Skip to main content

What crypto scams should I watch out for?

Don’t fall for crypto scams. Learn to spot common scams and get practical tips to keep your wallet and funds safe.

Crypto scams are designed to trick you into giving up access to your wallet. Most scams try to steal your 12-word secret key (also known as a 12-word secret recovery phrase), sync QR code, private keys, or other sensitive information. Common scam tactics include:

  • Fake websites and phishing emails

  • Investment offers that are too good to be true

  • Unexpected emails or messages that falsely claim you need to take urgent action

Never share your secret key, private keys, or sync QR code.

Want to know how to spot red flags and stay safe? Read on for more details.


In this article:



What are crypto scams?

Crypto scams are deceptive tactics designed to trick you into giving up your funds or sensitive information, such as your 12-word secret key, private keys, sync QR code, or wallet access. These scams come in many forms, including fake giveaways, phishing emails, fraudulent investment schemes, and malicious wallet apps.

Because crypto is decentralized, and Exodus is a self-custody wallet, you alone control your funds. This also means that if a scammer gains access to your wallet, there’s no central authority to recover your assets. And since crypto transactions are irreversible, once your funds are sent, they can’t be recovered.

The best defense is awareness. In this article, we’ll walk you through the most common types of crypto scams, how to spot red flags, and steps you can take to protect yourself.


How can I recognize a scam?

There are many types of crypto scams, but most of them rely on the same psychological tricks. Recognizing the warning signs can help you avoid falling for a scam.

If you're unsure if something is legitimate, contact the official Exodus Support team by emailing [email protected].

Watch out for these common red flags:

  • Unrealistic promises: Be cautious of offers that promise guaranteed returns, free crypto, or huge profits. If it sounds too good to be true, it probably is.

  • Pressure and urgency: Scammers often try to rush you into acting quickly. For example, they might lie and say that you need to claim funds before a deadline. They may use scare tactics or fake countdowns and “limited-time offers” to prevent you from thinking things through. Take your time and verify the source before acting.

  • Requests for sensitive wallet information: Never share your 12-word secret key, sync QR code, private keys, or passwords. No legitimate platform or support team will ever ask for this. Scammers often pressure you to share this information, falsely claiming it’s needed to verify your identity or unlock your wallet.

  • Upfront payments or fees: Be wary of anyone asking for a payment to release or unlock funds, process a withdrawal, or claim winnings. This is a common scam tactic.

  • Unsolicited or unexpected contact: Scammers often contact you unexpectedly via email, Telegram, Discord, or social media. They might seem helpful or say that there is something urgent, like falsely claiming that your account is at risk and action is required, or that you need to be fast to claim funds.

  • Fake support or impersonated services: Scammers can spoof emails, create fake websites, or copy trusted accounts. Their goal is to trick you and gain your trust by falsely appearing as legitimate support, platforms, or services.

  • Lack of transparency: Be cautious of livestreams, websites, or chat groups that hide comments, block feedback, or offer vague details. Scammers often suppress warnings from other victims.

  • Celebrity endorsements: Fake giveaways or investment pitches that use names like Elon Musk or Vitalik Buterin are scams. These figures are not involved in promotions or handouts.


How can I protect myself from scammers?

Staying safe starts with protecting your wallet and personal information. Most crypto scams rely on tricking you into handing over access to your funds. As such, the best defense is knowing what never to share, what to avoid, and how to spot red flags before it’s too late.

If you're unsure if something is legitimate, contact the official Exodus Support team by emailing [email protected].

Here’s how to protect your wallet and stay in control of your crypto:

  • Protect your private info: Never share your 12-word secret key, private keys, or sync QR code with anyone. No one legitimate, especially Exodus staff, will ever ask for them. Avoid entering this info on any website. If someone asks for it, it’s likely a scam.

  • Don’t validate or verify your wallet: No one should ever ask you to enter or share your 12-word secret key or private keys, not even support staff. If you're asked to “validate” or “verify” your wallet by providing this info, it’s likely a scam.

