Updated: September 10, 2026

Reviewed by: Rick Cramer, Head of Analytics at SimpleSwap

Short answer

TRC20 and ERC20 are fungible-token standards on two different blockchains: TRON and Ethereum. USDT issued as TRC20 and USDT issued as ERC20 are treated by Tether as equivalent versions of the same dollar-denominated token, but they exist on separate ledgers and cannot simply be sent from one network to the other.

TRON produces blocks more frequently and typically reaches its solidified state in about a minute. Ethereum uses 12-second slots and normally reaches protocol-level finality in roughly 13–15 minutes, although a transaction can be included and visible much sooner.

Fees work differently. Ethereum charges gas in ETH, and the cost varies with network demand. TRON uses Bandwidth and Energy: users can obtain resources by staking TRX or receiving delegated resources, while insufficient resources result in TRX being burned. TRON is often attractive for USDT transfers, but it is not guaranteed to be cheaper than Ethereum under all market conditions.

In practice, the first question is simpler: which network does the receiving wallet, exchange or service support?

What is ERC20?

ERC-20 is the fungible token standard on Ethereum, originally proposed as EIP-20 in November 2015. USDT and USDC, both issued on Ethereum, use the ERC-20 interface.

Ethereum addresses are commonly represented as 42-character hexadecimal strings that begin with 0x.

Transaction fees are paid in ETH. A standard ERC20 transfer therefore normally requires the sending account to have enough ETH to pay gas. Ethereum's own documentation uses roughly 65,000 gas as an illustrative figure for an ERC-20 transfer, although actual gas consumption depends on the token contract.

Some smart-account or gas-sponsorship systems can abstract gas payments from users, so the claim that “zero ETH means USDT can never move” is too absolute. At the Ethereum protocol level, however, gas is ultimately denominated and paid in ETH.

What is TRC20?

TRC20 is the fungible-token standard on TRON. It runs on the TRON Virtual Machine and is compatible with Ethereum's ERC-20 standard.

TRON launched its MainNet in May 2018. Tether and TRON announced the introduction of TRC20-USDT on March 4, 2019; the current TRC20 USDT contract was deployed the following month.

TRON's user-facing Base58Check addresses are 34 characters long and begin with T.

TRON does not use a conventional gas-fee model. Transactions consume two main resources:

• Bandwidth covers transaction size.

• Energy covers smart-contract execution, including TRC20 transfers.

Bandwidth has a limited free daily allowance. Energy does not. Both can be obtained through staking or delegated from another account. If the sender lacks sufficient resources, TRX can be burned to cover the shortfall.

TRC20 vs ERC20: side by side

Fee figures should always be treated as snapshots rather than permanent network characteristics.

An Ethereum ERC-20 transfer consumes gas, and its dollar cost depends on the current gas price and the price of ETH.

On TRON, even the Energy requirement for a USDT transfer is not fixed. Current TRON documentation gives approximate examples of around 64,000 Energy when the recipient already has a positive USDT balance and around 130,000 Energy when the recipient's USDT balance is zero. The exact figure can also change under TRON's Dynamic Energy Model.

Check the amount shown by your wallet immediately before confirming the transfer.

Fees: why the answer is no longer simply “TRC20 is cheaper”

Ethereum prices transactions according to gas consumption and current demand for block space. ERC-20 transfers use more gas than standard ETH transfers because they involve interacting with a smart contract.

When demand for Ethereum is low, mainnet token transfers can become inexpensive. When demand rises, the same transaction can cost considerably more. The price, therefore, cannot be summarized with a durable dollar range.

TRON works differently. A USDT transfer consumes Bandwidth plus Energy. If the sender has sufficient resources from staking or delegation, little or no TRX needs to be burned for those resources. Without sufficient resources, TRX is burned according to the network's rules. Another complication: a USDT transfer to an address with a zero token balance generally requires more Energy, due to the additional storage write, than a transfer to an address with a positive USDT balance. TRON's Dynamic Energy Model can further alter the cost.

That means TRC20 is often an efficient transfer rail, especially for users or services with sufficient Energy resources, but “TRC20 is cheaper in almost all conditions” is no longer a safe general rule.

Compare the live fees before sending.

Speed and finality

TRON produces a block approximately every three seconds.

However, saying that a TRON transaction becomes final “after 19 blocks” is technically inaccurate. TRON's solidification mechanism looks for confirmation from at least 19 distinct active Super Representatives out of 27, rather than simply counting a fixed number of blocks. Under healthy network conditions, this normally takes about one minute.

Ethereum uses 12-second slots. A transaction can therefore be included in a block quickly, but block inclusion and protocol finality are not the same thing.

Ethereum finality typically takes about two epochs, or 13–15 minutes. Exchanges and other services may credit Ethereum deposits earlier or later, depending on their own confirmation policies.

For users, both networks usually show an incoming transaction well before full protocol finality. How long a deposit takes to become spendable on an exchange is a policy of that exchange, not a universal property of ERC20 or TRC20.

Wallet compatibility

Both networks now have broad wallet support.

One important update for 2026 is MetaMask. Older comparisons often say that MetaMask only supports Ethereum/EVM networks and that TRON requires TronLink. That is no longer accurate: MetaMask now supports TRON by default, including TRX, USDT, and other TRON assets.

TronLink remains a TRON-focused wallet. Multi-chain products, including Ledger, Exodus, Trust Wallet, and Tangem, also support TRON assets, depending on the specific product and version.

Wallet support can change, so confirm that the wallet supports both the asset and the network before sending.

Wrong-network mistakes and how to avoid them

Sending on a network the destination does not support.
If an exchange gives you a USDT TRC20 deposit address or explicitly requires the TRON network, do not send USDT over Ethereum instead. Recovery policies vary by platform: some custodial services may be able to recover unsupported deposits, sometimes for a fee, while others may not.

Confusing EVM networks that share the 0x format.
Ethereum, BNB Smart Chain, Polygon, Arbitrum, and many other EVM-compatible networks use the same basic hexadecimal address format. A destination address, therefore, only needs to be syntactically valid on several networks, even though the recipient only supports one of them. Always verify the network separately from the address.

Not having enough TRON resources or TRX.
Sending USDT TRC20 requires Bandwidth and Energy. Those resources can come from staking, delegation or, when insufficient, a TRX burn. A transaction with insufficient resources and insufficient TRX may fail. Simply holding USDT does not guarantee that the wallet can send it.

Not having enough gas for ERC20.
A conventional Ethereum ERC20 transfer requires ETH for gas. If the wallet does not use a gas-sponsorship mechanism and no ETH is available, the transfer cannot execute successfully.

Trusting a pasted address without checking it.
Clipboard-hijacking malware can replace an address during copy-and-paste, while address-poisoning attacks try to place visually similar addresses in the transaction history. Do not rely only on the first and last few characters when transferring a large amount. Verify the address carefully, confirm the network, and use a trusted address book or a hardware wallet display when available.

One more check on the other side of the address. Everything above is about verifying your own actions. If you have a SimpleSwap account, you can also check the counterparty: paste the address into Address Check in your Customer Account to see whether it is associated with sanctioned entities or other flagged categories. The screening is run by third-party services and does not catch everything, and a low result is not a character reference. It is one more data point before the funds move, and the checks are free within your loyalty level's monthly allowance.

Which should you choose?

The network is a property of the route, not a different dollar value of the token. Pick the network that the destination supports, then compare cost and operational requirements.

How SimpleSwap handles TRC20 and ERC20 USDT

On SimpleSwap, USDT issued on different networks is presented as network-specific assets. This allows a user, when the relevant pair is available, to send USDT on one supported network and receive USDT on another without manually operating a blockchain bridge.

For example, a user can select USDT ERC20 as the asset to send and USDT TRC20 as the asset to receive, then provide a compatible TRON address.

SimpleSwap is a self-custodial multi-source swap aggregator that aggregates liquidity from more than 20 CEX and DEX providers. After the deposit is confirmed, the platform routes the exchange through its provider network and sends the output asset to the receiving wallet.

You do not need TRX simply to receive USDT TRC20. However, if you later want to send that USDT directly from your wallet, you will need sufficient TRON resources (TRX) to cover the transaction fee.

SimpleSwap uses an all-in-one crypto-to-crypto rate. Its fee is dynamic and depends on the asset pair, liquidity, market conditions, network costs, and routing. For some assets, the cost may start from 0.2%; 0.2% should not be treated as a guaranteed minimum fee for every USDT exchange.

A fixed-rate exchange locks the quoted rate for 20 minutes. To retain the received rate, the deposit must be sent and the required blockchain confirmation received within the applicable window.

Most crypto-to-crypto swaps can be initiated without creating an account. However, SimpleSwap applies risk-based transaction monitoring and may require KYC or additional information when compliance triggers are identified.

SimpleSwap's H1 2026 Swap Report also shows how important cross-chain traffic is to its audience. 91.8% of swaps crossed a network boundary. Separately, USDT on TRON was the largest single net gainer of the half, gaining 6.0 percentage points when comparing its share of received volume to its share of sent volume.

Those are two separate findings: the report does not say that USDT on TRON was the platform's largest asset by absolute volume.

FAQ: TRC20 vs ERC20

Can I send TRC20 USDT directly to an ERC20 address?
No. TRC20 and ERC20 operate on separate blockchains and use different user-facing address formats. To move USDT from TRON to Ethereum, use a service or cross-chain mechanism that explicitly supports both networks.

Which is cheaper, TRC20 or ERC20?
There is no universal answer. TRC20 can be inexpensive when the sender has sufficient Energy or access to delegated resources, but an unstaked TRON account may need to burn TRX to execute the USDT smart contract call. Ethereum gas can, meanwhile, become very low during quiet periods. Compare the live transaction cost before sending.

Which is faster, TRC20 or ERC20?
TRON produces blocks more frequently and normally reaches its solidified state in about one minute. Ethereum uses 12-second slots, so transactions can be included quickly, but full protocol finality normally takes around 13–15 minutes. A wallet or exchange may consider either transaction usable before full protocol finality according to its own policy.

Is TRC20 less secure than ERC20?
The networks use different consensus architectures. TRON uses Delegated Proof of Stake with 27 active Super Representatives producing blocks. Ethereum uses Proof of Stake with a much larger validator set. That is a meaningful structural difference, but decentralization and security cannot be reduced to a single number.

For USDT specifically, there is also issuer risk on both networks: Tether retains the ability to blacklist addresses and freeze tokens under applicable policies. Network security, issuer controls, wallet security, and destination risk should therefore be considered separately.

Do I need TRX to send USDT TRC20?
You need enough Bandwidth and Energy to execute the transfer. These resources can come from your own staked TRX or be delegated to your account. If available resources are insufficient, TRX is burned to cover the shortfall. So you do not necessarily need a spendable TRX balance if sufficient resources are already available, but an ordinary wallet without enough Energy will generally need TRX.

How do I convert USDT from ERC-20 to TRC-20?
Use a swap or cross-chain service that explicitly supports both versions. SimpleSwap supports network-specific USDT assets and can route supported wallet-to-wallet conversions without requiring the user to manually operate a bridge. Most swaps can be initiated without creating an account, although risk-based KYC checks may apply.

Why did my exchange deposit not arrive?
A network mismatch is one possible cause, but it is not necessarily the most common. Check the transaction hash, selected network, deposit address, required confirmations, and any additional identifiers the exchange requires. If the funds were sent over an unsupported network, contact the receiving platform's support. Recovery depends on its technical capabilities and policies.

What is Address Check? Address Check is a Customer Account tool that screens a wallet address for association with sanctioned entities and other risk categories. Enter the address and its network to receive a risk level and the connections identified. Screening is performed by third-party services and may not identify all potential issues. The number of checks available per month depends on your Loyalty Program level.

This article is for educational purposes only and is not financial or investment advice. Network fees, wallet support, resource parameters, and confirmation policies can change. Always verify the asset, network, destination address, and live transaction cost before sending funds. SimpleSwap's only official domain is simpleswap.io.

Sources:

Tether — Supported Protocols and Integration Guidelines

Ethereum — ERC-20 Token Standard (EIP-20)

Ethereum — Ethereum Accounts and Address Format

Ethereum — Gas and Network Fees

Ethereum — Proof-of-Stake Consensus

Ethereum — Finality and Single-Slot Finality

TRON — TRC-20 and Token Standards

TRON — TRC-20 Protocol Interface

TRON — Accounts and Address Format

TRON — Bandwidth and Energy Resource Model

TRON — Bandwidth and Energy

TRON — USDT Transfer Energy Requirements

TRON — Dynamic Energy Model and Energy Costs

TRON — Consensus, Super Representatives and Finality

TRON — MainNet History and Milestones

Tether — USDT Introduced to the TRON Blockchain

MetaMask — TRON Support

SimpleSwap — Clipboard Hijackers: The Malware That Swaps Your Address

SimpleSwap — FAQ

SimpleSwap — AML/KYC Policy

SimpleSwap — Terms of Service

SimpleSwap — H1 2026 Report

Two different things get called “free crypto,” and they work in opposite directions.

A fake airdrop is a claim page dressed up as a reward. It promises tokens for an address, a task, a follow, or simply for existing, then asks you to confirm a transaction to “receive” them.

A drainer dApp is what actually executes the theft. It isn’t a token or a coin: it’s the site or contract sitting behind the claim button, and instead of sending you anything, it requests permission to move assets you already hold, a token approval, an NFT authorization, an off-chain signature.

The airdrop is the bait. The drainer is the mechanism. Put together, the question before signing anything is simple: is this page giving me something, or asking permission to take something I already have?

Why a signature can matter

A wallet drainer doesn’t always need your recovery phrase, password, or private key. Sometimes it does, but the simpler route is to convince you to approve the wrong request in your own wallet. An approval is permission: you let an app or contract move a specific token on your behalf. Legitimate apps use approvals constantly, so seeing one doesn’t prove anything on its own; what matters is the scope. A claim page requesting a large or unlimited allowance on a token you hold is a warning sign; some permissions remain active long after you close the tab, so the theft doesn’t always happen immediately. Other attacks use off-chain signatures that incur no gas fee and leave no visible transfer, yet still carry real financial authority once signed.

The scale is shrinking, though not gone. Scam Sniffer’s 2025 report tracked $83.85 million in wallet-drainer phishing losses across 106,106 victims on EVM chains, down 83% from $494 million in 2024, with victims down 68%. Losses closely tracked market activity, peaking at $31 million in Q3 during Ethereum’s strongest rally of the year. The largest single theft was $6.5 million in September, via a forged Permit signature. Since 2023, Scam Sniffer’s tracked totals in this category have exceeded $800 million.

How the fake claim reaches you

A promoted post or ad for a token claim, airdrop, or reward from a familiar project can link to a lookalike site. Blockaid has documented networks of accounts built to promote malicious dApps disguised as legitimate claims.

A compromised account with real followers and history works just as well as a distribution channel: attackers have pushed scam links through hijacked accounts on X, Instagram, and Discord.

An unfamiliar token or NFT can also appear in your wallet unprompted, sometimes carrying a linked website or “instructions” for claiming or selling it. Receiving the asset doesn’t give anyone control of your wallet; the risk begins only when you follow its instructions to an external page.

When the safety advice becomes the trap

The most convincing version of this scam borrows the language of a real hack. April 2026, by Blockaid’s count, was the worst month for crypto theft on record: more than $629 million drained across upward of twenty incidents, led by two attacks. On April 1, Drift Protocol lost roughly $285 million to a privileged-key compromise at its Security Council. On April 18, KelpDAO lost about $292 million after a compromised LayerZero verifier node allowed a fraudulent cross-chain message to pass through its bridge, draining 116,500 rsETH.

Both attacks were followed almost immediately by an unrelated second wave. Real security guidance tells users to revoke approvals or migrate assets, and drainer operators echo that language back while it’s still fresh: revoke, migrate, claim, compensation. Blockaid found lookalike domains, revokes-drift[.]trade and revoke-kernelsdao[.]com, that live within hours of each hack and are seeded into reply threads under the real security posts rather than running as standalone ads. On the KelpDAO campaign, nine coordinated retweets from repurposed accounts landed within a six-minute window, timed to coincide with peak community anxiety. The same pattern repeated across five incidents that month on different operators’ kits: a technique spread across the whole drainer ecosystem, not the work of one group.

None of the above requires reading a smart contract. Six checks catch nearly all of it.

Ask what the page wants. A legitimate claim may need a transaction or signature alone; that proves nothing. A “free” airdrop that wants broad access to USDT, ETH, NFTs, or anything else in your wallet is one to question.

Get to the page yourself. Don’t follow a claim link from a post, reply, or ad; go to a project’s official site you’ve verified independently. A saved bookmark for services you use often removes one way to land on a lookalike domain.

Don’t mistake gas for an unlock fee. A real claim may cost ordinary network gas. Being asked to send crypto elsewhere as a “deposit” or “verification fee” to unlock your allocation is a serious red flag.

Don’t disable a warning because a site asks you to. A page telling you to enable blind signing, dismiss a wallet alert, or turn off protection before you can “receive” anything wants you to remove protection exactly when you need it.

Use a separate wallet for claims. Keeping experimental dApp activity separate from your main holdings limits the impact of a single bad approval. It’s not full protection, since a live permission can still expose what you send there later, but it caps the damage.

Check your active permissions. Leaving a site or disconnecting your wallet doesn’t cancel an on-chain approval. Revoke.cash or an explorer’s approval checker shows what’s still active; use a verified URL, since fake revocation tools exist too. SimpleSwap’s Safety Academy lists these tools.

