft as instant and invisible. The transfer is executed by the drainer contract under an approval you granted. If you want to audit what you have already granted, read token approval safety and how to audit your wallet activity.

Why 2025's losses fell — and why complacency is wrong

The 83% drop in 2025 drainer losses is real progress: wallets got better at flagging malicious signatures, and more users learned not to blind-sign. But two cautions.

First, the kits adapt. The 2025 drainer ecosystem re-tooled around new signature surfaces — most notably EIP-7702 delegations after Ethereum's Pectra upgrade, with the first documented victim losing roughly $147,000 to a single malicious batched transaction in May 2025. We break that vector down in EIP-7702 airdrop phishing.

Second, attack volume tracks airdrop seasons. Every major distribution event re-concentrates exactly the population scammers want: users who expect to connect wallets to unfamiliar claim sites. The 2026 drainer ecosystem is smaller per-victim but broader in reach — more sites, cheaper kits, AI-generated variants of the same core trick.

The defense, condensed

The machine has one load-bearing wall: the signature you give at claim time. Everything else — the page, the brand, the deadline, the pop-up — is set dressing.

• Treat every claim site as hostile until verified on-chain; start with our 5-step airdrop verification workflow.

• Never claim with a wallet that holds your main holdings — use a dedicated burner, per how to claim airdrops safely.

• Read what a signature authorizes before signing anything; blind signing is how most drainer approvals slip through.

• If tokens or NFTs appear that you never asked for, do not interact: that is the fake token playbook.

For a printable version of every check in one place, see the airdrop safety checklist. This article is part of our Airdrop Safety series.

Originally published at https://theonchaindiary.com/articles/biggest-airdrop-scams-anatomy/. More Web3 security guides and risk-scoring tools at Onchain Diary.