  • Don’t share your sync QR code: If someone asks for your sync QR code, it's likely a scam. Scammers can use it to access your wallet and steal your funds.

  • Don’t allow remote access to your device: Scammers often pose as support agents and ask you to install remote access software to steal your funds or data.

    Exodus Support will never ask to access your device.

  • Don’t trust others to help set up your wallet: Scammers may offer to help you set up your wallet to steal your secret key or sync QR code. Never let anyone assist with setting up your wallet, especially online or remotely.

  • Be careful with QR codes: Scammers may send QR codes that auto-fill a higher amount than expected. Always double-check the amount before sending.

  • Be skeptical and verify everything: Scammers rely on urgency and excitement to trick you. Always pause and double-check before clicking links, connecting your wallet, or sending funds.

    Stick to official sources, avoid links from messages, and watch for fake websites or social media accounts. Real support will never ask for sensitive info like your key or private keys.


    Taking a moment to verify the source can help protect your crypto.

For more tips on how to protect your wallet, visit: How do I keep my money safe?


What are some common scams?

Crypto scams take many forms and are always evolving. To help you stay safe, the sections below outline some of the most common types of scams:


Phishing scams

Phishing scams impersonate trusted companies, brands, or individuals to trick you into revealing sensitive information, especially your 12-word secret key, sync QR code, or private keys.

These scams often come through fake emails, social media posts, websites, or support messages that appear legitimate. The goal is to create urgency or fear so that you act without verifying.

Phishing is especially dangerous in crypto because once you give someone access to your wallet, there's no way to undo the damage. With a self-custody wallet like Exodus, protecting your private info is your responsibility, so it's critical to stay cautious.

Here are examples of phishing scams.


Spear phishing using leaked personal data

Spear phishing uses leaked information to create personalized attacks.

If your personal information has been exposed in a data breach, scammers may send fake emails, texts, or phone calls using your contact details. They often include accurate information, like your name, email, or legitimate services you’ve used, to make the scam seem more believable.

Some scammers impersonate crypto platforms or wallets (such as Coinbase or Trezor) and make fake support calls pressuring you to move funds. The aim is to create urgency to trick you into sending money directly to them.

Finding your email, phone number, or password in a breach can be unsettling, but it does not put your Exodus wallet or funds at risk. It can serve as a reminder to stay alert for scams and strengthen your defences.

To check whether your data has been exposed in a breach, visit: haveibeenpwned.com​.

To help protect yourself:

  • Ensure your passwords are unique and update old or reused ones, especially if a previous password has been leaked. Consider using a password manager to ensure every password is strong and unique.

  • Use two-factor authentication (2FA) and avoid SMS-based authentication if possible (because of the risk of SIM-swapping).

  • Create a dedicated email for crypto activity or use an alias service like SimpleLogin for disposable email addresses.

  • Be cautious of unexpected calls or texts if your phone number has been leaked.

  • Attackers may impersonate crypto platforms by email, SMS, or phone. Always verify directly through the official website or app.

If you’re ever unsure if something is a scam, contact Exodus Support by emailing [email protected], or visiting the messenger (purple chat icon in the bottom-right corner) to start a chat.


WalletConnect scams

WalletConnect is a legitimate and widely used protocol that allows you to connect your wallet to web3 apps and dApps. However, scammers can exploit this by creating fake web3 apps and malicious websites that look almost identical to trusted platforms.

The scammer aims to trick you into connecting your wallet to a fake web3 app and to approve a dangerous transaction or request. It could give the scammer the permissions needed to access your funds or create a transaction that behaves differently from what you expect and sends the funds to the scammer instead.

Always verify that the web3 app or website you're connecting to is legitimate, and that you accessed it with the correct URL, before approving any connection through WalletConnect.

To help protect yourself:

In Exodus Mobile, connecting to web3 apps with WalletConnect is only available if you created your wallet before April 22, 2026.