Where this meets your swap

A standard SimpleSwap exchange doesn’t expose you to this category of attack, by design: it never asks you to connect a wallet, grant a token approval, or sign a Permit-style permission. You choose a pair, enter the address where you want the asset delivered, and SimpleSwap gives you a deposit address. Then you send an ordinary outgoing transfer from your own wallet, a specific amount, once, not standing permission to spend from it later. A SimpleSwap swap doesn’t add a token allowance to whatever you’re carrying, and it doesn’t clean up approvals granted elsewhere: a permission you gave a DEX, a claim page, or any other dApp stays live until you revoke it, it expires, or it’s invalidated.

To check whether an address is worth trusting, the sender behind an unfamiliar token, say, SimpleSwap’s Customer Account, has a tool for it: Address Check. Enter the address, pick its network, and it screens it through third-party services and returns a risk level. It’s available to registered users, with monthly checks scaling by Loyalty Program tier, from 5 on Bronze to 25 on Platinum. It won’t tell you whether a claim page is a drainer, but it’s a fast way to check the address behind a suspicious token or “reward” first.

The rule to remember

You don’t need to read a smart-contract signature to catch most of these. Before approving anything, ask why a page that’s supposed to hand you free tokens needs permission to spend tokens you already own. If you can’t answer that clearly, don’t approve it.

This article is for educational purposes only and is not financial, legal, or security advice. Scam methods, wallet interfaces, and token permissions change over time. Always verify the website and understand what a wallet request authorizes before signing or sending funds. SimpleSwap’s only official domain is simpleswap.io.

Why check an address at all

Most safety advice about addresses covers one question: Is this the address I meant to paste? Address Check answers a different one: What is this address associated with?

That second question matters in both directions.

When you are about to send, the counterparty may be someone you have not dealt with before: a seller in a peer-to-peer deal, a new OTC contact, or a project treasury. The address looks like any other string of characters. Its transaction history does not.

When you are about to accept funds, the history travels with them. Coins that passed through a sanctioned entity or a known exploit earlier in their life can attract compliance attention on any service you later use, even if you had no part in what happened upstream. Knowing this before you accept a payment is cheaper than finding out afterward.

How it works

1. Log in to your Customer Account and open Address Check in the left-hand menu.

2. Paste the address and select the network it belongs to.

3. Press Check.

4. Read the risk level on the gauge and open the details for the connections found.

Every check you run is saved to a history tab. You can filter it by date and by risk score and search it by address, which is useful if you deal with the same counterparties repeatedly or want to recheck an address a month later.

What the result contains

The screening checks whether the address is associated with sanctioned entities or other risk categories and reports the result as a risk level. Alongside the level, the report identifies connections to trusted and suspicious sources, so you can see what drove the score rather than a bare number. A detailed report is also sent to your account email.

How many checks do you get

Checks are allocated per month by Loyalty Program level. Every registered user starts at Bronze automatically; higher levels are reached through cumulative exchange volume and, once reached, do not expire.

Your remaining allowance is shown directly under the input field.

What a risk level means, and what it does not

The result comes from third-party screening services. That is worth stating plainly, because it sets the limits of what the tool can tell you.

A low risk level means the screening found no association with the risk categories it covers. It is not a statement that the address, or the person behind it, is trustworthy, nor is it a guarantee about how any exchange or wallet provider will treat funds from that address. New risk indicators appear before databases catch up.

A high risk level means the screening found an association worth your attention. It is not proof that the counterparty did anything wrong. Addresses can be tainted by transactions several hops away, and exchange deposit addresses, in particular, aggregate flows from many unrelated users.

The screening may not identify all potential issues. The decision about whether to proceed remains yours.

Where does this fit in your routine

Address Check does not replace the checks that already sit on your side of a self-custodial swap: confirming the address character by character, matching the network to the asset, sending a small test amount on an unfamiliar route. Those protect you from your own mistakes. Address Check adds context about the other party.

FAQ

Do I need an account to use Address Check? Yes. The tool lives in the Customer Account. Swaps themselves still do not require an account.

Which networks are supported? The network selector next to the address field shows the current list. Choose the network the address actually belongs to; the same address string can exist on several EVM chains with different histories.

What happens if I use up my monthly checks? The allowance resets the following month. Moving up a Loyalty Program level increases the number of checks available.

Does Address Check cost anything? The checks are included in your Customer Account within the monthly allowance for your level. SimpleSwap charges a service fee on exchanges; fee details are available on the website and through support.

Does a low risk level speed up my swap or exempt it from review? No. Address Check is an informational tool for your own decisions. Transaction screening on exchanges runs independently of it.

This article is for informational purposes only and does not constitute financial advice. Address Check relies on third-party screening services and may not identify all potential issues. Risk disclaimers are set out in the Terms of Service. SimpleSwap's only official domain is simpleswap.io.

You post in a project's Telegram or Discord because a transaction has not arrived. Within minutes, a direct message appears. The profile picture matches the team's branding, the username looks plausible, and the tone is professional. The person apologizes for the trouble, asks what happened, and offers to help.

That timing is part of the attack.

Coinbase documented exactly this pattern in November 2025: scammers monitor public Telegram and Discord chats for people posting questions or expressing frustration, then contact them by DM while posing as support representatives.

The broader trend is measurable. Chainalysis reported that impersonation scams grew by more than 1,400% year over year in 2025, making impersonation one of the fastest-growing areas in its scam data.

The headline number for total scam activity needs more context. When Chainalysis published its findings in January 2026, it had identified at least $14 billion in on-chain inflows to cryptocurrency scams during 2025. Based on the historical discovery of additional illicit addresses after publication, the final estimate was projected to exceed $17 billion.

Chainalysis also found that scam operations with on-chain links to AI vendors extracted an average of $3.2 million per operation, compared with $719,000 for operations without those links – roughly 4.5 times as much.

Worth stating precisely: fastest-growing is not the same thing as largest.

Chainalysis said high-yield investment programs and pig butchering remained the dominant scam categories by volume. It also warned that the categories increasingly overlap: investment and pig-butchering operations may incorporate impersonation, social engineering, phishing and wallet-focused tactics.

Fake support is one expression of that broader impersonation problem.

The mechanic

Coinbase describes a simple version of the pattern.

A user asks for help in a public community. A scammer monitoring the channel notices the message. Minutes later, the user receives a private message from an account impersonating support.

The conversation may begin with ordinary troubleshooting questions. The escalation comes later.

Sometimes the target is a recovery phrase or private key, supposedly needed for “wallet verification” or “syncing.” Sometimes the scammer sends a link to a cloned support or wallet interface. In other versions, the victim is told that an account has been compromised and that funds must immediately be transferred to a new “safe” wallet controlled by the attacker.

Coinbase has documented that latter pattern as well: fake support representatives may manufacture an urgent security problem and instruct victims to transfer crypto to an address supposedly created to protect their assets.

Three psychological details help explain why the approach works.

You were already looking for help. You did not initiate contact with the scammer, but you did publicly signal that you needed assistance. A private message arriving immediately afterward can therefore feel like a response rather than an unsolicited approach.

You are dealing with a problem. A delayed transaction, an inaccessible wallet, or an unexplained balance creates urgency. The person offering an immediate solution arrives at a moment when a quick resolution feels particularly valuable.

The scammer can optimize for speed. Automated monitoring, scripts, and organized teams enable rapid contact with potential victims. Fast response is not evidence that the sender is legitimate.

The important part is that none of these signals requires a technical exploit. The attacker is trying to compromise the decision-making process before trying to compromise the wallet.

This is an industry, not always an individual

The lone-scammer model is increasingly incomplete.

In January 2026, Coinbase described modern scam operations that resemble businesses: organized groups with specialized functions, training, scripts, quotas, phishing infrastructure, and systems for moving stolen money.

The same report discussed The Com, a loose cybercriminal ecosystem largely made up of teens and young adults who coordinate through services such as Discord, Telegram, and gaming platforms. Coinbase noted that members have used social-engineering techniques, including fake Coinbase support calls, to drain victims' wallets.

Other large scam networks operate on a still greater scale, including scam compounds in which workers may themselves be victims of trafficking and forced labor.

That organization helps explain why some fake-support accounts can appear remarkably responsive. A criminal operation designed to identify targets and open conversations does not function like a conventional customer-support queue.

One of the largest publicly reported individual social-engineering losses shows the possible scale.

On January 10, 2026, blockchain investigator ZachXBT reported that a victim had lost more than $282 million in Bitcoin and Litecoin in a hardware-wallet social-engineering attack. Other security reports subsequently put the value at roughly $283–284 million, depending on asset prices used in the calculation.

Security researchers reported that the attacker impersonated Trezor support and persuaded the victim to expose their wallet recovery phrase. The hardware wallet itself was not reported as having been technically breached.

The security device could protect the keys from remote extraction. It could not protect a recovery phrase that its owner was persuaded to disclose.

The rules

You do not need to decide whether a support profile looks convincing. Use independent verification instead.

Treat an unsolicited private support message as unverified.

Do not rely on its profile picture, username, badge, conversation history, or knowledge of your problem. Close the conversation, navigate independently to the project's official website or app, and initiate a new support request through one of the channels listed there.

A legitimate service may have its own policy about outbound communications, so “no real support team ever contacts anyone first” is too broad as a universal rule.

The useful rule is simpler: an incoming message does not prove the sender's identity. Verify through a channel you opened yourself.

Never give a support representative your recovery phrase or private key.

A genuine support agent does not need possession of your wallet's private credentials to investigate a transaction.

A legitimate wallet application may ask you to enter a recovery phrase when you deliberately initiate a wallet recovery process. That is different from sending the phrase to an agent, entering it into a support form, or following a recovery link sent by a stranger.

Anyone who obtains a conventional wallet recovery phrase can generally use it to reconstruct the wallet's keys and move its assets.

There is one more pattern worth remembering: recovery scams.

After a theft, scammers may approach the victim, claiming they can trace, retrieve, or unlock the stolen assets in exchange for an upfront fee or access to the wallet. Treat unsolicited recovery offers with the same suspicion as the original scam and verify any recovery service independently.

How SimpleSwap support actually works

The safest way to explain our support process is to refer to the channels and procedures that SimpleSwap publishes on its Safety Academy.

The official SimpleSwap domain is simpleswap.io.

For service issues, SimpleSwap lists support@simpleswap.io as its support email address. Its Terms of Service also identify the contact form and live chat on simpleswap.io as official support channels.

If someone contacts you privately claiming to represent SimpleSwap and you cannot independently verify the request, do not continue the conversation. Open simpleswap.io yourself or write directly to support@simpleswap.io.

SimpleSwap support does not need your seed phrase or private key.

A standard SimpleSwap exchange does not require those credentials. Never disclose them to anyone claiming they need them to investigate or complete a swap.

An Exchange ID is an important reference for support, but it is not necessarily the only information support may need.

For a delayed or unclear transaction, SimpleSwap's FAQ recommends checking the exchange status and, once a deposit has been sent, the transaction ID (TXID) on a blockchain explorer. Support may ask for the Exchange ID and TXID.

Depending on the situation, additional verification may also be required. Refund, compliance, and deposit-ownership procedures may require additional information or documentation.

Be suspicious of an arbitrary payment demanded to “unlock” or “release” an ordinary transaction – but do not use “support never asks for an additional payment” as the test.

SimpleSwap's current Terms provide for legitimate fees in some exceptional refund and fund-recovery situations. A refund may involve a blockchain network fee. For certain token refunds, an additional payment in the network's native coin may be required to cover that fee. SimpleSwap or a service provider may also impose a recovery fee in some fund-recovery cases.

That makes the verification channel more important than the mere existence of a fee.

Do not pay based on instructions received through an unsolicited DM. Verify the situation directly through simpleswap.io or support@simpleswap.io, and make sure the request aligns with the official exchange or refund process.

That distinction matters because a scammer can repeat almost any sentence a legitimate company publishes. What they cannot do is make an independently opened official channel confirm that they are handling your case.

What comes next

“Know the Scam by SimpleSwap” breaks down the mechanics behind common crypto scams and the checks that can interrupt them before a transaction becomes irreversible.

 This article is for educational purposes only and is not financial, legal, or security advice. Scam methods and support procedures can change. Independently verify current support information before sharing credentials, sending funds, or following recovery instructions. SimpleSwap's only official domain is simpleswap.io.

Updated: September 7, 2026

Reviewed by: Rick Cramer, Head of Analytics at SimpleSwap

USDT (Tether) and USDC (Circle) are both designed to stay at $1. USDT is the largest and most heavily traded stablecoin. As of September 6, 2026, CoinGecko reported USDT’s market cap at about $183.4 billion, compared with $74.6 billion for USDC, and noted that USDT also had a much higher daily trading volume. That scale and liquidity help explain USDT’s market dominance, but they do not, on their own, make it more trusted. The key question is what backs each coin, how often reserves are disclosed, and how much confidence users place in the issuer’s reporting.

Their reserve and reporting models differ. Tether's disclosures are weighted toward U.S. government securities and related instruments, but they also include other assets and exposures such as Bitcoin, gold, and secured lending. Tether publishes quarterly reserve attestations, and in August 2026, KPMG U.S. completed a full independent audit of Tether International's 2025 financial statements and issued an unqualified opinion.

USDC is backed by highly liquid dollar-denominated assets, including bank deposits, short-dated U.S. Treasuries, and overnight U.S. Treasury repurchase agreements. Most reserves sit in the Circle Reserve Fund, a government money-market fund managed by BlackRock. Circle reports reserve holdings weekly and receives monthly third-party assurance from a Big Four accounting firm; Deloitte also audits Circle's corporate financial statements.

If you want the broadest trading coverage and deepest liquidity across global crypto markets, USDT usually has the edge. If you care more about a simpler reserve structure, more frequent reporting, or MiCA-compliant issuance in the EEA, USDC is stronger on those points. In the end, neither one is automatically “safer” than the other.

What is USDT?

USDT is a US-dollar stablecoin issued by Tether. Tether was founded in 2014 as Realcoin and was renamed Tether shortly thereafter.

Tether relocated its principal issuing entity to El Salvador in 2025 after obtaining local regulatory approvals.

USDT exists on several blockchains, including Ethereum, TRON, Solana, TON, and Avalanche. Tether treats USDT on supported networks as having the same value, but you still have to choose the right network when sending it: USDT on one blockchain cannot be sent to an address on another without a supported cross-chain mechanism.

What is USDC?

USDC is Circle’s U.S. dollar stablecoin, launched in 2018. It was first governed by the Center Consortium, which Circle and Coinbase created together. In 2023, Center was shut down as a standalone organization, and Circle took full control of USDC issuance and governance.

Since July 2024, Circle Internet Financial Europe SAS has served as a second issuer of USDC for the EEA, alongside Circle Internet Financial, LLC. Circle Internet Group, Inc., the group's parent company, began trading on the New York Stock Exchange under the ticker CRCL on June 5, 2025.

USDC is natively available on Ethereum, Solana, Base, Arbitrum, and many other networks. Circle's Cross-Chain Transfer Protocol (CCTP) lets native USDC move between supported blockchains by burning it on the source chain and minting an equivalent amount on the destination chain, eliminating the need for wrapped tokens or bridge liquidity pools.

USDT vs USDC: reserves and audits

Two distinctions are important here.

A reserve attestation is not the same thing as an annual financial statement audit. Tether's quarterly BDO attestations and Circle's monthly USDC reserve assurances test specific reserve information. Separately, both companies now have audited corporate financial statements. The important update for 2026 is that Tether can no longer accurately be described as a company that has “never completed a full audit”: KPMG U.S. audited Tether International's financial statements for the year ended December 31, 2025, and issued an unqualified opinion in August 2026.

Reserve composition is still where the approaches differ most clearly. Circle concentrates USDC reserves in cash and highly liquid short-duration US government instruments. Tether's reserves are also heavily weighted toward government securities but include additional asset classes and credit exposures. Those additions can introduce market or credit risk that cash and short-term government securities do not carry to the same degree. Tether, in turn, points to its excess reserve buffer and broader balance sheet as sources of resilience.

The track record: what has actually gone wrong

Neither issuer has a spotless history, but their most visible historical failure modes have differed.

Tether's major historical issue was the accuracy of its backing and disclosure claims. In 2021, Tether and Bitfinex reached an $18.5 million settlement with the New York Attorney General after an investigation found false statements concerning Tether's backing. In the same year, the CFTC ordered Tether to pay $41 million for misleading claims that USDT was fully backed by US dollars; the CFTC found that sufficient fiat reserves were held for only 27.6% of days in a 26-month sample from 2016 to 2018.

Tether's disclosure regime has changed substantially since then. It now publishes regular reserve information and quarterly attestations, and in August 2026, it added a KPMG audit of its 2025 financial statements.

Circle's most visible stress event involved banking concentration. In March 2023, Circle disclosed that $3.3 billion of USDC reserves were held at Silicon Valley Bank after the bank failed. USDC temporarily traded as low as roughly $0.87. The peg recovered after US authorities announced that all SVB depositors would have access to their funds.

Circle's current reserve structure relies heavily on short-dated Treasuries, overnight Treasury repos and cash held at regulated financial institutions, with the majority of the reserve held through the BlackRock-managed Circle Reserve Fund.

The lesson is not that one issuer is trustworthy and the other is not. The point is that stablecoin risk can reside in different areas: reserve assets, banks, liquidity, regulatory exposure, operational controls, and the issuer itself.

USDT vs USDC: liquidity and where each is used

USDT leads in overall market liquidity. It has a much larger market capitalization and significantly higher global trading volume than USDC, and it is widely used as a quote and settlement asset across centralized crypto markets.

USDT on TRON is also widely used as a transfer rail. The network has become particularly important for dollar-denominated crypto transfers and has substantial adoption in emerging-market use cases. Actual transaction costs, however, depend on TRON resource availability and network conditions rather than being universally “cheap.”

USDC is deeply integrated into regulated fintech, institutional settlement, and DeFi infrastructure. It is natively available on Ethereum, Solana, Base, Arbitrum, and numerous other chains and is supported by Circle's cross-chain infrastructure. It is better to describe USDC as having deep liquidity and protocol integration on networks such as Solana rather than claiming that it universally “dominates” Solana DeFi.

