How to spot a scam

If someone sent you a link

Never connect a wallet or sign anything from an unsolicited link. This is the one rule that matters most. Most of these don't steal your seed phrase directly — they get you to sign a permit or setApprovalForAll message that looks like nothing, and it grants the scammer a spending allowance on your tokens or NFTs. “Verify your wallet” by signing something is always the scam, never a real step.

• ›Generic, unbranded domains are the tell. Real projects use their own name (app.uniswap.org). A domain like notify-url.com or claim-reward.xyz isn't for anything specific — it's built to be reused across campaigns, just swap the subdomain.
• ›Check domain age with any WHOIS lookup. Scam sites are almost always days-to-weeks old. A protocol that's existed for years isn't running comms through a month-old domain.
• ›Compare against the actual official domain, bookmarked from the project's real account or docs — never trust a link from a DM, email, or random site, even if it looks right.
• ›Search “<domain> scam” before doing anything. If it's a known drainer, someone's posted about it already.
• ›Browser extensions (Wallet Guard, ScamSniffer) flag a lot of these automatically if you want a standing safety net instead of manually checking every link.

If it's a token contract

Is the source code verified on the block explorer? If not, you cannot see what it does — full stop. That alone is a reason to stop, regardless of anything else about the project.

If it's a proxy, check the implementation, not the proxy shell. Most tokens today are upgradeable proxies — reading the thin proxy contract tells you nothing; you need the actual implementation it delegates to.

Real rug-pull mechanisms to actually look for in the code, not just vibes:

• ›Mint function callable by the owner with no cap — owner can inflate supply and dump.
• ›Blacklist/pause functions — owner can freeze your wallet or halt all trading at will.
• ›Fee-on-transfer the owner can change after launch — can be set to 100% later, the classic honeypot: you can buy, you can never sell.
• ›Upgradeable with no timelock — owner can swap the entire contract logic instantly, for any reason.

None of these automatically mean scam — plenty of legitimate tokens have owner-controlled mint or pause for real reasons. The point is knowing they exist and deciding if you trust who holds that power, not assuming their absence or presence proves anything by itself.

If it's a “too good to be true” opportunity

• ›Guaranteed or fixed high yield with no real explanation of where it comes from — real yield has a source (fees, lending interest, real economic activity); if nobody can explain the source in one sentence, that's the answer.
• ›Pressure to act fast (“only 10 spots left,” countdown timers) — a real opportunity doesn't need artificial urgency to get you to skip diligence.
• ›Anyone who reaches out to you first with an investment opportunity, especially over DM/Telegram/WhatsApp from someone you don't otherwise know.

General social-engineering patterns

• ›Fake support accounts. Real project support never DMs you first, and never asks you to share a screen, a seed phrase, or “verify” by sending a transaction.
• ›Look-alike handles/domains. One swapped character (uniswaap, unisvvap) is a common trick — read it letter by letter if something feels slightly off.
• ›Urgency + authority combined is the actual formula behind almost every successful scam, crypto or not: “act now” + “I'm from the team/support.” Slow down specifically when you feel both at once.