Fake websites and profiles

Scammers often create fake websites and social media profiles that closely mimic trusted sources. Usually, spoofed sites use web addresses that closely resemble official ones. A scammer might change a single letter in the domain name or use a different extension, like .biz, .info, etc. Even a single wrong character in a URL can lead to a scam site.

Scammers also often pay for their fake sites to appear at the top of search results, making them seem more legitimate.

These fakes often urge you to "validate your wallet" or "verify your info," which is a trick to steal your secret key.

To help protect yourself:


Impersonation and fake support

These scams rely on impersonation or emotional manipulation rather than direct phishing.

Scammers may pretend to be support agents, authority figures, friends, or members of trusted organizations to gain your trust.

Their goal is to convince you to take actions, such as sending funds or sharing information, that can compromise your wallet or cause you to lose your funds.

Here are examples of this kind of scam.


Exodus imposters

Some scammers try to pose as Exodus by sending spoofed emails, creating fake social media accounts, or building lookalike websites, all in an attempt to steal your funds.

These scams often try to create a sense of urgency. The fake Exodus imposters may claim you need to take immediate action to secure your wallet, ask for sensitive information like your 12-word secret key or private keys, or say you need to pay to verify your wallet or unlock a larger amount in your Exodus wallet.

These are all signs of a scam. Messages, websites, or social media accounts making these claims are not from Exodus.

Exodus is a self-custody wallet. Exodus Support will never ask for your secret key, sync QR code, or private keys, or ask you to verify or validate your wallet.

If you ever need help from Exodus, contact the official support team by sending an email to [email protected] or by visiting the messenger (purple chat icon in the bottom-right corner) to start a chat.

To help protect yourself:


Fake partnership scams

In this scam, scammers pretend to be legitimate companies and falsely claim they partnered with Exodus or similar platforms to gain your trust and steal your crypto.

These scammers send phishing emails claiming that you must transfer your assets from legitimate crypto companies to an Exodus wallet due to regulatory changes or platform updates.

The scammer provides a 12-word secret key and instructions to restore it into a wallet. They then tell you to move your funds to that wallet, which the scammer controls.

Never restore a wallet from a secret key someone else gave you, and never send funds to this wallet. If you do, scammers can access your funds.

​A recent example involved a phishing email impersonating Gemini. The email falsely claimed that Gemini filed for bankruptcy and partnered with Exodus. It included a secret key and instructed users to restore the wallet in Exodus, then move their funds from Gemini to that wallet. In reality, scammers controlled the wallet, and could steal any funds sent to it.

To help protect yourself:


Employment scams

Employment scams involve fake job offers where scammers pretend to be employers and eventually ask you to send cryptocurrency or other funds as part of the job.

Scammers often reach out through social media, messaging apps like Telegram or WhatsApp, or job platforms. They may offer simple remote work, such as product reviews or other tasks.

At first, the job may seem legitimate. In some cases, scammers may send small payments to build trust. However, they will eventually ask you to send your own crypto to "level up", pay for training, or as part of starting or securing the role.

Once you send the funds, the scammers vanish, and your money is gone for good.

To help protect yourself:

  • Do not send crypto to anyone as part of a job

  • Be cautious of unsolicited job offers or messages

  • Verify the company and job listing through official channels


Scams claiming your wallet is linked to another platform

You may receive an email that your Exodus wallet has been linked to Binance, Coinbase, or another crypto platform.

This is a scam. Your Exodus wallet can't be linked to any other platform. The scammer wants you to provide them with your 12-word secret key so they can steal your funds.

Exodus Support will never ask for your secret key or private keys.

To help protect yourself:


Telegram scams

Scammers on Telegram will often pretend to offer help or be from Exodus Support in an attempt to try to access your wallet or steal your information.

Exodus does not offer support on Telegram. If someone on Telegram claims to be from Exodus Support, then it is a scam.