In the EEA, USDC has a clear regulatory footing: Circle SAS is an ACPR-licensed Electronic Money Institution and issues USDC under MiCA. ESMA has also required CASPs to address services involving non-MiCA-compliant stablecoins by the end of Q1 2025, making issuer status increasingly important for EEA platforms.

SimpleSwap's H1 2026 data reflects the importance of USDT on TRON, but the metric needs to be stated precisely. USDT on TRON was the largest single net gainer in the report, up 6.0 percentage points when measured as the difference between its share of received volume and its share of sent volume. It was not identified as the largest asset in terms of absolute platform volume.

Trading vs holding: which stablecoin fits which job

Holding both can reduce concentration in a single issuer, but it does not eliminate stablecoin risk. It simply distributes that exposure across two issuers and reserve structures.

Risks USDT and USDC share

Both issuers have the technical ability to block or freeze tokens at specific addresses. Circle's terms expressly permit address blocking in connection with illegal activity and valid government orders; Tether likewise freezes USDT in coordination with law enforcement and sanctions enforcement.

Both stablecoins can temporarily deviate from $1 during periods of market stress. Both depend on reserve management, redemption liquidity, and functioning banking and financial-market infrastructure. And both expose users to the ordinary operational risks of blockchain transactions: choosing the wrong network, entering the wrong address, interacting with phishing sites, or compromising wallet credentials.

A dollar stablecoin is designed to reduce exposure to the price volatility typical of cryptocurrencies such as BTC or ETH. It does not eliminate depeg risk, issuer risk, liquidity risk, regulatory risk, or user error.

How to swap USDT to USDC with SimpleSwap

SimpleSwap is a self-custodial multi-source swap aggregator that draws liquidity from more than 20 CEX and DEX providers.

To swap USDT to USDC, or the reverse:

1. Select the asset and network for each side, for example, USDT (TRC20) to USDC (Solana).

2. Choose a fixed or floating rate. A fixed rate is locked for 20 minutes; to keep that rate, the deposit must arrive and receive the required blockchain confirmation within the time window. A floating rate is calculated when the swap is processed and may change with the market.

3. Enter the receiving wallet address, and make sure the selected network matches the destination wallet's network.

4. Send USDT to the deposit address generated for the order.

5. After the deposit is confirmed and the exchange is processed, USDC is sent to the receiving wallet. The exchange can be tracked using its Exchange ID.

SimpleSwap uses an all-in exchange rate rather than adding a separate percentage trading fee on top. Pricing is dynamic and depends on the pair, liquidity, market conditions, network fees, and routing; for some assets, the cost may start from 0.2%. The receiving-side network fee is included in the amount shown, while the network fee charged by the user's wallet for sending the initial deposit is separate.

Most crypto-to-crypto exchanges can be started without signing up. However, “no KYC” applies only to transactions assessed as low risk. SimpleSwap may require mandatory KYC or additional information for any transaction when risk, AML, compliance, or other applicable triggers are met, and the transaction may be temporarily paused for review. No public percentage should be attached to how often this happens unless supporting data is available.

SimpleSwap does not maintain permanent customer crypto balances between swaps. Its only official website is simpleswap.io.

FAQ: USDT vs USDC

Is USDC safer than USDT?
There is no universal answer. USDC has a simpler reserve composition focused on cash and highly liquid US government instruments, more frequent reserve disclosure, and explicit MiCA-compliant issuance in the EEA. USDT has a longer operating history and substantially greater aggregate market liquidity. Tether also completed its first full independent financial-statement audit in August 2026. The relevant question is which risk matters most to you: issuer concentration, reserve composition, liquidity, jurisdiction, redemption access, or operational exposure.

Which stablecoin is more liquid, USDT or USDC?
Overall, USDT. As of September 2026, it has a substantially larger market capitalization and higher global trading volume. USDC can still have deeper or more convenient liquidity for particular protocols, networks, or regulated venues.

Are USDT and USDC audited?
The word “audited” needs qualification. Tether continues to publish quarterly reserve attestations from BDO, and it now also has a full KPMG U.S. audit of Tether International's 2025 financial statements, with an unqualified opinion. Circle publishes weekly reserve data and monthly third-party reserve assurances, while Deloitte has audited Circle's corporate financial statements since fiscal 2022. Reserve attestations and annual financial-statement audits are different forms of assurance.

Can USDT or USDC be frozen?
Yes. Both issuers have mechanisms that can block or freeze tokens at specific addresses, including in connection with sanctions, suspected illegal activity, or valid law-enforcement requests.

Can I swap USDT to USDC without an exchange account?
On SimpleSwap, most crypto-to-crypto swaps can be initiated without signing up. However, risk-based compliance checks still apply, and SimpleSwap may require KYC or supporting information where its monitoring or compliance procedures trigger additional review.

What happened to USDC in March 2023?
Circle disclosed that $3.3 billion of USDC reserves were held at the failed Silicon Valley Bank. USDC temporarily fell to roughly $0.87 before returning toward its $1 peg after US authorities announced measures protecting all SVB depositors.

Should I hold USDT or USDC long term?
There is no universally correct choice. USDC currently has a simpler reserve profile and reports reserves more frequently, while USDT has significantly greater aggregate liquidity and a longer operating history. Splitting exposure between them can reduce concentration risk in a single issuer, but it does not eliminate stablecoin, network, custody, or regulatory risk.

This article is for educational purposes only and is not financial or investment advice. Stablecoin reserves, reporting practices, regulatory status, network support, and exchange availability can change. Check the issuers' latest disclosures and the rules applicable in your jurisdiction before relying on them. SimpleSwap's only official domain is simpleswap.io.

Sources: 

1. CoinGecko — Tether (USDT) Historical Data

2. CoinGecko — USDC Historical Data

3. Tether — Q2 2026 Financial Figures and Reserves

4. Tether — KPMG U.S. Audit of 2025 Financial Statements

5. Circle — Transparency and USDC Reserves

6. Tether — Supported Protocols

7. Circle — The Next Chapter for USDC

8. Circle — MiCA USDC White Paper

9. Circle — MiCA Compliance in the EU

10. Circle — CCTP Documentation

11. New York Attorney General — Tether and Bitfinex Settlement

12. CFTC — $41 Million Tether Enforcement Action

13. Circle — USDC and Silicon Valley Bank

14. Federal Reserve — Silicon Valley Bank Depositor Announcement

15. ESMA — Guidance on Non-MiCA-Compliant Stablecoins

16. Circle — USDC Terms

17. Tether — Legal Terms

18. SimpleSwap — H1 2026 Report

19. SimpleSwap — FAQ

20. SimpleSwap — Terms of Service

21. SimpleSwap — AML/KYC Policy

22. SimpleSwap — Safety

We are marking it anyway because those three years changed how we work. KAS was never our biggest asset by volume. What it surfaced was an assumption we had carried since 2018, and fixing it changed the pricing logic that every other pair now runs on. In 2023, it seemed like a catalog edge case. Today, it feels like a preview of where the whole market is headed.

Here is why that matters to anyone embedding a swap. A user taps the swap button in your product. The estimate is off, or the funds take longer to arrive than the screen showed. They do not open a block explorer to figure out which layer failed them. They write to you.

That asymmetry defines the category. The question is not which provider has the longest asset list, but what job you are hiring someone to do.

The jobs a swap provider is hired for

Keep the promise I made on your behalf. Your interface shows a number before the user commits funds. That number came from an execution layer, but your product appears to be the one that said it.

Do not make me the one who has to explain. Every stalled swap turns into a support conversation somewhere. Whether it lands on your team depends on how clearly the provider shows what went wrong and how quickly a person steps in.

Be there on the worst day. Any provider looks competent on a calm day. The test is what happens when liquidity thins across the market at once, which is the day your users most want to move.

Do not turn integration into a permanent project. If every new asset becomes a ticket on your roadmap, you did not buy infrastructure. You bought an obligation.

Stress test one: a block faster than a price

KAS was one of our hardest exams, and the reason is structural.

An estimate is assembled from live quotes across venues that can fill the trade, weighted by the depth behind each one at that moment. It has a shelf life, because a quote from four seconds ago describes a market that no longer exists. On a slow chain, that shelf life comfortably exceeds the confirmation window, so the estimate survives the wait.

When we started routing KAS in 2023, Kaspa was producing about one block per second. The Crescendo hard fork in May 2025 raised that to ten. Settlement now happens faster than quote refreshes, which means the price your user agreed to can go stale within the very window it is supposed to hold, and the venue that looked best a moment ago may already be the wrong choice.

None of that is the network's fault. What broke was an assumption inherited from a decade of slower rails: that the chain would always be the slow part.

Three years of rebuilding produced one portable lesson. An estimate is not a prediction about the market, it is a commitment with an expiry, and a system that does not track the age of its own inputs cannot honor it. Floating estimate accuracy on SimpleSwap now reaches 99.998% for the majority of swaps, and networks like this one are part of that.

"Fast chains did not get rid of latency. They just pushed it into a layer no one had ever measured, because there had never been a reason to measure it."
Stefan Lauer, Head of Infrastructure, SimpleSwap

Stress test two: the day the depth disappeared

Speed is one way to break an execution layer. Removing its liquidity is the other, and the industry ran that experiment in public on 10 October 2025.

Roughly $19 billion in leveraged positions were force-closed within 24 hours across some 1.6 million accounts. Bitcoin fell by around 14% at its lowest, and several smaller assets briefly printed near zero as the order book ran out.

For anyone embedding a swap, the price move is not the main point. What matters is what broke underneath it. Reported outcomes included API failures and delayed deposits at a major exchange under heavy load, a well-known perpetuals venue offline for about eight hours, and another down for roughly four and a half. Synthetic dollar pricing detached sharply at one venue while holding near parity elsewhere, pointing to fragmentation rather than solvency.

Every one of those failures happened at the plumbing layer, and none were caused by a blockchain being slow.

That is the Kaspa argument arriving from the opposite direction. One event compressed the time available to quote, the other removed the depth behind it. In both, the chain performed as designed and the layer above decided what users experienced.

The structural issue lies in that fragmentation. When pricing on one venue breaks away from the rest of the market, a single-source route inherits the bad number. Aggregation across 20+ liquidity providers is what keeps one venue's bad half-hour from becoming your user's execution.

"You find out what an execution layer is worth on about four days per year. The rest is practice."
Rick Cramer, Head of Analytics, SimpleSwap

Three questions to ask any swap provider

Throughput answers none of the jobs above. These do, and they work equally well pointed at us.

How old is the quote you are showing my users? A provider treating a four-second-old quote the same as a fresh one is guessing on your users' behalf, and the guess arrives with your logo on it.

How many venues can a trade actually reach? Ask for the number of sources, then ask what happens when one stops quoting mid-route. Single-source execution looks identical to aggregated execution until the day it does not.

What does failure look like from my side? Every execution layer fails sometimes. What matters is whether your support team can see a stalled swap in real time and quickly reach a human.

What changes when fast becomes the default

Kaspa felt like an outlier when we integrated it. Now it reads as a preview. Sub-second finality is spreading across the category, and systems built for ten-minute settlement will meet the same constraints we ran into three years ago. We rebuilt for that on the network where the pressure was highest, and the volumes were modest, because what you learn from a demanding asset carries over to easier ones, and not the other way around.

So the anniversary is not really about an asset. It is about the year we stopped assuming the chain would wait for us.

Infrastructure check

SimpleSwap API integration is what those 6,000+ products already run on, including self-custody wallets, with no separate tier for demanding assets. Integration covers white-label or API-level swaps, revenue share on partner volume, asset coverage maintained on our side, and a named contact for incidents.

What's happening

A post or a private message claims SimpleSwap is quietly running a higher loyalty tier, available only if you install a browser extension or run a short script first. It is making the rounds on trading forums and in Telegram groups, often presented as an "insider trick" or a "leaked" bonus code. The figure attached to it has recently shifted, now ranging from 25% to 32%. The underlying mechanic has not changed at all.

None of it is true. It's a scam that borrows SimpleSwap's name, not a real loyalty perk. SimpleSwap's actual program lives at simpleswap.io, and no script unlocks a hidden version of it.

How the trick works

Tampermonkey itself is a legitimate tool that millions of people use to run small scripts on sites they trust. This scam works by getting you to load a stranger's script into it and point that script at SimpleSwap, which has nothing to do with installing an official SimpleSwap tool.

The version circulating right now is formatted like a private security write-up, with a summary and screenshots, and is even labeled as a "proof of concept". It feels like something a researcher would disclose, not a tip from a stranger. That polish is what makes it convincing, more than the substance underneath it.

Once it is running, the script does one thing: it swaps the deposit address on the real SimpleSwap page for one controlled by the scammer. Your screen still shows the right amount and the swap details you entered. Only the destination changes, and by the time the transaction confirms on-chain, there is nothing left to redirect.

The story about a server bug is what gets people to install it. A plain "secret bonus" pitch is easy to ignore. A technical flaw you can supposedly exploit feels different, and that difference is the entire hook.

The number is the tell

SimpleSwap's real Loyalty Program caps at a 20% service fee discount and up to 0.4% cashback in USDT, earned through swap volume inside your account. There's no 25% tier sitting behind a bug for anyone to unlock, because the program doesn't go that high in the first place. A number above what SimpleSwap actually publishes isn't a flaw waiting to be found. It's the detail that gives the script away.

If a number looks better than what SimpleSwap advertises, that gap is the warning sign.

What SimpleSwap's Loyalty Program actually gives you

SimpleSwap does have an actual Loyalty Program, and every detail of it is public on simpleswap.io/loyalty. No extension or script is involved, and there's no invite code to redeem.

The levels, in order:

• Bronze

• Silver

• Gold

• Platinum

Bronze starts automatically the moment you sign up, with no swap volume required. Each level above it brings a bigger fee discount and more cashback, based on how much you've swapped.

• Fee discounts climb to 20%.

• Cashback goes up to 0.4% in USDT on every finished swap.

• Once you reach a level, it's yours. It doesn't reset if your volume drops later.

The only place your rewards exist

Every Loyalty Program benefit is calculated and paid out in your account on simpleswap.io or in the official SimpleSwap app. There's no other channel. SimpleSwap does not offer a browser extension, and it never runs a script to raise your tier or unlock a bonus rate. If a message tells you otherwise, it didn't come from SimpleSwap.

How to stay clear of it

• Reach your account only through simpleswap.io, or through the official app from the App Store or Google Play. The Android APK is posted directly on simpleswap.io too, never anywhere else.

• Treat any script that promises to "unlock" a bonus as hostile by default. SimpleSwap never asks you to install something to receive a reward you've already earned.

• Check your level and rate inside your Customer Account, not inside a screenshot someone sent you.

• If an offer beats 20% off plus 0.4% cashback, don't chase it. Report it.

If you've already run it

Stop there. Delete the script and disable Tampermonkey too if you're not sure what else is running through it. If you already sent a swap through it, move any remaining funds in that wallet to a new one right away, since the connection may be compromised. Revoke any permissions you approved while the tool was active. Then reach out to our support team via simpleswap.io so we can flag the pattern and warn others.

The key point

There is no hidden loyalty tier behind a script, and there never was. Any real benefit SimpleSwap offers is already visible in your account on simpleswap.io, so you can review it before you install or agree to anything. If a bonus asks you to download first and log in second, that order alone is a good sign it is not ours.

SimpleSwap Loyalty Scam FAQ

Is the 25–32% SimpleSwap loyalty bonus real?

No. SimpleSwap's Loyalty Program caps at a 20% service fee discount and 0.4% cashback in USDT, unlocked by swapping through your own account rather than by installing anything. A script advertising a bigger bonus outside the app isn't connected to SimpleSwap, no matter how official the branding looks.

Do I need to install anything to get SimpleSwap Loyalty rewards?

No. Signing up automatically gives you the Bronze level. Every discount and cashback payment after that is calculated on simpleswap.io, within your Customer Account. No extension or script is ever part of the process.

Does SimpleSwap have an official browser extension?

No. SimpleSwap doesn't publish or support a browser extension on any browser. Every feature, including the full Loyalty Program, works directly on simpleswap.io or in the official app, so there's no reason to add a third-party tool to use the service. General-purpose tools like Tampermonkey are legitimate on their own, but a script written by a stranger and aimed at SimpleSwap isn't something we publish, no matter what it claims to unlock.

Is SimpleSwap safe?

Judge it the way this guide would tell you to judge anything: by whether it asks you to install something outside its own site or app. SimpleSwap is self-custodial, so your crypto moves from a wallet you control to another wallet you control, with no balance held on the platform between swaps. The service has been running since 2018, and the scams built around its name exploit that trust rather than breaking anything on the platform itself.

Where can I check my real Loyalty level and rewards?

Inside your Customer Account on simpleswap.io, or in the official app. That page shows your current level and swap volume, along with the exact discount and cashback tied to it. Nowhere else shows this correctly, because nowhere else calculates it.

How do I know I'm actually on simpleswap.io and not a lookalike?

Read the address bar before you read the page. The domain must end exactly in simpleswap.io, with nothing added before or after it. The full ten-second check, including why the padlock icon proves nothing on its own, is in Spot a Fake SimpleSwap in 10 Seconds.

What comes next

New entries in Know the Scam by SimpleSwap go up regularly, alongside the original crypto scam guide this pattern comes. Follow #KnowTheScam to catch the next one before it reaches you.

This article is for informational purposes and isn't financial advice. Trading cryptocurrencies carries risk, and any decision to do so is your own. SimpleSwap isn't liable for losses connected to those risks. Full details are in our Terms of Service.

The scale here is easy to underestimate. In January 2026, Dune data showed that ​​Solana launchpads alone created more than 25,000 tokens a day for five consecutive days, with Pump.fun accounting for roughly 70% of them. That is one ecosystem on one chain.

Deploying a token costs almost nothing and requires no permission, which is the point of the technology and also the reason this category exists at all.

Two of the ways it goes wrong are used interchangeably in conversation, and they should not be.

A honeypot is a trap in the code. You buy; the transaction succeeds; then your sell reverts. The restriction was written into the contract before you ever arrived.

A rug pull is a timing trap. The contract may be perfectly ordinary. You can buy and sell normally. Then the people holding the liquidity remove it, or dump their supply into your bids, and the token becomes unsellable because nothing is left on the other side.

The first is a locked door. The second is a room that gets emptied while you are standing in it.

What the trap looks like in the code

Honeypot contracts do not need clever cryptography. They need a conditional in the transfer function.

Sell reverts. The _transfer logic checks whether the destination is the liquidity pair, which is what selling looks like on-chain, and reverts if it is. Buys pass. Sells fail with a generic error, which most people read as a slippage problem and retry with higher slippage.

Blacklists and whitelists. Rather than blocking everyone, the contract keeps a list. Ordinary buyers are added to it after purchase. A handful of addresses never are. This is the variant that fools careful people because the chart shows real sales.

Modifiable tax. The contract exposes an owner-only function such as setFee. Tax is 3% while people accumulate, and becomes 99% the moment the owner decides. Technically you can still sell. You will receive almost nothing.

Mint rights. If the owner can call mint, supply is not fixed regardless of what the tokenomics image said. Your share can be diluted to nothing without a single sell.

Pause functions. A trading toggle that halts all transfers, held by one address.

Proxy contracts. The most underrated. An upgradeable proxy routes calls to a separate logic contract that the deployer can replace. The code you audited on Monday is not necessarily the code executing on Friday. Any check you perform on a proxy has a shelf life.

Why does the chart lie

This is the part worth internalizing because it defeats the most common instinct.

The standard reassurance is to look at the trading activity: price rising, volume real, and sells visible on the chart. In a whitelist honeypot, all of that is true, and none of it protects you. The wallets exiting are the ones the contract permits to exit.

The one-minute check

None of this requires reading Solidity. Four steps, in order, using free tools.

1. Run two scanners against the contract address. GoPlus returns a structured report covering honeypot detection, modifiable tax, hidden owner, mint, and blacklist functions. It powers the risk warnings inside many wallets and explorers. Token Sniffer scores the token and matches its bytecode against a database of known scam templates, which catches the large share of these that are copy-paste jobs. A low score usually means the codebase is structurally identical to previous rugs.

Use two, because they disagree with each other, and disagreement is information.

2. Simulate a sell. Honeypot.is and similar tools execute a simulated buy and sell against the contract and report what actually happens, including the real buy and sell tax rather than the advertised one. This is the single most direct test available, because it asks the contract the only question that matters.

3. Check whether liquidity is locked, and for how long. If LP tokens sit in the deployer's wallet, the liquidity can be withdrawn at any moment and the exercise is over. Look for a lock with a reputable locker such as Unicrypt or Team Finance, verify the lock transaction itself rather than a claim on a website, and note the expiry date. A lock expiring next week is not a lock.

4. Look at holder concentration. Bubblemaps and the explorer's holder tab show whether supply is spread or clustered. If a small group of wallets, especially connected ones, holds a large share, the exit risk is theirs to trigger and yours to absorb.

Then, if all four pass, do a minimal test buy followed immediately by a test sell. Not a small buy. A buy and then a sell. The purchase proves nothing. Only the exit does.

What "low risk" actually means

Two honest limits on all of the above, because a checklist that oversells itself is its own hazard.

A green result from a scanner means no known traps were detected, not that the token is safe. New trap patterns appear before detection rules do, and automated analysis is pattern matching, not comprehension.

And a red flag is not always fraud. Some legitimate launches retain ownership early in order to fix problems, or run temporarily higher taxes. The difference is whether the team is identifiable and whether those powers are time-locked. Unrenounced ownership plus an anonymous team plus unlocked liquidity is not three yellow flags. It is one red one, three times.

Scale gives a sense of the odds. In the fourth quarter of 2024, GoPlus analysts flagged roughly 67,000 suspicious tokens across Ethereum, BNB Chain and Base, a category covering rug pulls, honeypots and other risky contracts rather than honeypots alone. Base by itself accounted for around 54,000 of them. Token Sniffer, for its part, self-reports flagging 6.08 million of the 47.9 million tokens it indexes across fifteen chains, which is a vendor figure rather than an audited one and is best read as an order of magnitude.

Loss estimates deserve more caution than they usually get. Figures for annual rug pull losses range from several hundred million to several billion dollars depending on methodology, because some counts measure funds provably stolen while others include any token whose liquidity collapsed, which sweeps in ordinary project failure alongside deliberate fraud. Both get reported under the same heading. The direction is not in doubt. The precision is.

Where this meets your swap

A swap service can move you into a token. It cannot move you out of one that will not let you leave.

That asymmetry is worth stating plainly, because it is the practical reason this crypto scam belongs in a series about swaps. If a token's contract blocks your sell, no exchange, aggregator, or DEX can execute it, and the failure will appear to be a routing problem rather than what it is. There is nothing on our side or anyone else's to fix, because the transaction is being refused by the token itself.

Which is also why established listings behave differently from brand-new contracts. An asset that has traded across many venues for a long period has been through a filter, imperfect but real. A contract deployed yesterday has been through none, and the only thing standing between you and its author is the check you run before buying.

Our only official domain is simpleswap.io.

What comes next

Each entry above gets its own breakdown in "Know the Scam by SimpleSwap." Next up: rug pulls, fake support, fake airdrops, drainer dApps, and recovery scams.

This article is for educational purposes only and is not financial or investment advice. Tools named here are examples rather than endorsements, and none of them replaces your own judgement. SimpleSwap's only official domain is simpleswap.io.

SimpleSwap-powered fixed-rate exchanges have been running within the Exodus wallet for a year. Over those twelve months, the partner side of the product gained five capabilities, none of which required Exodus or any other partner to change their integration.

Automatic refunds on swaps paused for screening

A small number of exchanges are paused for compliance checks. If a check requires further review and the exchange cannot proceed, the funds are automatically returned to the refund address; no ticket is needed.

Most refunds are completed within 5 to 15 minutes, although they can take up to 30 minutes when networks are busy. Partner statistics first show the exchange as failed, then as refunded once the money arrives.

What partners need to know:

• The refund_address field must be passed in the API request. Partners who do not collect a refund address from the user can provide their own and settle directly with the user.

• A standard network fee is deducted from the returned amount. No service charge is added on top of it.

• Coverage spans the major networks and assets. Account managers hold the current list.

• Refunds apply to eligible exchanges, not to every case.

A pause does not mean the user is being accused; it simply means there is reason to take a closer look. Crypto funds can carry over history from earlier or third-party transactions that the current sender may know nothing about, which is why the money is returned rather than left sitting somewhere.

"Nobody celebrates a swap that had to be sent back," said Stefan Lauer, Head of Infrastructure at SimpleSwap. "But whether that money comes back on its own or through a support ticket is the part a partner lives with every day. Wallets put their own users in front of infrastructure they did not build, and a year of that from Exodus is not a small thing to hand over. Most of what shipped this year came from taking it seriously."

Fee settings per API key and per pair

Partner accounts now set the fee percentage for an individual API key and an individual pair, rather than across the account as a whole.

A wallet can issue a separate key for each product or traffic source, give each one its own margin, and then compare the results directly. A BTC-to-USDT route can be priced differently from a long-tail altcoin route.

Pricing experiments run within the dashboard rather than in a release cycle.

Margin set on the individual transaction

The exchange creation method accepts a custom_fee parameter, so the profit share is set when an exchange is created rather than inherited from its key. Reference: https://api.simpleswap.io/docs/api/create-exchange

A promotional rate for one user segment can run alongside a standard rate for another, without changing account settings.

This is the level of payment flows usually needed, where pricing depends on the basket rather than on the integration.

Reverse estimate

A standard estimate answers the question "How much will I receive for 1 BTC?" Reverse estimate answers the opposite one: "How much does the customer need to send to receive 500 USDT?".

Payment services use it to quote goods and services in a stable equivalent while accepting whatever asset the buyer holds.

The settlement figure is known before the invoice goes out.

300+ assets added, with no partner-side release

More than 300 assets were listed over the year, including tokens requested directly by partners. They reach partner apps through the same currency call already in place.

Behind that pace sits the aggregation layer, which now draws on 20+ liquidity providers across CEX and DEX venues, with NEAR among the sources announced publicly. A wider pool means a new asset can usually be routed through existing infrastructure, rather than waiting for a single venue to support it.

Listing requests arrive when a coin starts moving, making the speed of adding an asset a commercial rather than a technical question.

Where things stand after year one

• 20+ liquidity providers aggregated across CEX and DEX sources

• 2,800+ assets available for exchange, 300+ of them listed in the past year

• 3.2M+ trading pairs

• 6,000+ partner products running SimpleSwap

• 20M+ swaps processed for 10M+ users since 2018

• 99.9% uptime

• 4-minute average support response when a case needs a person

Five changes went out over the year, and not one of them was a migration. The integration Exodus shipped in August 2025 is the same one running today, with a broader asset list and finer control over what each transaction earns. Teams that want to switch any of it on will find the details in the API documentation or through their account manager.

About SimpleSwap

SimpleSwap is a self-custodial, multi-source swap aggregator that helps users exchange crypto with greater privacy and control, without having to compare providers and routes themselves. It supports direct wallet-to-wallet swaps across 20+ liquidity providers and 2,800+ swappable assets, combining liquidity from well-known CEX and DEX sources under the hood.

Operating since 2018, the exchange infrastructure is integrated into 6,000+ partner products, including Exodus, Tangem, Ellipal, Cake Wallet, and Tonkeeper.

For partners: SimpleSwap API integration at https://simpleswap.io/affiliate-program API documentation: https://api.simpleswap.io/docs

Media contact: marketing@simpleswap.io

This article was written by SimpleSwap — a self-custodial multi-source swap aggregator. 2,800+ assets, 20+ liquidity providers across CEX and DEX sources, 20M+ swaps since 2018. Wallet-to-wallet by design, with routing handled under the hood.

The information in this article is not a piece of financial advice or any other advice of any kind. The reader should be aware of the risks involved in trading cryptocurrencies and make their own informed decisions. SimpleSwap is not responsible for any losses incurred due to such risks. SimpleSwap’s only official domain is simpleswap.io.

You copy a wallet address. You paste it. You send.

Somewhere in between, a process running on your computer noticed that what you copied matched the shape of a crypto address and replaced it with a different one. The paste looked normal. The field is filled. Nothing on screen suggested anything had happened, because from the operating system’s point of view, nothing unusual did.

This is clipper malware, and it is one of the oldest tricks in crypto for a reason: it is cheap, it requires no interaction with any blockchain, and it exploits the one step nobody reads carefully.

How it works, mechanically

Three stages, and none of them are clever.

Infection. The clipper arrives inside something you installed. Cracked software, fake tools, unofficial app stores, malicious browser extensions. A Rust-based clipper, documented by Check Point Research in June 2026, was hidden inside Solana and Pump.fun sniper bots, an “Aviator Predictor,” and assorted crash-game forecasters. That is a precise portrait of the target: people hunting an edge.

Listening. Once resident, it registers a clipboard handler and maintains a list of regular expressions that match address formats for Bitcoin, Ethereum, Tron, XRP, and others. Every copy event gets tested against them. Copy a recipe and nothing happens. Copy an address, and it fires.

Substitution. The clipboard contents are swapped for an attacker’s address before you paste. That is the whole attack.

Check Point’s own conclusion is worth quoting in spirit: the malware is not the interesting part, because clippers are old news. The interesting part is that the attacker behaved less like a hacker than like a marketer. The campaign ran a WordPress hub feeding downloads on GitHub, SourceForge and YouTube, propped up by networks of fake accounts: repositories padded with fake stars and forks, a SourceForge counter showing 44,485 downloads mostly from Android devices despite no Android build existing, tutorial videos with AI narrators and coordinated positive comments, and manufactured upvotes on security platforms.

Which means every check a careful person performs before downloading, the star count, the reviews, the community sentiment, the low detection rate, has been bought in advance.

Microsoft Threat Intelligence documented a Windows clipper that has been active since February 2026, runs without a traditional installer, uses Windows Script Host and ActiveX to launch a bundled Tor proxy, and communicates with a hidden-service command server. Alongside clipboard theft, it takes screenshots and spreads through USB shortcut files. The Check Point payloads targeted both Windows and macOS, with the macOS build shipping a script that walks the victim through stripping Apple’s quarantine flag to bypass Gatekeeper. That instruction is the attack.

Why blocklists do not help

The scale of these operations is what surprises people.

CyberArk’s analysis of the MassJacker campaign, distributed via a pirated software site, found 778,531 unique attacker addresses. Only 423 of them held funds at the time of analysis, totaling around $95,300, with roughly $336,700 having passed through in total.

That ratio is the design, not a failure. Hundreds of thousands of addresses exist so that no two victims ever pay the same one. There is no single address to report, blocklist, or track. The Check Point sample contained more than 15,500 addresses in a single binary, most of them Bitcoin addresses, and rotated them as they were used.

The advice that does not transfer

Here is why this deserves its own entry rather than a paragraph in the address poisoning one.

Against poisoning, the standard defense is to keep a saved address book and select from it rather than copying from your transaction history. That works because poisoning depends on you picking a bad address that arrived legitimately in your history.

Against a clipper, the address book does not help. You can select a perfectly correct address from your own saved contacts. The substitution happens after the copy and before the paste, in transit, on your machine. The source you copied from was clean. What arrived in the field was not.

The second habitual defense also has a hole. Checking the first and last few characters catches a random substitution, so clipper authors adapted. The Laplas family introduced a method for generating addresses that closely resemble the one the victim copied, and researchers testing it produced a convincing lookalike in about five seconds. A glance at the ends now passes.

And one more, which catches people who believe they have already solved this: a hardware wallet does not protect you. It protects your keys and your seed phrase, neither of which is under attack here. It cannot know that the destination you approved is not the destination you intended. You will confirm the swapped address on the device screen yourself.

What actually works

Because the malware operates at the operating system level, defenses fall into two groups: catching a substitution in the moment and preventing infection in the first place.

Verify the address after pasting it into the field, not before. This is the single most important habit, and it inverts the usual advice. It does not matter what you copied. What matters is what is sitting in the recipient box at the moment you confirm. Read it there, against a trusted source, comparing the middle of the string rather than just the ends.

Check it on the signing device. If you use a hardware wallet, the address shown on its screen is the one the transaction will actually use. That display is beyond the reach of clipboard malware on your computer, making it the most trustworthy surface you have.

Send a small test first for large transfers, and re-verify the field contents before the main send rather than reusing anything.

If something tells you to bypass a security warning, stop. The macOS variant needed victims to disable Gatekeeper themselves. Any instruction to strip a quarantine flag, ignore a signature warning, or disable protection is not a workaround. It is the payload’s install step.

Treat cracked software as a wallet risk, not a legal one. Every major clipper campaign in the past two years has been distributed this way. Pirated applications, cracked wallet tools, sniper bots, game cheats, and “unlockers” are the primary delivery vehicles, and the calculation is straightforward: the software you did not pay for is being paid for another way.

Install mobile apps only from official stores and only via links published on the official site. Copy-paste is even harder to avoid on a phone than on a desktop.

Audit browser extensions. They can read clipboard contents in some contexts and are a common delivery route. Remove anything you do not actively use.

Keep a clean device for significant holdings. The most effective structural answer is separation: one machine for downloads, games, and experiments, another for anything involving real money.

If you suspect an infection, do not just change addresses. Scan with reputable security software, and treat any large transfer as unsafe until the device is verified clean. A clipper that is still resident will simply swap the next one too.

Where this meets your swap

Every exchange asks for a receiving address, and this crypto scam targets the exact moment you provide it, thereby putting it into our flow whether we like it or not.

There are two paste operations in a standard SimpleSwap exchange, and both are exposed on an infected machine. The receiving address you paste into the form and the deposit address you copy from us into your own wallet. A clipper can substitute either one.

Nothing on our side can detect that. The address that arrives in the field is the address we will use, because it is indistinguishable from one you typed deliberately, and a confirmed transfer cannot be reversed by anyone. So the verification is genuinely yours: after pasting, read what is actually in the box, and when copying our deposit address, check the value that landed in your wallet against the one shown on the order page.

Anyone asking whether SimpleSwap is safe should understand this honestly. The service can be operating perfectly, and your funds can still end up somewhere else because the failure occurred on your device before the transaction was created. Our only official domain is simpleswap.io.

What comes next

Each entry above gets its own breakdown in “Know the Scam by SimpleSwap.“ Next up: honeypot tokens, rug pulls, fake support, fake airdrops, drainer dApps, and recovery scams.

This article is for educational purposes only and is not financial or security advice. SimpleSwap’s only official domain is simpleswap.io.

Consider how the most effective crypto phishing of 2026 reaches its victims.

You want to use a DEX. You search for it, the first result appears, you click it, and you land on a site that looks exactly right. Everything about that sequence feels safe because at no point did you click a link somebody sent you. You navigated there yourself.

That is the entire attack. Security researchers at SEAL have tracked threat actors running fake ads every week for more than a year, impersonating Uniswap, PancakeSwap, Morpho, Hyperliquid, CoW Swap, and Ledger. In a seventeen-day window in March 2026 alone, at least $1,274,259 was stolen. Uniswap was the most impersonated brand, accounting for 41% of detected malicious sites.

The clever part is the plumbing. Rather than pointing an ad directly at a malicious page, attackers route it through a page hosted on a Google-owned domain such as sites.google.com, which carries enough reputational weight to pass automated review. The ad is checked. The destination is not.