Some Telegram scammers may try to steal your funds by syncing with your wallet. They might ask you to share your screen so they can view and scan your sync QR code.

Never share your sync QR code. If they get access to it, they can scan it to sync their wallet to yours and gain full access to its funds.

If you need to contact Exodus Support, contact the official Exodus team by emailing [email protected] or by visiting the messenger (purple chat icon in the bottom-right corner) to start a chat.

To help protect yourself:


Recovery scams

Recovery scams claim to help people recover lost or stolen funds. They often involve individuals or groups that pretend to have special expertise or resources to help. In reality, they are trying to steal more funds from people who may already be victims of scams.

Recovery scams take various forms, such as phishing scams, fake recovery websites, or impersonation scams. They may target victims who have lost funds through scams or hacks or who are looking for a way to recover funds that they believe were lost due to a mistake or oversight.

Due to how crypto works, recovery is rarely possible. Legitimate services will likely not offer to recover your funds.

To help protect yourself:

  • Be skeptical of anyone promising to recover your funds

  • Be very careful about paying upfront fees or sharing sensitive info


Fake support messages and DMs

Scammers often reach out unexpectedly, pretending to be from a legitimate company, crypto project, support team, or even a well-known figure.

These messages commonly arrive through direct messages on platforms like Telegram, Discord, X (formerly Twitter), or Facebook, as well as through texts, calls, emails, or pop-up messages on websites and within apps.

The goal is usually to build trust or create urgency. For example, scammers may claim that your wallet is at risk, offer to help with a technical issue, or promise free crypto or investment opportunities.

Legitimate companies or support teams won’t DM or email you unexpectedly about your wallet or funds. If someone does, it’s almost certainly a scam.

To help protect yourself:


Investment scams

These scams promise big returns, guaranteed profits, or exclusive opportunities, like special investments, prizes, or rewards.

Some investment scams operate by requesting an upfront payment in exchange for a promised, but ultimately nonexistent, larger sum of money, reward, or service.

In the end, the offers are usually fake, there are no real returns, and your money has been lost.

Here are some examples of this kind of scam.


Common investment scam tactics

Investment scams promise big profits, and they are designed to look convincing. These scams exist both in traditional finance and crypto, but the tactics used by scammers are often the same.

Scammers may claim you’ll earn high returns with little or no risk, but the investment is either fake or worthless. Common types include:

  • Ponzi schemes: Early investors are paid with money that new investors provide. There's no real profit, and the scam relies on the fact that there are always new investors. These schemes collapse when new money stops coming in.

  • Pyramid schemes: You’re asked to recruit others and earn money from their fees. Like Ponzi schemes, they fall apart when new members stop joining.

  • Fake investment opportunities: You’re asked to invest in a fake company, project, or product. These scams often use fake websites, flashy materials, or impersonated endorsements.

Investment scams can be hard to detect. Scammers often use professional-looking materials and pressure tactics to make fake opportunities seem legitimate.

Always be cautious of offers that seem too good to be true.

Even if an offer sounds convincing, stay alert. Look for red flags such as high-pressure tactics, vague details, or guaranteed returns.

Always be skeptical and follow these tips:

  • Do your research

  • Check for reviews or warnings online (search for the name of the company and “scam”)

  • Consult a trusted, licensed financial advisor

  • Verify legitimacy with a trusted regulatory agency


Advance fee scams

If anyone asks for payment upfront in exchange for money, rewards, or a service, it's often a scam. Legitimate services do not usually require advance payments for withdrawals, winnings, or investments.

Scammers might promise you money, rewards, or a service, but first require you to pay a small fee upfront to claim it.

They might say that the payment is for processing or unlocking your funds. However, once you send the "fee," they usually disappear or demand additional payments, with the promised funds or rewards never arriving.

Scammers often pose as companies or support teams and contact you with spoofed emails or social media accounts. They may also pose as fake merchants or sellers offering goods or services. Their goal is to trick you into transferring funds. Since crypto transactions are irreversible, you cannot get your money back if you send funds to a scammer.

Always be skeptical and follow these tips:

  • Never send crypto to claim a prize, unlock funds, or pay a processing fee

  • Verify the source. Don’t trust emails or messages at face value

  • Watch for urgency and pressure


Crypto tax software used in advance fee scams

In a version of the advance fee scam, scammers use crypto tax platforms to make it look like you have a large deposit or balance waiting to be claimed.

Some crypto tax platforms allow users to import real blockchain data or manually add transactions to track crypto for taxes. Scammers exploit this using the manual entry feature to create the illusion of large funds associated with an address.

Sometimes, pretending to be from Exodus or the tax service, scammers may send fake screenshots or emails claiming that the funds are "pending" or "locked" and asking you to pay a fee to release them.

But the funds don't exist. The transaction is only a manual entry within the tax platform, not a real blockchain transaction.

If you send funds to unlock the fake balance, the scammer will take your money and disappear.

Always be skeptical and follow these tips:

  • Never send crypto to unlock or unfreeze funds

  • Verify the source. Don't trust emails or messages at face value

  • Watch for urgency and pressure


Token presale scams

Presales can offer early access to new tokens, and some are legitimate opportunities to support projects early on. However, they’re also a common target for scams. Because these tokens are often not yet listed on exchanges, it can be harder to verify a project's legitimacy.

Scammers may create fake presale websites, impersonate real projects, or promote malicious smart contracts. They often promise token bonuses or guaranteed returns to lure people in. But once you send funds to a fake presale, the scammers vanish, and your money is gone for good.

Always do your own research before participating. If anything seems unclear or too good to be true, it's best to stay away.

Always be skeptical and follow these tips:

  • Never send crypto to unlock, claim, or unfreeze funds

  • Verify the source. Don’t trust links or messages at face value.

  • Watch for urgency, pressure, or "limited time" claims


Scam tokens and airdrops

These scams use suspicious or unexpected tokens and NFTs to trick users.

The tokens might appear in your wallet without warning, and may contain malicious links hidden in their metadata.

Some are designed to track activity, while others try to lure you into interacting with them, leading to security risks or wallet compromise.

Here are some examples of this kind of scam.

Fake tokens

Just like scammers spoof legitimate websites, they can also create fake versions of real tokens. These scam tokens may look and behave like authentic tokens in your wallet, but they have no actual value.

The goal of sending fake tokens is to trick you into believing you’ve received something valuable, often as part of a phishing attempt or a larger scam.

If you see an unfamiliar token in your Exodus wallet or transaction history, follow these steps to verify it with a block explorer and a crypto data aggregator like CoinMarketCap or CoinGecko.

  1. Click the transaction ID in your wallet to open the transaction in a block explorer.

  2. Click the token's contract address. It is typically displayed within the transaction's information.

  3. Then, search for the token by name on CoinMarketCap. You can find the token's contract address under Contracts.

  4. Compare the contract address you found on CoinMarketCap to the token in question. If the token is legitimate, the contract address will match.

Another way to determine a token's legitimacy is to look for red flags on its contract address page on a block explorer.

Block explorers provide information on a few key areas regarding tokens:

  • a) Token reputation - signaled by a blue checkmark

  • b) Holders & Total Transfers

  • c) Code verification with Audit Report

  • d) Contract Address

Here is an example of a legitimate token displayed on the block explorer. a) Note that the token has a known reputation, b) a high number of holders and total transfers, c) an audited source code, and d) a contract address that matches what is listed on CoinMarketCap and CoinGecko:

Compare it to a scam counterpart of the same token. In this example, the scam token has a) an unknown reputation, b) a low number of holders and total transfers, c) no audit done on the source code (even though the source code is a match), and d) the contract address does not match what is listed on CoinMarketCap or CoinGecko.

Although none of these checks automatically rule out a token's legitimacy, a token lacking all those criteria is suspect.