Why the old advice no longer works

For fifteen years, the standard advice was to look at the message. Spelling errors, awkward phrasing, generic greetings, a sender address that is slightly off. That advice is now actively misleading because it teaches people to trust a test that no longer detects anything.

The evidence for that is worth citing carefully, because this part of the industry is full of numbers with no method behind them. The most frequently quoted figure — that 82.6% of phishing emails now contain AI-generated content — comes from KnowBe4's 2025 threat trends report, which covers September 2024 to February 2025. Several security researchers have noted that it circulates without a fully transparent methodology, so treat it as a directional signal rather than a measurement.

The finding that does hold up is experimental. In a controlled study by Heiding, Schneier, and colleagues, fully AI-automated spear phishing achieved a 54% click-through rate, compared with 12% for generic phishing, matching the click-through rate of emails written by human experts. The sample was modest, with 101 participants across four groups, but the direction is clear: the machine now writes as convincingly as a skilled human, at a fraction of the cost.

Meanwhile, phishing kits sell for under $100 on criminal marketplaces, complete with templates, credential-harvesting pages and evasion tooling. Somebody with no technical ability can run a campaign that reads better than most corporate email.

So: no typos, correct branding, a believable tone, and details from whatever breach you were in. The message is no longer the obvious giveaway, which makes phishing the hardest crypto scam to teach people to spot, because the thing we told them to watch no longer gives the game away.

The technique that beats two-factor authentication

This is the part worth understanding properly, because it changes what "check the URL" protects you from.

Classic phishing shows you a fake login page. Adversary-in-the-middle phishing does something more elegant: the attacker runs a live proxy between you and the real service. You type your password into what is functionally the genuine login flow. Your two-factor code works because it is being relayed to the real site in real time. You get logged in. Everything succeeds.

What the attacker takes is not your password but your session token, the credential your browser holds that says you have already authenticated. With it, they no longer need your password or second factor.

This is now the center of gravity. In its Q1 2026 email threat report, Microsoft found credential phishing rose from 89% of payload-based attacks in January to 94% in March, while traditional malware delivery fell to 5 or 6%. The modern phishing economy runs on stolen logins and the session tokens attached to them, not on viruses.

Two-factor authentication remains worth having, but it is no longer a defense against this particular attack, and the line that matters is no longer between SMS and authenticator apps. A six-digit code from an app is as reliable as one from a text message, because anything you can read and retype can be passed to the real site while you are still looking at the fake one. Microsoft draws the same split in its own documentation, separating traditional MFA from phishing-resistant methods: passkeys and FIDO2 security keys, which are cryptographically bound to the domain on which they were registered and remain silent about any copy of it.

Where does it arrive from now?

Email is still the volume channel, but the interesting growth is elsewhere.

Search ads and SEO poisoning. Covered above, and the most dangerous because the victim's own initiative is what delivers them.

Physical letters. The surprise of 2026. Printed mail on branded letterhead, impersonating hardware wallet companies, announcing a mandatory authentication update, with a QR code leading to a cloned setup page that asks for the recovery phrase. Addresses for these campaigns come from exactly the kind of vendor breach we wrote about last week.

Calendar and cloud abuse. Google's own June 2026 advisory describes fake renewal notices injected directly into Calendar invites and phishing pages hidden inside "invisible pages" in cloud documents to bypass reputation-based filtering.

Voice. AI voice cloning needs a few seconds of audio, and spoofed caller ID does the rest. A call from support asking you to read back a code is now trivially cheap to produce.

Fake security prompts. A recurring construction is the security upgrade that is itself the attack: a notice about mandatory verification, a 2FA improvement, a wallet migration, each leading to a cloned interface that asks for the recovery phrase in the name of protecting it. The pretext is the inversion, and it works because it borrows the language of the advice people have already been given.

What is phishing actually after

Three different targets, and telling them apart determines the defense.

Your recovery phrase. The oldest and final version of this crypto scam. Cloned wallet interfaces prompt you to "restore," "verify," or "re-sync," and a phrase given up that way is a total, irreversible loss. What makes this one hard to teach is that a legitimate version of the screen exists: restoring or importing a self-custody wallet does mean typing the phrase into the wallet software, and MetaMask documents exactly that flow. The difference is not what the screen asks for, but who started the process. A restore you began yourself in software you installed is normal, and a prompt that arrived by any other route is an attack. Nobody outside your own wallet ever needs the phrase, least of all an exchange or a support agent.

Your login and session. The AiTM case above is aimed at exchange accounts rather than wallets.

Your signature. Not credentials at all, but an approval that lets a contract move your tokens later. We covered that mechanic in its own entry, and it is why a "sign this message" prompt deserves the same level of suspicion as a password field.

The one thing that cannot be forged

Here is where this lands, and it is oddly reassuring.

Attackers can now generate a perfect copy, clone any interface pixel-for-pixel, buy the top search result, proxy the real login page, and relay your second factor. Every signal you were trained to inspect has fallen.

What they cannot do is control how you arrived.

What actually holds up

Bookmarks, not search. Reach every crypto service through a bookmark you created once from a hand-typed address. This defeats search ads, SEO poisoning, and typosquatting in a single habit, and it requires no judgment in the moment.

Never act on inbound contact. Email, call, letter, calendar invite, DM. If something claims to need attention, go to the service through your own bookmark and check there.

Treat security warnings as the likeliest bait. Urgency plus a security pretext is the standard construction. Real providers do not announce mandatory upgrades that begin with your recovery phrase.

Use a second factor that cannot be relayed. Passkeys and FIDO2 security keys are tied to the real domain and refuse to authenticate against a proxy. Codes are the weak link here, whether they arrive via SMS or an authenticator app, so treat an app-based code as an improvement over SMS rather than as protection against this attack.

Type a seed phrase only into a restore you started. Open the wallet software you installed, choose to import or recover, then enter it. If the screen found you rather than the other way round, it is an attack, however right it looks.

Distrust QR codes on paper. A code in a letter is a link you cannot inspect before you follow it.

Where this meets your swap

Phishing is the pattern most likely to involve our name without involving us at all, which is why we would rather set out the rules than reassure you.

We will never message you first. Nobody here will ever ask for your recovery phrase, because a swap does not require one and never will. We do not announce mandatory security upgrades by email, letter, or calendar invite. And a standard exchange does not ask you to connect a wallet or sign anything.

Our only official domain is simpleswap.io. Anyone asking whether SimpleSwap is safe to use should start there, because most of what gets reported to us as a problem with the service turns out to be a page that was never ours. Type the address by hand once, bookmark it, and use the bookmark from then on. That habit is worth more than anything else on this page.

What comes next

Each entry above gets its own breakdown in "Know the Scam by SimpleSwap." Next up: clipboard hijackers, honeypot tokens, rug pulls, fake support, fake airdrops, drainer dApps, and recovery scams.

Follow #KnowTheScam to catch every new one as it drops.

This article is for educational purposes only and is not financial or security advice. SimpleSwap's only official domain is simpleswap.io.

Banks close at 5pm. Wire transfers pause on weekends. SWIFT payments can take three business days to cross a border. None of that applies to a stablecoin. That gap explains why it has become the most-used category of crypto assets, even among people who have never bought Bitcoin.

A stablecoin is a cryptocurrency designed to maintain a stable value, typically pegged to the US dollar, by being backed by reserves — cash, short-term government debt, or other liquid assets. While Bitcoin can swing 8% in a day, a stablecoin like USDT or USDC is built to stay as close to $1.00 as possible, transaction after transaction.

That stability is the whole point. It turns a blockchain from a speculative casino into something you can actually use to hold value, pay someone, or park money between trades — without a bank account standing in the way.

By mid-2026, the total stablecoin market had grown to $308 billion, up 14.3% year over year, though it was about 4.5% below its May 2026 peak. Tether’s USDT alone accounts for roughly 59% of that supply, with USDC in second place near $75–78 billion. The top two together control over 80% of the market.

How Do Stablecoins Work?

Every stablecoin uses one of two mechanisms to hold its peg. Reserve-backed models (fiat, crypto, and commodity-backed) hold assets equal to or greater than the tokens in circulation and rely on redemption: if the market price drifts from $1, arbitrageurs buy the cheap token and redeem it for the underlying asset, or mint new tokens and sell them, pulling the price back toward parity. Algorithmic models skip the reserve and instead expand or contract supply through code based on demand — a mechanism that works until confidence in the token breaks down, at which point there’s no hard asset backing the price.

What Are Stablecoins Used For?

Trading and DeFi collateral are among the biggest use cases, offering a stable unit of account that lending, yield, and derivatives protocols can price against without exposing them to crypto volatility. Cross-border payments and remittances are also growing rapidly, as stablecoin transfers can settle in seconds, regardless of banking hours or borders. Businesses are increasingly using them for treasury management and cross-entity settlement, where waiting on wire transfers can create operating costs. For individuals, they can serve as an on/off ramp between fiat and crypto and as a way to step out of volatility without leaving the blockchain. A newer category is also emerging: machine-to-machine payments, where AI agents can transact directly in stablecoins without a human in the loop.

Why Stablecoins Exist in the First Place

Crypto’s biggest early weakness wasn’t security — it was volatility. A merchant accepting Bitcoin for a coffee in 2013 might have found the payment worth 20% less by the time it settled. A trader closing a profitable position often had nowhere “safe” to sit in crypto without cashing out to a bank, only to lose hours or days to settlement delays.

Stablecoins were created to solve crypto’s volatility by pegging their value to a trusted currency. The idea first showed up in the 2012 Mastercoin documentation as a theoretical proposal, but it did not become tradable until Tether Limited launched USDT in 2015. Adoption picked up in the late 2010s and accelerated from 2020 onward, as decentralized finance introduced lending, trading, and yield products that needed a stable unit of account.

The Main Types of Stablecoins

Not all stablecoins are built the same way. Understanding the type tells you exactly what risk you’re taking on. There are four standard categories, based on what actually backs the token:

Fiat-backed stablecoins (USDT, USDC) are the simplest and most widely used. A company holds real dollars or dollar-equivalent assets in reserve and issues one token per dollar held. You’re trusting the issuer’s reserves and its willingness to redeem, which is why reserve transparency matters so much when comparing them. Tether publishes quarterly attestations of its reserve composition; Circle has leaned harder into full audits and a reserve structure built almost entirely around cash and short-dated US Treasuries.

The concentration runs deep: on TRON, the second-largest stablecoin network, roughly $85 billion of its $87 billion in stablecoin supply is USDT alone, over 97% of the network’s liquidity sitting in a single token, according to Bitcoin Foundation data.

Crypto-backed stablecoins, like DAI, are backed by other cryptocurrencies locked in a smart contract and are usually over-collateralized to help cushion price swings. No single company controls issuance — the code does. The trade-off is that smart-contract and liquidation risks replace issuer risk: if the collateral drops sharply, automated liquidations can occur faster than a person at a firm can step in.

Commodity-backed stablecoins, like PAXG or XAUT, are tied to a physical asset, almost always gold, that the issuer keeps in custody. Each token stands for a claim on a set amount of that metal. Here, the main trust is in the custodian and the audit trail — you are relying on the gold in the vault matching the tokens in circulation, and on redemption actually working when needed.

Algorithmic stablecoins aim to hold their peg through supply-and-demand rules built into a protocol rather than hard collateral. They are the most experimental category, and TerraUSD’s collapse in May 2022 remains the clearest warning: once confidence broke, the system’s stabilization mechanism exacerbated the sell-off rather than absorbing it. The token lost nearly all its value within days. That failure also points to why many newer designs move toward hybrid stablecoin models that combine different mechanisms to improve resilience.

Newer entrants are usually hybrids rather than a separate fifth category. Multi-collateral or synthetic tokens like USD3 or sDAI combine several stablecoins or add yield mechanisms on top of a fiat- or crypto-backed base, spreading issuer risk across multiple baskets. Compliance-forward, programmable stablecoins like Aave’s GHO or PayPal’s PYUSD use the same fiat- or crypto-backed reserve logic but are designed to integrate more smoothly into regulated financial systems and DeFi protocols, with reserve audits built in from the start. This is also the category quietly powering machine-to-machine payments: AI agents made roughly 14 million payments in USDC over a recent 30-day period, and nearly all of them used this stablecoin.

How Stablecoins Are Regulated: The GENIUS Act

The US GENIUS Act, signed into law in 2025, established the first federal licensing and reserve framework for “payment stablecoins,” requiring 1:1 backing and prohibiting issuers from paying yield directly. The full rules are still being worked out, but major payment companies like Visa and Stripe are already building stablecoin rails as if this will become standard financial infrastructure rather than just a workaround.

That’s the direction stablecoins are heading: less experimental, more like basic infrastructure that people only notice when it isn’t there.

What This Actually Means for You

If you’re holding crypto and want to get off the volatility rollercoaster without leaving the blockchain entirely, a stablecoin is that off-ramp. If you’re sending money across a border where local banking is slow, expensive, or simply unavailable, a stablecoin is often faster and cheaper than the alternative.

Worth keeping in perspective: of the tens of trillions of dollars in stablecoin transfers that happened in 2025, only an estimated $350–550 billion was genuine real-economy payments; the rest was trading activity and funds moving between wallets and exchanges, per Reap’s 2026 stablecoin data. Stablecoins are becoming a payments rail, but right now they’re still mostly a trading rail that also happens to work for payments.

Getting Your First Stablecoin: What the Process Actually Looks Like

For someone new to this, the practical question isn’t “what is a stablecoin” in the abstract — it’s “how do I actually get one without making a costly mistake?” SimpleSwap is a self-custodial swap aggregator that pulls liquidity from 20+ sources and routes across 2,800+ assets. It converts existing crypto directly into a stablecoin, such as USDT or USDC, and sends it straight to a wallet address you control.

As a SimpleSwap crypto exchange transaction, the process works like this: you choose what you’re sending, choose the stablecoin you want to receive, paste your wallet address, and confirm. Specifically for crypto-to-crypto conversions, does SimpleSwap require KYC? Identity verification is triggered mainly when a fiat payment partner is involved, since those partners operate under their own regulatory obligations — but it isn’t the only trigger across the industry. Some platforms also verify users above certain transaction thresholds, in specific jurisdictions, or as part of standard sanctions screening, regardless of whether fiat is involved in the trade. That distinction matters if you’re comparing platforms: some require full account verification before you can swap even between two crypto assets, while non-custodial aggregators generally don’t, as long as no fiat currency touches the transaction and no other trigger applies.

A Word on Risk, Because Every Stablecoin Carries Some

It’s honest to say that “stable” describes the intent, not an absolute guarantee. USDC briefly slipped from its dollar peg in March 2023 when Silicon Valley Bank was seized by regulators; it held part of Circle’s reserves at the time. It recovered within days once the reserves were confirmed intact. TerraUSD’s algorithmic collapse the year before never recovered. The lesson isn’t that stablecoins are inherently unsafe: it’s that the backing model determines how a shock plays out, and understanding that model before you hold a large position is worth ten minutes.

FAQ

Is a stablecoin actually risk-free?

No. It removes price volatility, not risk entirely — you’re still exposed to issuer solvency risk, smart-contract bugs, or regulatory action, depending on the type.

Which stablecoin is the safest?

There’s no single answer; it depends on how much you weigh issuer transparency, liquidity, and decentralization against each other. Diversifying across multiple options is a common approach.

Can I lose money holding a stablecoin?

Yes, if the peg breaks (a “depeg” event) or the issuer fails to honor redemptions — which is why understanding what backs a stablecoin matters more than its price on any given day.

Do I need to verify my identity to buy a stablecoin?

Usually, only if fiat currency is involved in the transaction. Crypto-to-crypto conversions to a stablecoin on non-custodial platforms typically don’t require an account, though some platforms add checks above certain volume thresholds or in certain jurisdictions.

How is a stablecoin different from a regular cryptocurrency?

Regular cryptocurrencies like Bitcoin or Ethereum have no price peg and can fluctuate freely with market demand; stablecoins are specifically engineered to minimize fluctuations relative to a reference asset, usually the US dollar.

How does a stablecoin stay at $1?

Through reserve backing plus redemption arbitrage, if the price drifts, traders buy or redeem the token until it returns to parity. Algorithmic stablecoins instead adjust supply through code, which is a less reliable mechanism, as TerraUSD showed.

What backs a stablecoin?

It depends on the type — cash and short-term government debt for fiat-backed tokens, other cryptocurrencies locked in a smart contract for crypto-backed tokens, physical assets like gold for commodity-backed tokens, or, for algorithmic tokens, no hard collateral at all.

What is an example of a stablecoin?

USDT and USDC are the two largest fiat-backed examples. DAI is a widely used crypto-backed example, and PAXG is a common commodity-backed example.

Is USDT a stablecoin?

Yes. USDT (Tether) is the largest stablecoin by market cap, a fiat-backed token pegged to the US dollar and backed primarily by cash and short-term government debt.

What happens when a stablecoin depegs?

Its market price moves away from its $1 target. The outcome depends on the backing model: USDC recovered within days of its March 2023 depeg once its reserves were confirmed intact, while TerraUSD’s 2022 depeg triggered a collapse it never recovered from.

This article was written by SimpleSwap — a self-custodial multi-source swap aggregator. 2,800+ assets, 20+ liquidity providers across CEX and DEX sources, 20M+ swaps since 2018. Wallet-to-wallet by design, with routing handled under the hood.

The information in this article is not a piece of financial advice or any other advice of any kind. The reader should be aware of the risks involved in trading cryptocurrencies and make their own informed decisions. SimpleSwap is not responsible for any losses incurred due to such risks. SimpleSwap’s only official domain is simpleswap.io.

Here's what actually moved the market. On Wednesday, Treasury Secretary Scott Bessent doubled the size of the department's long-duration bond buybacks, from $2 billion to at least $4 billion per operation. The catch: the change doesn't take effect until September 9 and runs through November 4. Not one dollar has moved yet.

Long-bond yields, sitting near a two-decade high after weak demand for 30-year debt, dropped sharply anyway, as traders read the surprise timing as the Treasury stepping in behind a shaky market. Yields crept back up by Thursday morning, and economists couldn't agree on whether a modestly bigger buyback changes much of anything.

Crypto didn't wait for that debate to settle. Traders who had shorted bitcoin, positioned for tighter conditions rather than a friendlier tone from the Treasury, got run over: about $3 billion in short positions were liquidated over the following day, and each liquidation triggered more buying, pushing the price up on momentum alone. Bessent added fuel Thursday, telling CNBC the eventual buyback total could top $4 billion.

Sentiment kept pace with price. The Fear & Greed Index opened the week at 46. It jumped to 62 within a single day. By Friday, it hit 72: from fear to solid greed in about 48 hours.

Real conviction, or a leverage squeeze?

The bull case has real inputs behind it. Large holders kept buying through the drawdown and the bounce. Spot and futures demand turned positive on a 30-day basis for the first time in months, per CryptoQuant, and spot bitcoin ETF flows turned positive again in July and early August after a weak start to the year.

The skeptical case is just as real. Funding rates hit a 20-month high this week, meaning traders are paying more to stay long than they have in over a year. Sentiment swinging from Fear to Greed in 24 hours has a history of unwinding just as quickly, and analyst Benjamin Cowen has argued the cycle bottom could still be two months out.

"Forty-six to seventy-two in two days sounds like leverage and momentum, not real conviction," said Rick Cramer, Head of Analytics at SimpleSwap. "True conviction builds over weeks. This move happened before the slower data could even catch up, and moves that fast often unwind just as quickly."

Four numbers worth more than the candle

Funding rates hit a 20-month high this week. Elevated funding has preceded most of bitcoin's sharper pullbacks over the past two years, since it signals that the rally is increasingly running on borrowed money rather than fresh buyers. If that number cools while price holds, that's historically the healthier sign.

ETF flows turned positive again in July and stayed positive into August, after a rough first half of the year. One good week doesn't say much by itself. A run of them has historically told investors more than any single day's candle.

The largest wallets kept adding through the drawdown and haven't stopped through the bounce. That's a different kind of buying than retail chasing a green candle after the fact.

A Fear & Greed reading in the 70s this early in a move has historically been more of a caution flag than a confirmation. It leaves less room for the rally to surprise anyone, making it worth checking again next week regardless of where the price goes.

None of these four numbers will make the decision for you. They're a rough read on what people trading real size are watching, and they tend to beat whatever's trending on social media by Sunday.

The backdrop keeps moving too. The White House hosted a digital-asset summit this month; the SEC has floated a dedicated "Regulation Crypto Assets" framework, and GENIUS Act stablecoin rules are due by November.

Execution gets harder exactly when it matters most

Volatile markets don't just move the price. They widen spreads and turn manually routed trades into a guessing game between the price on screen and the price actually filled.

SimpleSwap, a self-custodial swap aggregator that never holds customer funds between transactions, routes every trade wallet-to-wallet and pulls live pricing from more than 20 liquidity providers across centralized and decentralized sources.

"Nobody really thinks about routing infrastructure when the market is calm. That is exactly when you do not need to," said Stefan Lauer, Head of Infrastructure at SimpleSwap. "A week like this is what puts it to the test. The system either finds the best price across dozens of sources in real time, or it does not."

Whether this rally has legs won't be clear for at least another week. What's already clear: it moved fast enough that anyone waiting for certainty probably missed most of it.

This article was written by SimpleSwap — a self-custodial multi-source swap aggregator. 2,800+ assets, 20+ liquidity providers across CEX and DEX sources, 20M+ swaps since 2018. Wallet-to-wallet by design, with routing handled under the hood.

The information in this article is not a piece of financial advice or any other advice of any kind. The reader should be aware of the risks involved in trading cryptocurrencies and make their own informed decisions. SimpleSwap is not responsible for any losses incurred due to such risks. SimpleSwap’s only official domain is simpleswap.io.

Crypto addresses are 42-character hexadecimal strings that are meaningless and hard to remember. That is why most interfaces truncate them: the first four characters, an ellipsis, and the last four. People read the ends; the middle is ignored.

Address poisoning is the discovery that this display convention is an attack surface.

Researchers at Carnegie Mellon documented 270 million poisoning attempts across Ethereum and BNB Chain between July 2022 and June 2024, aimed at 17 million unique wallets, with confirmed losses above $83 million. Their conclusion was blunt: this is quietly one of the largest phishing operations running on public blockchains.

How it works

Four steps, each individually harmless.

1. The attacker picks a target. Bots continuously monitor the chain for wallets with regular activity, especially those moving large stablecoin balances. Dormant wallets are not worth the gas.

2. They generate a lookalike. GPU-powered vanity address generators produce thousands of candidate addresses per second until one matches the target's first few and last few characters. In the December 2025 case, the fake matched the first three and last four hex characters, seven fixed positions in total. Truncated in any wallet interface, the two addresses are identical.

3. They plant it in your history. The attacker sends a tiny or zero-value transfer from the lookalike address to you. That dust does nothing except add the fake address to your transaction list, sitting among the addresses you actually use, looking exactly like one of them.

4. They wait. The next time you send funds and reach for your history rather than your address book, the trap either works or it does not. No further action is required from the attacker.

Nothing is hacked at any point. The resulting transaction is valid, signed by the rightful owner, and executed exactly as instructed. It simply goes to the wrong place, and no exchange or swap service can reverse it.

The case that should change how you send

On December 20, 2025, a trader lost 49,999,950 USDT, close to $50 million, to a poisoned address. The whole thing took under an hour, and the funds were converted to ETH, split across wallets, and partially routed through a mixer.

Read the sequence carefully, because it is the reason this article exists.

The victim did the thing everyone recommends. They first sent a 50 USDT test transaction to the correct address, and it arrived successfully. Watching the chain, the attacker then pushed a 0.005 USDT dust transfer from a lookalike address into the victim's history, landing it immediately after the successful test. Minutes later, the victim copied from that history for the real transfer, and 49,999,950 USDT went to the attacker.

The victim later offered a $1 million white-hat bounty for the return of the funds. It went unanswered.

So the standard advice is not wrong, but it is dangerously incomplete. A test transaction verifies the address. It does not protect the gap between the test and the real send, and that gap is precisely where the poison arrives.

In January 2026, the same pattern took 4,556 ETH, roughly $12.25 million, from another holder.

Why 2026 made this worse

The economics were always absurd. A May 2024 victim lost $68 million in wrapped Bitcoin to an attack that cost the scammer about $0.65 in gas.

But at scale, the dust transfers added up. Then Ethereum's Fusaka upgrade landed in December 2025, cutting fees by roughly six times. Good for users, it removed the last cost barrier to mass poisoning overnight.

The numbers changed fast. Poisoning attempts went from 628,000 in November 2025 to 3.4 million in January 2026, a 5.5x jump in two months. One attacker contract sent three million dust transfers to over a million addresses for a total cost of $5,175.

The prevention checklist

Ordered by how much each one actually does.

Never copy an address from transaction history. This is the whole attack. History is a log of what happened, not a list of addresses you trust. Treat it as read-only.

Keep a real address book. Save addresses you use repeatedly in your wallet's contacts or whitelist, entered once from a source you control. Then select from there every time. This removes the decision entirely, which is better than remembering to be careful.

Verify the middle, not just the ends. If you are checking manually, the first and last four characters are exactly what the attacker matched. Compare a run of characters from the center, or better, compare the full string.

Re-enter the address for the real transfer, not just the test. The $50 million case turned on this. If you send a test, go back to your trusted source for the main transaction rather than reusing anything from history.

Use ENS or a domain name where available. A human-readable name removes the character-matching problem at its root, though you should still confirm the name resolves to the address you expect.

Ignore unexpected dust. Small, unrequested transfers are not free money or a glitch. They are usually bait, and the correct response is to leave them alone and never interact with the sender.

Slow down on large transfers. The victims in these cases were not careless people. They were moving large sums using a workflow that is fine ninety-nine times and catastrophic once.

Where this meets your swap

This is the one attack on our map that lands squarely inside our own flow, and it would be dishonest to present it otherwise.

Every SimpleSwap exchange asks you for a receiving address. That is the moment address poisoning targets. We generate the deposit address you send to, but the address your converted funds arrive at is one you provide, and if it is poisoned, the transfer is valid, final and unrecoverable. No exchange can undo a correctly executed transaction to a wrong destination.

So the check belongs to you, and it is a short one: paste from your own wallet or address book rather than from any transaction list, then compare the middle of the string, not just the ends. If the swap is large, do it twice before confirming.

It is worth being just as attentive to the deposit address we show you. That address cannot be poisoned the way a receiving address in your history can, but a phishing page or a copy-paste slip can still hand you the wrong one. Copy it from the order page itself and paste it directly into your wallet. Anything that arrives via chat, email, or a search result is not from us, and our only official domain is simpleswap.io.

What comes next

Each entry above will get its own breakdown in "Know the Scam by SimpleSwap" over the coming months. Follow #KnowTheScam to catch every new one as it drops — phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.

FAQ

What is address poisoning? A crypto scam in which an attacker sends you a tiny transfer from an address engineered to look like one you use, so that the lookalike sits in your transaction history. If you later copy the recipient address from that history instead of a trusted source, your funds go to the attacker.

Why did I receive a tiny amount of crypto I did not expect? Most often, this is poisoning bait, which places a lookalike address in your history. It can also be used for wallet-clustering analysis. In either case, do not interact with it and never copy that address.

Does sending a test transaction protect me? Only partially, and the largest recorded case proves the limit. The victim's test went to the correct address, after which the attacker poisoned the history in the minutes that followed. Send the test if you like, but re-enter the address from your trusted source for the real transfer.

Can poisoned funds be recovered? Effectively never. The transaction is valid and correctly signed, so there is nothing technically wrong for anyone to reverse. In the $50 million case, even a $1 million bounty produced nothing.

Is checking the first and last four characters enough? No. Those are the exact positions attackers match. In the December 2025 case, the fake shared the first three and last four characters with the real address.

Is SimpleSwap safe from address poisoning? No exchange can be, and that is worth stating plainly rather than reassuringly. Every swap asks you for a receiving address, and if the address you paste has been poisoned, the transfer is valid and final. Nothing on our side can detect that the destination is not the one you meant. What we can do is tell you where the risk sits: paste from your own wallet or address book rather than any transaction history, and verify the middle of the string before confirming. Our only official domain is simpleswap.io, and the deposit address should always be copied directly from the order page.

Is SimpleSwap a scam? No. SimpleSwap has operated since 2018 as a self-custodial swap aggregator, moving funds between wallets you control without holding a balance in between. Two unrelated things push that phrase into search results.

The first is brand impersonation: cloned sites and fake support accounts that borrow a recognizable name in order to phish people. Our only official domain is simpleswap.io; we never message you first, and nobody at SimpleSwap will ever ask for your seed phrase.

This article is for educational purposes only and is not financial or security advice. SimpleSwap's only official domain is simpleswap.io.

On August 13, Trezor told roughly 14,000 customers their personal details had been exposed. Not through Trezor, but through ShipMonk, the logistics provider that packs and ships its hardware.

The company was precise about what did not happen. Its systems were not compromised. The devices are secure. No seed phrase, no key, no firmware. 11,742 customers had full exposure of name, email, phone number, and shipping address, with 1,947 partially exposed.

By the usual measure, minor. No funds moved; nothing was hacked.

That reading is the mistake, and it is what this piece is about.

One data point is nothing. The combination is everything.

The standard reaction to breach news is a shrug. My email and phone number have been out there for years. And taken alone, that is correct: a phone number decides nothing, a name decides nothing, a city decides nothing.

Value appears when fields are joined.

Your phone number, your name, the fact that you bought a hardware wallet six weeks ago, and the street it shipped to are not four harmless facts. It is a qualified list of confirmed crypto holders, sorted by purchase recency, and it preemptively removes every friction point that normally causes an impersonation attempt to fail.

Trezor’s own warning named three channels: email, phone, and post. The third one matters because physical mail becomes possible when addresses are leaked, and it carries the authority that an email lost a decade ago.

Three leaks in crypto, three different failures

Trezor, August 2026: the vendor. The breach happened at a logistics partner, not at the company whose name is on the box. Trezor’s ninety-day retention limit with that partner measurably reduced the blast radius, which is a real argument for buying from companies that keep less.

Ledger, 2020, and again in January 2026: the long tail. The 2020 breach exposed data on more than 270,000 customers, which was published on a hacking forum. Six years later, customers still report calls and printed letters from fraudsters impersonating the company. Some arrived with counterfeit hardware wallets mailed to the victim’s home, pre-loaded to compromise anyone who set one up. Then, in January 2026, another notification was received following unauthorized access to a third-party e-commerce provider. Leaked data does not expire; it gets resold and recombined.

The 149-million dump, January 2026: no company at all. A researcher found an unsecured database of roughly 149 million stolen credentials, about 96GB in size, sitting openly online, including around 420,000 Binance login records, 48 million Gmail accounts, and 17 million Facebook accounts. Binance was not breached. Neither was Google. The credentials came off infected user devices, harvested one at a time by infostealer malware that read saved browser passwords, session cookies, autofill data, and wallet extension files.

That third case is the category shift worth internalizing. Attacking a company is expensive and gets noticed. Infecting a hundred thousand people through fake game mods, cracked software, and malicious browser extensions is cheap and goes unnoticed by anyone. One infected machine exposes every account it logs into, which is why these dumps mix email, banking, and exchange credentials in one file. And stolen session cookies bypass two-factor authentication outright because a session token represents a login that has already occurred.

What your data is actually used for

Fraud. Personalized datasets make phishing nearly frictionless. The sender knows your name, your city, and your recent purchase, so the message reads as routine.

Stalking and harassment. Photos, social profiles, contacts, and locations are already in circulation. The work is knowing where to look.

AI profiling. Services now compile reputation portraits from public and leaked material, scoring whether a person is reliable or risky and selling the conclusion as analytics. Whitebridge AI is one example of the category. You may not know such a profile exists, and there is little practical way to correct it.

So a leak today means more than lost privacy. Systems are forming opinions about you from this material, and that process is largely outside your reach.

The part that is no longer only digital

CertiK recorded around 52 physical attacks on crypto holders worldwide in the first half of 2026, up 33% year-over-year. Chainalysis reported that more than $30 million was stolen in violent attacks over the same period, on pace to exceed 2025’s full-year total of $58 million.

A shipping address tied to a hardware wallet purchase links crypto ownership to a physical location. This year, a French couple was reportedly targeted in three home invasions within a month after moving into a house once owned by crypto millionaires whose address had leaked. They held nothing. The address was the target.

What to do

Assume the data is out. You cannot un-leak an address. You can change what an accurate detail is worth.

Treat product knowledge as worthless proof of identity. Someone knowing your wallet model, purchase date, and street proves they read a database, not that they work anywhere.

Never act on inbound contact. Not email, phone, post, or a QR code in a letter. Go to the company via a bookmark you saved. This one habit defeats every scenario above.

No legitimate company will ever ask for your recovery phrase. After the Ledger breach, attackers used the stolen data to specifically target 24-word seed phrases. That request is the tell, no matter how much the sender knows about you.

Distrust unsolicited hardware absolutely. A wallet arriving that you did not order is an attack, not a gift or a warranty replacement.

Clean the device before changing passwords. If an infostealer is still resident, your new credentials leak the same day. Scan first, then rotate, starting with email.

Stop storing passwords in the browser. Browser stores and autofill are the first things infostealers read. A password manager plus app-based or hardware-key two-factor authentication removes most of the value of a stolen credential.

Use dedicated details for crypto purchases. A separate email and a parcel locker or work address rather than home. It limits what any future leak can connect to.

Why are we publishing this

Know the Scam is our educational project, and this entry sits slightly outside the usual pattern because there is no clever attack to dissect here. Nothing about a logistics breach is technically interesting.

What is worth your attention is the pipeline. Nearly every crypto scam we have written up relies on credibility, and leaked data is how that credibility is bought. Fake support needs to know your device. Phishing needs your name. Fake giveaways need to reach holders, not the general public. Recovery scams need a list of people who have already lost money once.

Our aim with it is narrower than general security advice. It is to ensure that the next message arriving with your correct name and address is read as evidence that data leaked somewhere, rather than as proof that the sender is who they claim to be. That single reflex is what most of these schemes cannot survive.

This article is for educational purposes only and is not financial or security advice. SimpleSwap’s only official domain is simpleswap.io.

Start with an honest admission, because this entry sits slightly awkwardly in a series about fraud.

A sandwich attack is not a crypto scam in the way phishing is. Nobody deceives you, nobody obtains your seed phrase, and no contract is exploited. A bot notices what you are about to do and arranges to be standing in front of you when you do it. Everything it does is a valid transaction that anyone is permitted to make.

It is closer to a tax than a theft. But it is a tax you pay without being told; it is paid to a private party, and a genuine scam industry is built directly on top of it. So it belongs here.

The mechanic, step by step

On a public blockchain, transactions are not private the moment you sign them. They sit in the mempool, a waiting room of pending transactions visible to anyone running a node, until a block producer includes them. Bots read that room continuously.

Say you swap $50,000 of ETH for USDC on a DEX. Here is what happens in the seconds that follow.

Step 1. The bot sees your order before it executes. Your transaction is public while pending, and it contains everything a bot needs: the pool you are trading against, your size, and your slippage tolerance.

Step 2. It calculates how your trade will affect the price. In an automated market maker, price is a function of the pool’s reserves, so a large buy predictably increases the price. The bot knows exactly how much, because the formula is public.