To help protect yourself:


Fake NFT Vouchers

If you receive an unexpected NFT in your NFT Gallery claiming you've won free crypto, money, or other prizes, it's likely a scam.

These fake NFT vouchers often include links to malicious websites designed to steal your information or access your wallet.


Always be cautious with unexpected NFTs, and never click on links they contain.

If you visit a scam link, it could try to gain access to your wallet by asking you to enter your 12-word secret key or private keys, or prompt you to authorize a malicious transaction.

​​
To help protect yourself:

  • Hide fake NFTs: Don't interact with them, don't visit any of the links, and don't send it out.


Dust attacks

Dust attacks involve an scammer sending very small amounts of crypto to multiple crypto addresses. The low value being sent can make it easy to miss. With dust attacks, the attacker's goal is typically one of two things:

  1. For account-based assets, the dust transaction might include malicious links leading to malware, phishing sites, or advertisements in the transaction details.

  2. For UTXO-based assets, an attacker might send dust to an address to analyze the movement of the dust in an attempt to reveal the owner's other addresses.​

To help protect yourself:


Transaction and address manipulation scams

These scams target sending or receiving crypto transactions. They work by changing the destination address, faking transaction statuses, or tricking you into sending funds to the wrong place.

The goal is to confuse you while you complete a transaction.

Some scammers may also trick you into importing a wallet they claim contains funds. The wallet is under the scammer's control, so you can't withdraw the funds, and any funds you send to it can be stolen.

Here are some examples of this kind of scam.


Address poisoning: Unrecognized transactions with zero value

If you notice zero-value transactions in your wallet that you don't recognize, you may have been targeted by a scam known as address poisoning.

Address poisoning is a tactic scammers use to trick you into sending crypto to the wrong address. The scam relies on you copying a recently used address from your transaction history without double-checking that it's correct.

Scammers generate a wallet address that resembles one you've interacted with. Then, they send a small or zero-value transaction to your address, or create a fake transaction that looks like it's from you.

The scammer hopes you will mistakenly send your crypto to the address from your transaction history instead of the correct address.

To help protect you from copying a scam address, Exodus automatically hides zero-value transactions on all supported EVM networks.

In addition, on Exodus Mobile, if you copy a receive address from your transaction history by long-pressing it, you’ll see a warning reminding you to verify it.

To help protect yourself:

  • When sending crypto, double-check every character of the address

  • Don't copy addresses from your transaction history

  • For extra safety, send a small test transaction before sending a larger amount. Keep in mind that some exchanges have minimum deposit limits, so check with the platform first


Ghost transactions (failed or replaced scam transactions)

This type of scam tries to trick you into thinking that you have received funds when, in reality, no funds ever reached your wallet, which is why they're often called ghost transactions.

The scammer sends you a transaction, often an Ethereum or ERC20 transaction, but they either replace it to reroute the funds back to themselves or create a transaction that will fail. As a result, you'll never actually receive any funds.

The scammer hopes you'll assume the payment was successful and send the goods, services, or crypto in return.

Exodus may automatically hide ERC20 transactions on Ethereum and other supported EVM-compatible blockchains when the sender attempts to transfer tokens they do not actually have. These transactions will fail and are often associated with scam attempts. Hidden transactions may still be visible on a block explorer.

To protect yourself, always confirm that funds have actually arrived before sending anything in return. You can check your balance on a block explorer to verify the transaction was successful. You can also check if the transaction was replaced or failed.

​If you see a) Dropped & Replaced, you might not receive the funds from this transaction. b) Click on the transaction ID of the replaced transaction to confirm where the funds in the replaced transaction were sent, as well as the amount.

Keep in mind that not all Dropped & Replaced transactions are scams. This feature is also used to speed up a stuck transaction. To determine if it could be a scam, look at the address the funds were sent to in the replacement transaction.


If the transaction fails, you will see the Fail status when viewing it with a block explorer. This means that you will never receive the funds.