Step 3. It front-runs you. The bot submits its own buy of the same asset, paying a higher fee so it lands before yours in the block. This pushes the price up before your trade executes.

Step 4. Your trade was executed at the worst possible price. You still receive tokens, and your wallet reports success, so nothing looks wrong. You got less than you would have had thirty seconds earlier.

Step 5. It backruns you. Immediately after, in the same block, the bot sells what it just bought at the price your own trade created. The difference is its profit, and it came out of your output.

Your transaction sat in the middle. Hence the name.

Two details make this hard to notice. The whole thing resolves inside one block, so there is no window in which anything appears wrong. And you do not have a counterfactual: you cannot see the price you would have received, only the one you got.

The damage also scales with your size, because the bigger your trade, the more it moves the pool and the more there is to extract. On a $200 swap, it is invisible. On a $200,000 swap, it is real money.

The numbers

Cointelegraph Research, using an EigenPhi dataset, analyzed more than 95,000 sandwich attacks on Ethereum between November 2024 and October 2025 and estimated annual trader losses at around $60 million. Cumulative extraction on Ethereum has been estimated at roughly $410 million.

Four findings are worth pausing on, and the first one runs counter to the alarmist version of this story.

The trend is downward. Monthly extraction fell from nearly $10 million in late 2024 to about $2.5 million by October 2025, even as monthly DEX volume climbed past $100 billion. Researchers attribute part of that decline to traders adopting MEV protection, a rare case of a defensive tool visibly working.

Frequency did not fall with it. Attacks held steady at 60,000 to 90,000 a month. What dropped was the take per attack, which now averages about $3. This is a volume business, not a series of spectacular hits.

Almost 40% of attacks targeted low-volatility pools, meaning stablecoins, wrapped assets, and liquid staking tokens, with about 12% hitting stable swaps specifically. The intuition that “I am only swapping USDC; there is no price risk” does not protect you, because the bot is not exploiting volatility. It is explained by the slippage tolerance you set casually because the pair felt safe.

It is remarkably concentrated. Roughly 70% of all attacks during that period trace back to a single operator.

Solana runs the same play at different scales, though the two headline numbers below are separate snapshots, not a single total. Over a 30-day stretch (Dec 7–Jan 5), a single bot, DeezNode’s Vpe program, executed 1.55 million sandwich transactions for a profit of 65,880 SOL, about $13.43 million, per Helius/Jito data — with an average profit per attack of about $8.67. That is one operator, not the network. A separate 30-day snapshot found 77,188 sandwich attacks against 49,247 victims, perpetrated by 203 individual attackers, with each attacker having more than 10,752.

The scam that grew on top

Here is where this becomes a proper Know the Scam entry.

Because “MEV bot” sounds technical and profitable, an entire category of fraud now uses the term as bait. The pitch arrives via DM or YouTube tutorial: deploy this MEV bot contract, fund it, and watch it earn passive income from front-running trades. You are walked through the pain of going to Remix and deploying it yourself, which makes you feel in control.

The contract does one thing. It forwards your funds to the author. One documented operation collected roughly 156 ETH, around $411,000, from retail victims.

The tell is simple and worth memorizing: real MEV infrastructure is boring, open source, and fiercely competitive. It is a business of milliseconds and infrastructure costs, run by people who do not need your capital and would not share the edge if they did. Anything flashy and confident that invites you to fund a contract is the scam version.

What actually reduces exposure

Ranked roughly by how much they help.

Use a private transaction relay for DEX trades. Services such as Flashbots Protect route your transaction to block builders without it passing through the public mempool, so searchers cannot see it in flight. Flashbots Protect has served 2.1 million Ethereum accounts and shielded around $43 billion in DEX volume as of late 2024, and Polygon launched its own private mempool in April 2026.

The honest caveat: private is not airtight. Academic work has documented sandwich attacks executed through private channels, and benchmarks have found that execution quality varies meaningfully between providers. Treat “MEV protected” as a claim to check rather than a guarantee.

Prefer intent-based or batch-auction venues for same-chain trades. CoW Swap and similar designs settle orders in batches at a uniform price rather than in a sequenced queue, which removes the ordering advantage the attack depends on.

Set slippage tolerance deliberately. Your slippage setting is the ceiling on how much a sandwich can take. A 5 on a large trade is an invitation. Tighten it, accept that some transactions will fail, and treat those failures as evidence that the protection is working.

Split large orders. Sandwich profit scales with how much your trade moves the pool. Several smaller trades across venues move each pool less, so there is less to extract.

Trade deeper pools. The same order in a deeper pool results in less price movement by default and yields less profit for a bot.

Where this meets your swap

Worth being precise here rather than claiming immunity.

Sandwiching requires two things: a trade whose intent is visible before it executes, and a price that your own order moves. A standard SimpleSwap exchange gives an attacker neither in the usual form. You are not broadcasting a signed DEX trade with your slippage tolerance attached. You send an ordinary transfer from your wallet to a deposit address e to exploit, and execution occurs on the provider’s side afterward.

Beyond that, routing itself changes the arithmetic. Where liquidity is sourced from centralized venues, there is no public mempool involved. Where a route splits a large order across several sources, each portion moves any individual pool less than the whole order would have, which is the same mechanism that keeps price impact contained and happens afterward, what a bot could extract.

The limits, plainly: this is a structural property of the flow rather than a security guarantee; DEX liquidity remains part of the wider market, and none of it protects trades you make directly on a DEX. Those need the tools in the section above.

What comes next

Each entry above will get its own breakdown in “Know the Scam by SimpleSwap” over the coming months. Follow #KnowTheScam to catch every new one as it drops — phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.

FAQ

What is a sandwich attack in crypto? A bot spots your pending DEX trade in the public mempool, buys the same asset just before you to push the price up, lets your trade execute at that worse price, then sells immediately after. Its profit is calculated from what you received.

Is MEV illegal or a scam? Sandwiching is not fraud in the legal sense. Every transaction involved is valid and permitted. It is extraction rather than theft, which is why it persists and why the defense is technical rather than legal. What is a scam is the “MEV bot” industry, which sells contracts promising passive front-running income and takes your deposit.

Is sandwiching getting worse? By the measured numbers, no. Extraction on Ethereum fell from about $10 million a month in late 2024 to roughly $2.5 million by October 2025, even as DEX volumes grew, and researchers credit part of that to the adoption of protection tools. Attack frequency stayed high, though, so the risk to any individual trade has not disappeared.

How do I know if I have been sandwiched? Usually, you do not, which is the core problem. Your transaction succeeded normally. Block explorers such as EigenPhi let you inspect a transaction and see whether it was bracketed by trades from the same address in the same block.

Does slippage tolerance protect me? It caps your maximum loss rather than preventing the attack. A sandwich cannot take more than your slippage setting allows, so a wide default is what makes a large trade worth attacking.

Are stablecoin swaps safe from this? No. Nearly 40% of measured attacks targeted low-volatility pools. The attack exploits transaction ordering, not price volatility.

Is SimpleSwap safe from sandwich attacks? A standard SimpleSwap exchange does not broadcast a signed DEX trade with your slippage tolerance attached, which is the thing bots hunt for in the public mempool. You send an ordinary transfer to a deposit address, and routing occurs on the provider’s side afterward, partly through centralized liquidity, where no public mempool exists. That is a structural property of the flow, not a security guarantee, and it does nothing for trades you make directly on a DEX. Our only official domain is simpleswap.io.

Is SimpleSwap a scam? No. SimpleSwap has operated since 2018 as a self-custodial swap aggregator, moving funds between wallets you control without holding a balance in between. Two unrelated things push that phrase into search results.

The first is brand impersonation: cloned sites and fake support accounts that borrow a recognizable name in order to phish people. Our only official domain is simpleswap.io; we never message you first, and nobody at SimpleSwap will ever ask for your seed phrase.

This article is for educational purposes only and is not financial or security advice. SimpleSwap’s only official domain is simpleswap.io.

The group calls itself Open Standard, and the token is Open USD, ticker OUSD. Visa, Mastercard, Stripe, Coinbase, BlackRock, and BNY are all in it. The coin has not shipped yet, with native issuance on Solana planned for later this year.

Seven years earlier, several of those names were running the other way. Regulators in the US and Europe called Facebook’s Libra a threat to financial stability in 2019, and Visa and Mastercard walked out of the Libra Association that October. Stripe and eBay left the same week, PayPal a few days earlier. What remained was sold to Silvergate Capital in January 2022 for $182 million, and the token never launched publicly.

What flipped in between is legal, not technical. The GENIUS Act was signed into law in the US on July 18, 2025, giving payment stablecoins a federal definition and establishing rules for issuing them. Those rules take effect in January 2027, though nobody waited. Any bank with federal deposit insurance now has a legal path to minting dollar tokens through a subsidiary. MiCA opened the same door in Europe.

The response was not subtle:

• 90% of financial institutions have taken action in the segment, from planning through live deployments (OpenFX, 2026)

• 3,473 companies now sit somewhere in the stablecoin value chain, per a July 2026 market map

• ~$313 billion total market cap as of June 30, 2026, close to double the figure from two years earlier (DeFiLlama)

• Roughly half the banks surveyed by the Fed named digital assets a priority for the next three years
  

The issuer list left crypto behind a while ago: PayPal (PYUSD), Ripple (RLUSD), MoneyGram (MGUSD), Western Union (USDPT), SoFi (SoFiUSD), JPMorgan (JPMD), Societe Generale (CoinVertible), Deutsche Bank through the AllUnity consortium (EURAU, CHFAU, SEKAU). Japan’s three largest banks agreed to issue a joint token by March 2027.

Which raises a question unrelated to any of these companies. If a hundred different dollars end up in circulation, what happens to the one already sitting in your wallet?

“The first decade of crypto asked who holds the dollar. This one asks whose dollar you’re holding. Issuing another one is easy now. Connecting the ones already out there is the harder problem, and it’s the one users run into every day.”

Stefan Lauer, Head of Infrastructure, SimpleSwap

The law opened the door. What walked through it is a set of incentives worth naming.

Reason one: the yield sitting on reserves

The mechanics are plain. An issuer accepts dollars and mints tokens in exchange. That incoming liquidity goes into short-term US Treasuries paying 4% to 5% a year. You get the right to redeem one for one. The issuer keeps the yield.

Tether reported $6.2 billion in net profit for 2023. The figure passed $13 billion in 2024 and was held above $10 billion in 2025.

You don’t need your own token to earn from this. Coinbase booked $305 million in stablecoin revenue in Q1 2026, up from $274 million a year earlier. That line sits inside a subscription and services segment worth 44% of net revenue. The exchange issues nothing of its own. It splits reserve income with Circle under a revenue-share agreement, then pays holders loyalty rewards for parking USDC.

For any company with real payment volume, the math writes itself. Look at the margin going to Tether or Circle, then decide to keep it.

Reason two: owning the rails

Reserve yield explains part of the story. Open Standard stripped mint and redemption fees from the OUSD design entirely and promised to hand most of the reserve income to ecosystem partners. Profit is secondary there. Control over settlement rails is the point.

The same logic applies to companies with no plans to issue anything. On July 9, Hyundai Card moved $20,000 between Hyundai Motor units from the US to Mexico using USDT on Avalanche. The round trip took about seven minutes instead of the three to four hours a correspondent banking route needs. No proprietary token was involved. Working infrastructure was.

Reason three: not living on someone else’s decisions

The third motive gets less airtime. Your own token cuts exposure to another issuer’s freeze decisions and to political pressure aimed at a monopoly. When one issuer serves everybody, its problem becomes everybody’s problem.

What does this cost you?

Here’s where it lands on users. Dozens of tokens, with no shared standard. Fiserv and PayPal announced plans to make FIUSD and PYUSD interoperable back in June 2025, and that pairing is still the headline example. Everything else stays technically and legally separate.

There’s a historical rhyme worth knowing. During the free banking era in the US (1837 to 1863), hundreds of private banks issued their own notes, and each note traded at a discount based on distance from the issuer and trust in its name. The era ended with a single standard imposed by the state.

Until something similar shows up, the work sits with you. Payment arrives in one token while your counterparty accepts another. Neither one lives on the network you actually use.

Swapping is where that gap gets closed. On SimpleSwap you can buy a stablecoin with fiat through partner providers (Mercuryo, Simplex, Guardarian), then swap it for another asset wallet-to-wallet. Underneath, the SimpleSwap exchange aggregates liquidity from 20+ CEX and DEX providers across 2,800+ assets and 3.2M+ trading pairs, with route selection handled in the background.

Your funds don’t sit on the platform between swaps. They leave a wallet you own and arrive at a wallet you own. All costs are included in the quoted rate, so SimpleSwap fees appear before you confirm, not after. Fiat purchases can trigger verification by the payment provider, which is the provider’s requirement rather than a step added by the service. SimpleSwap has been running since 2018, with 10M+ people using it since then.

Where this goes

The market is splitting due to a fight over payment infrastructure, not excess liquidity. Some tokens will stay as settlement tools inside a single ecosystem. Plenty of others will disappear quietly once the novelty wears off.

The on-chain dollar count keeps climbing either way. The question that stays constant is how fast you can move value from one of them into another.

This article was written by SimpleSwap — a self-custodial multi-source swap aggregator. 2,800+ assets, 20+ liquidity providers across CEX and DEX sources, 20M+ swaps since 2018. Wallet-to-wallet by design, with routing handled under the hood.

The information in this article is not a piece of financial advice or any other advice of any kind. The reader should be aware of the risks involved in trading cryptocurrencies and make their own informed decisions. SimpleSwap is not responsible for any losses incurred due to such risks. SimpleSwap’s only official domain is simpleswap.io.

Quick Take

If you need to swap crypto between your own wallets without opening an exchange account or learning a trading terminal, SimpleSwap does exactly that. The product has been on the market since 2018 and has stayed online through every market cycle since.

Who it’s for: self-custody users who want predictable wallet-to-wallet swaps with access to 2,800+ assets through aggregated CEX and DEX liquidity.

Who it’s not for: high-frequency day traders looking for an exchange-style trading terminal with order books and tight maker/taker fees.

How to Use SimpleSwap. Step by Step

The whole flow takes less time than reading this simpleswap.io review.

1. Choose the pair and see the estimated rate calculated from live liquidity.

2. Pick the rate type: fixed locks the price for 20 minutes, floating follows the market at execution.

3. Enter the receiving wallet address and confirm the network.

4. Send crypto to the unique deposit address generated for your order.

5. After network confirmations, the aggregator routes the conversion through the optimal provider and delivers the result to your wallet.

From the user’s perspective, it feels like a regular wallet transfer. Under the hood, SimpleSwap coordinates confirmations and routing across the whole liquidity network.

What It Costs

SimpleSwap bundles all costs into the rate you see before confirming, so the quoted amount reflects what you are expected to receive. The fee starts from 0.2% and may vary depending on currency pairs, liquidity, market conditions, and loyalty level. The service margin and routing costs are built into the same number.

Blockchain network fees apply separately and go to the network itself rather than to SimpleSwap:

Fixed rates carry a slightly wider spread than floating ones, and that difference buys a 20-minute price guarantee. High-frequency traders hunting 0.05% edges will find tighter pricing on terminal-grade venues. Users who value self-custody and predictable output get exactly what the quote shows.

Is SimpleSwap Legit?

Yes, and the answer rests on record rather than reassurance. SimpleSwap Ltd has run the product since 2018 and has stayed online through every cycle since, processing 20M+ swaps for 10M+ users with 99.9% uptime. The swap engine sits inside 6,000+ partner products, among them Exodus (NYSE-listed), CakeWallet, Ellipal, Tonkeeper, and Tangem, each of which conducted its own due diligence before integrating an outside service into its wallet.

The legal documentation is public, not implied: Terms of Service, Privacy Policy, Affiliate Terms, and the Anti-Financial Crime and KYC Policy all sit on the site.

SimpleSwap Trustpilot Reviews

Trustpilot is the most active page for SimpleSwap reviews, with a company profile maintained since 2018. As of mid-2026, the service holds a 4.1 TrustScore with a Great label, based on 2,500+ reviews, and 80% of the reviews left over the last 12 months are five-star. The company replies to 100% of negative reviews, typically within a day, as verified on the page.

Aggregators keep their own cards too: on Cryptoradar, simpleswap.io holds a 4.6 out of 5 user rating, with the verification experience scored at 4.7.

Is SimpleSwap Safe?

Safety here comes from architecture rather than from a trust badge. SimpleSwap holds no long-term user balances. Crypto transfers from one wallet you own to another, with the conversion itself routed through aggregated liquidity in a single time-bounded transaction.

This model removes two classic failure points:

• There is no platform balance, so an exchange-style hack or insolvency cannot touch your funds.

• Trust is limited to a single transaction instead of an ongoing custodial relationship.

Self-custody also means shared responsibility. Four things stay on your side:

• Double-check the receiving address, because confirmed blockchain transactions cannot be reversed.

• Select the correct network for the asset, since tokens sent to the wrong chain are usually lost.

• Protect your seed phrase; SimpleSwap never asks for private keys.

• Make sure you are on simpleswap.io before sending anything, since there are clone sites.

Is SimpleSwap safe for swapping Bitcoin and Ethereum? Yes, and these are the deepest routes in the system. BTC and ETH pairs get the tightest spreads across aggregated liquidity, while the fixed rate can lock your price for 20 minutes during network confirmation. For most floating swaps, estimate accuracy reaches 99.998%.

What “SimpleSwap Scam” Complaints Usually Mean

Any service that processes millions of transactions will collect both positive and mixed feedback. Most SimpleSwap users complete their swaps without friction, and public review data reflects that: Trustpilot remains the most active review page for the brand, with the majority of recent reviews rating the service positively. SimpleSwap Reddit threads that surface for is simpleswap legit reddit read much the same way.

The difficult cases are different. They are rarer, more emotional, and much more likely to turn into public complaints, especially if funds are delayed, a rate changes, the wrong network is used, or a compliance check is triggered. In SimpleSwap reviews, these complaints usually cluster around four scenarios.

Clone sites

The official domain is simpleswap.io. Phishing copies on lookalike domains can take deposits and vanish, and the resulting anger often ends up in SimpleSwap scam threads, even though a different operator took the money. Bookmark the real address before your first swap.

Floating-rate expectations

A floating rate settles at execution, so the final amount may differ from the initial estimate if the market moves between quote, deposit, confirmation, and execution. That is market mechanics rather than a SimpleSwap scam, and the fixed rate exists exactly for this case.

Wrong-network transfers

Sending an asset on an unsupported chain can lead to losses no service can reverse. The interface shows the required network, yet the final check still happens on the user’s side.

Verification holds

A small share of transactions gets paused for compliance screening. This scenario produces the most emotional SimpleSwap reviews, so it gets a full section below.

What Happens If a Swap Is Held for a Check

Most swaps do not reach this stage, but when a hold happens, the user should understand why it happens and what is needed to move the case forward.

Why holds happen

A swap may be temporarily paused if information available during transaction screening requires additional review to meet legal or compliance obligations. This means there are grounds for a closer look, not that the user is being accused of wrongdoing.

Additional compliance review does not automatically mean that the sender was directly involved in anything illegal. In crypto, funds can sometimes be affected by previous or third-party transactions without the current sender knowing about it.

Specific screening criteria cannot be disclosed publicly because of legal, compliance, and privacy requirements. Disclosing how these checks work could also make it easier to bypass the screening process. This includes internal compliance methodologies, information sources, information relating to third parties or competent authorities, and details of ongoing reviews.

Why SimpleSwap Does Not Benefit from Delays

Keeping cases unresolved is not in SimpleSwap’s interest. SimpleSwap has been operating for years and values its reputation. The goal is to complete the exchange, return the funds, or resolve the case in line with the required procedure.

Why additional information may be requested

Additional information is requested to verify the source of funds, clarify the transaction context, and complete the required compliance review.

Repeated document requests are not a tactic to delay the process. They usually mean that the information already provided does not yet answer the specific compliance question in the required scope, format, quality, or level of detail.

Timelines, honestly

When a case involves third parties or competent authorities, the timeline may depend on their review or response time. A firm ETA is not always possible, but support should provide updates and, where possible, an ETA based on the confirmed review status.

Support

Every transaction gets a unique order ID with real-time tracking from deposit to delivery. Most cases resolve automatically, and when a human is needed, the 4-minute average response means you are not watching the market move from inside a queue. Centralized exchanges reviewing held funds can keep users waiting for weeks, which makes this speed a practical advantage rather than a vanity metric.

FAQ

Is SimpleSwap legit? Yes, the service has run since 2018 and has processed 20M+ swaps. Its engine also powers swap features inside 6,000+ partner products, including Exodus and Tangem.

Is SimpleSwap safe? The self-custodial model keeps funds off the service, so there is no long-term balance to lose. Users remain responsible for address accuracy and network selection.

Is simpleswap.io legit, and how do I spot fakes? simpleswap.io is the only official domain, and queries like is simpleswap io legit or is simpleswap.io safe point to the same product. Treat look-alike addresses as phishing and report them to support.

Is Simple Swap legit, is Simple Swap safe, or is that a different service? Simple Swap written with a space is the same simpleswap.io product, so all Simple Swap reviews and simple swap io review describe one service.

Is SimpleSwap safe for swapping Bitcoin and Ethereum? Yes, BTC and ETH routes have the deepest liquidity in the system, and the fixed rate removes price uncertainty during confirmation.

Does SimpleSwap require KYC? Most crypto-to-crypto swaps need no account. KYC covers fiat purchases through payment partners and the optional one-time verification at registration. Verification helps move the review forward, but additional information may still be required

What should I do if my swap was stopped for a check? Contact the live chat with your exchange ID and provide the requested information. Support shares updates and, where possible, an ETA based on confirmed review status

Why do some SimpleSwap reviews mention a scam? SimpleSwap has been on the market since 2018, and most public reviews describe completed swaps, fast support, and a broad asset range. Still, occasional scam-related mentions can appear around two stressful scenarios: phishing clones that imitate simpleswap.io, and delayed transactions under compliance review. The only official domain is simpleswap.io, so users should always check the URL before sending funds.

When a swap is temporarily paused for AML/KYC checks, external provider review, or a competent authority request, users may worry because not all case details can be discussed publicly. A hold does not automatically mean wrongdoing; it means the transaction context and source of funds must be verified before the case can move forward. Providing the requested information through the official support channel helps the review move faster.

What are the fees? Everything is bundled into the quoted rate, so the number you see before confirming is the number that arrives. Network fees go to the blockchain itself.

How long does a swap take? Fast networks like Solana complete in under a minute, while Bitcoin and Ethereum usually take 10–30 minutes depending on congestion.

Is there a minimum amount? For the most liquid pairs, the minimum can start from around $1–2, with variation depending on currency, liquidity, and market conditions.

Verdict

This SimpleSwap review comes down to a simple conclusion: the service is legit, and its architecture makes it safe by design. The loudest scam accusations dissolve on contact with documented facts, from the 2018 track record to the partner list.

If you hold crypto in your own wallets and want swaps that behave predictably, SimpleSwap in 2026 does the job it advertises. If you need order books and margin tools, look at terminal-grade venues instead.

SimpleSwap is a self-custodial multi-source swap aggregator that helps users exchange crypto with more privacy and control, without having to compare providers and routes themselves. It supports direct wallet-to-wallet swaps across 20+ liquidity providers and 2,800+ assets, combining liquidity from well-known CEX and DEX sources under the hood. SimpleSwap’s only official domain is simpleswap.io.

You can lose every token in a wallet without ever revealing your seed phrase, without your private key leaving your device, and without anyone breaking a single piece of cryptography.

You approve it. That is the entire attack.

Wallet drainers took $83.85 million from 106,106 victims in 2025 alone, and among incidents exceeding $1 million, 38% involved Permit-style approvals. The mechanism is not exotic. It is a standard, legitimate feature of how tokens work, pointed at the wrong contract.

What an approval actually is

ERC-20 tokens do not move the way ETH does. A contract cannot simply take your USDC; you have to permit it first, and that permission is called an approval or allowance.

The flow has two steps:

1. You call approve(), naming a spender contract and an amount. This does not move anything. It writes a permission into the token contract: this address may move up to X of my tokens.

2. The spender calls transferFrom(), pulling tokens up to that limit, whenever it likes, with no further confirmation from you.

Step two is the part people miss. The approval is not a one-time consent for the swap you were doing. It is a standing authorization that persists until you actively remove it.

Why “unlimited” is the default, and why that matters

Most applications request an unlimited allowance, because it means the user approves once instead of before every single interaction. It is a genuine usability decision, not a trick.

But it creates asymmetric risk. A contract with an unlimited allowance on your USDC can move your entire USDC balance, now or in two years, whether or not you ever use that application again. If the contract turns out to be malicious, or if a legitimate one is later compromised, the permission you granted for a $50 trade covers everything you hold in that token.

And these permissions accumulate silently. Anyone who has used DEXs for a couple of years is carrying a list of live allowances they have entirely forgotten about.

The dangerous evolution: approvals that arrive as signatures

Here is the part that makes current attacks so effective, and it is where the “just read the transaction carefully” advice quietly breaks.

Newer standards, EIP-2612 permit and Uniswap’s Permit2, let you authorize a spender by signing an off-chain message instead of sending an on-chain transaction. No gas, no confirmation screen showing a token contract, no pending transaction. Your wallet shows what appears to be an ordinary “sign this message” request.

That is a real difference in how it looks to you. A traditional approval is a transaction, and wallets display transactions prominently, with the contract being approved and often the amount. A Permit signature is typed data, and wallets have historically presented it as a wall of fields or as a benign-sounding prompt to “verify your wallet” or “sign in.”

Then the attacker calls transferFrom(). Your tokens leave. The only thing you did was sign something.

This produces a counterintuitive tradeoff worth understanding, because most guides get it exactly backward:

• Permit2 is safer against stale approvals. Instead of dozens of forgotten unlimited allowances scattered across contracts, you approve one universal contract per token, and everything after that is a bounded signature with a deadline.

• Traditional approvals are safer against signature phishing, precisely because they require a transaction your wallet makes a fuss about.

Neither is better. The risk moved rather than disappeared.

The industry behind it

None of this is artisanal. Drainer kits are rented as a service, with the developer maintaining the malicious contracts and laundering pipeline while affiliates run the phishing and keep 75% to 95% of what they steal. That is why the same trick appears on hundreds of unrelated sites at once, and why the average victim lost $790: this is a volume business, engineered for scale rather than for whales.

How to audit and revoke, concretely

This takes about ten minutes and is the single highest-value piece of wallet hygiene most people have never done.

1. Open a revocation tool. Revoke.cash is the most widely used free and open-source platform, covering 100+ EVM networks. Etherscan’s token approval checker and MetaMask Portfolio do the same job. Type the address by hand or use a bookmark: phishing clones of revocation tools exist, which is a special kind of irony worth avoiding.

2. Review in read-only mode first. You can paste your public address without connecting a wallet. Sort from newest to oldest. If you suspect you recently signed something you should not have, do so.

3. Look for two things. Any allowance marked unlimited, and any contract you no longer recognize or use. Both are candidates for removal.

4. Revoke. This is an on-chain transaction and costs gas. As of March 2026, Etherscan supports batch revocation for EIP-7702 wallets, which substantially reduces the cost of clearing many approvals at once.

5. Check every chain you have touched. An approval on a network you used twice in 2023 is still live. Attackers deliberately route victims to less-monitored chains for exactly this reason.

6. Repeat quarterly. Treat it like changing a password. Approvals accumulate whether or not you are paying attention.

On Solana, the equivalent concept is a delegated token account, and Revoke.cash’s Solana mode or Sol Incinerator will show and clear them.

Three traps in the fine print

Disconnecting is not revoking. Removing a site from your wallet’s connected list stops it reading your address. It does nothing to the allowance, which lives in the token contract and remains active.

Revoking does not reverse anything. It removes future permission only. If a drainer already pulled your tokens, revoking prevents further loss but recovers nothing, because no one can undo a confirmed on-chain transfer.

Approving exact amounts is better where offered. Some interfaces let you set a custom allowance instead of an unlimited one. It costs an extra approval later. It also caps your maximum loss at the amount you actually intended to spend.

If you think you have already signed something

Move fast, in this order: revoke all approvals on the affected wallet, then transfer remaining assets to a completely fresh wallet that has never connected to any site, then stop using the compromised one. Preserve transaction IDs and screenshots, and report to your local cybercrime authority.

And treat anyone offering guaranteed fund recovery for an upfront fee as the follow-up scam, because that is reliably what it is.

Is SimpleSwap safe from this? Where our flow sits

A fair question to ask of any service, so here is the structural answer rather than a reassurance.

Approval phishing requires a wallet connection and a signature. A standard SimpleSwap exchange requires neither. You choose a pair, enter a receiving address, and then send funds from your wallet to a deposit address. There is no approve() call and no Permit signature, so no allowance is granted over your balance. So a standard swap adds nothing to your approval surface, and no allowance you hold is related to us.

That is a genuine structural property rather than a security promise, and the limits deserve to be said plainly. Any allowances you are carrying came from DEXs and dApps and will still be there after any number of swaps. And a swap that has confirmed on-chain cannot be reversed by us or anyone else, which is why the checks on this page belong before you sign, not after.

If a page claiming to be SimpleSwap asks you to connect a wallet and sign an approval, it is not our flow. Our only official domain is simpleswap.io.

What comes next

Each entry above will get its own breakdown in “Know the Scam by SimpleSwap“ over the coming months. Follow #KnowTheScam to catch every new one as it drops - phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.

FAQ

What is a token approval in crypto? A permission you grant a smart contract to move a specific token from your wallet, up to a set amount. It is required for ERC-20 tokens to function in DeFi, and it persists until you revoke it, rather than expiring after a single use.

Can someone drain my wallet without my seed phrase? Yes, and this is the most common way it happens now. If you approved a malicious contract, or signed a Permit message on a phishing site, the attacker moves your tokens using the permission you granted. Your seed phrase is never involved.

How do I revoke token approvals? Use Revoke.cash, Etherscan’s approval checker, or your wallet’s built-in allowance manager. Connect or paste your address, find approvals marked unlimited or belonging to contracts you no longer use, and revoke them. It costs gas, and you need to check each chain separately.

Does disconnecting my wallet remove approvals? No. Disconnecting only stops a site from seeing your address. The allowance stays live on-chain until you explicitly revoke it.

Is SimpleSwap safe from approval phishing? A standard SimpleSwap exchange does not involve connecting a wallet or signing an approval, so it does not add to your approval surface. It also cannot remove allowances you granted elsewhere, and a confirmed transfer cannot be reversed. Our only official domain is simpleswap.io.

This article is for educational purposes only and is not financial or security advice. SimpleSwap’s only official domain is simpleswap.io.

We are SimpleSwap, and this is the system we build. Since 2018, we have run a self-custodial multi-source swap aggregator used by 10 million people: funds move from your wallet to your wallet, and the routing happens under the hood. So this is not a neutral survey of the category. It is a description of our own machinery, written because the mechanics are more interesting than the marketing, and because anyone writing a SimpleSwap review should be able to check the claims against how the thing actually works.

Sourcing

An aggregator holds live connections to a provider network: for SimpleSwap, 20+ liquidity sources spanning centralized and decentralized venues, covering 2,800+ assets. Each exposes the same facts continuously: supported pairs, networks, price, and, crucially, depth. That last one is the variable users never see and the one that decides everything on a large order.

Route selection

The system does not look for the best rate in the abstract. It looks for the best executable rate for that size, on that network, at that moment.

Those qualifiers do the work. A venue quoting an excellent headline price may hold it for only a fraction of your order, after which you fill against worse levels and your realized average is nothing like the number you saw. This is why the largest exchange is not automatically the cheapest: it prices against its own book and flow, so when depth runs thin for your pair, you are exposed to the limits of a single source, however large it is overall.

Route selection compares candidate paths on expected output after impact, then does the thing that matters most: it can split. If no single provider absorbs the order cleanly, the system divides it across several, taking the top of each book rather than eating deep into one.

Concretely, a $250,000 order that would walk painfully down one venue’s book might instead go out as four slices, perhaps 38% to a deep centralized book, 27% to a pool, then 21% and 14% to two more sources. Each takes an amount it can fill near its best price. The user sees none of this, only the combined output.

Execution and tracking

Once your deposit confirms, the swap runs along the chosen route, with cross-chain legs handled internally. The measurable claim here is estimate accuracy: on the majority of floating swaps, the amount received lands within 99.998% of the estimate shown before commitment. Timing belongs to the chains, so fast networks settle within a minute, while Bitcoin and Ethereum take 10 to 30 minutes.

Tracking exists because the other layers fail invisibly — a provider stalls, a network congests, a leg retries. Without an order ID and a live status trail, it looks identical to theft. With them, it looks like a delay you can watch and ask about, which is most of what a four-minute support response is for.

Where aggregation actually pays

On a $200 swap, aggregation is a convenience: rates across venues are close enough that the difference rounds to nothing.

Price impact is where it becomes material. Impact is the gap between the quoted price and what you effectively get once your order has moved through the available depth, and it scales with your size relative to that depth. Send a large order into one venue, and you walk down its book. Split it across several, and each absorbs a slice near the top, keeping the impact bounded to swaps worth hundreds of thousands.

Which contradicts a common assumption: OTC desks are not the only option for sizes above a certain threshold. For checks in the tens or low hundreds of thousands, aggregated routing is a genuine alternative.

“The interesting part of this system is not that it finds a good rate. It is that it asks a question most users cannot ask on their own: what happens to the price at their size. A headline quote is a promise about the first slice of an order. Depth is a fact about all of it. Splitting one check across several books is unglamorous work, and on a large transfer it is worth more than any feature we could put on a landing page.”

Stefan Lauer, Head of Infrastructure, SimpleSwap

Where it stops being the right tool

Very large or compliance-sensitive transactions still belong at an OTC desk. Aggregation extends the range where routing works; it does not remove the ceiling.

Bundled pricing is not the tightest pricing. The rate includes the liquidity spread, typically 0.5% to 2%, plus service and routing costs. A high-frequency trader comparing maker and taker spreads across five venues will find better numbers on a centralized order book.

Self-custody means no reversal. Funds move wallet-to-wallet so that no one can recall a confirmed transfer. Aggregation improves the price. It cannot improve a wrong address.

The part that is invisible on purpose

There is a second audience for all of this that never sees our interface. The same engine runs inside 6,000+ partner products, including wallets such as Exodus and Tangem. A wallet offering swaps can either integrate with dozens of providers and maintain those connections forever, or call a single API. Most choose the API, which is why many swaps that appear to happen inside a wallet are this system behind someone else’s interface.

Which is the honest summary of a liquidity aggregator: an answer to fragmentation that succeeds by being unnoticeable. You see one rate and one confirmation. Underneath, twenty-odd sources were asked what they could do with your order, and the best combination of answers became one transaction.

This article was written by SimpleSwap — a self-custodial multi-source swap aggregator. 2,800+ assets, 20+ liquidity providers across CEX and DEX sources, 20M+ swaps since 2018. Wallet-to-wallet by design, with routing handled under the hood.

The information in this article is not a piece of financial advice or any other advice of any kind. The reader should be aware of the risks involved in trading cryptocurrencies and make their own informed decisions. SimpleSwap is not responsible for any losses incurred due to such risks.