To help protect yourself:


Honeypot scams: Don't import unknown secret keys or private keys!

Scammers use honeypot scams to make you believe you can access a wallet with funds. In reality, the scammer still controls the wallet.

Scammers will give you a 12-word secret key (also known as a 12-word secret recovery phrase) and/or private key, claiming you can recover the wallet and access its crypto. However, the scammer has secretly changed the wallet settings. Although you can see the funds, the scammer controls the wallet and prevents you from sending them out.

A common tactic involves honeypot wallets that appear to hold a large amount of crypto, typically USDT or other stablecoins, but the wallet has no crypto to cover the transaction fees. If you send crypto to cover the fees, it will likely be stolen.

Scammers may also try to sell these honeypot wallets, tricking you into believing you purchased a wallet with funds. However, the funds are inaccessible because the scammer still controls the wallet.

Below, you can learn more about common honeypot scams, such as the USDT on TRON, USDT and USDC on Ethereum, and address ownership scams.


USDT on TRON

With some honeypot scams on TRON, scammers set up a wallet containing USDT or other funds that cannot be transferred, even if you have the wallet's secret recovery phrase or private key.

For example, it could be a multi-sig wallet, which means it requires more than one private key to access and send funds.

Without all the necessary private keys (signatures), you won't be able to withdraw any crypto. The scammer controls the additional private keys and can steal any funds you send to the wallet, such as TRX sent to cover transaction fees.

In other cases, the wallet might hold USDT on TRON, but the USDT has been blacklisted by the issuer, meaning it's frozen and can't be transferred.

Never send funds to a wallet where the permissions have been changed. For information on what to do if you have restored a honeypot scam wallet, see: What should I do if my wallet is affected by an ownership or honeypot scam?

To help protect yourself:

  • Never restore a wallet with a secret key or a private key that someone gives you

  • Never send funds to a wallet you don't trust

  • Never share your own secret key, private keys, or sync QR code


USDT and USDC on Ethereum

Some honeypot scams use wallets containing USDT or USDC on the Ethereum network. However, the tokens in these wallets have been blacklisted by the issuer, meaning they are frozen and cannot be transferred.

Scammers may try to trick you into thinking you can access these funds in the wallet, or tell you to send Ethereum (ETH) to the wallet to cover network transaction fees for sending the tokens.

Never send any ETH to this address. You will not be able to access the tokens in the wallet, and scammers could steal any ETH you send to it.

For more information, if you restored a honeypot wallet by mistake, see: What should I do if my wallet is affected by an ownership or honeypot scam?

To help protect yourself:

  • Never restore a wallet with a secret key or a private key that someone gives you

  • Never send funds to a wallet you don't trust

  • Never share your own secret key, private keys, or sync QR code


Address ownership scam

Scammers may try to trick you by giving or selling you a 12-word secret key or a private key to a wallet where they have secretly changed ownership or taken control of the address.

A few common examples include Solana addresses, where scammers change the owner, and XRP addresses, where they disable the master key. In both cases, the original private keys can no longer access the funds in the address, preventing you from withdrawing them.

This tactic makes you believe you have full access to the wallet and its funds. However, you do not. Since the scammer controls the address ownership, you cannot access or withdraw the funds.


Don't send any funds to these scam addresses. If you do, the scammers will have full control over those funds and can steal them anytime.

It's best practice not to restore a wallet with a secret key or a private key that someone gives you. And remember, it's crucial never to share your own secret key or private keys with anyone.

If the ownership of one of your addresses has changed, or you’ve restored an ownership scam wallet, see: What should I do if my wallet is affected by an ownership or honeypot scam?

To help protect yourself:

  • Never enter or share your secret key or private keys

  • Don't restore a wallet with a secret key or a private key that someone gives you


Ethereum and EVM smart contract delegation scam

Scammers can gain control of your Ethereum or other EVM-compatible address by getting it delegated to a malicious smart contract.

This can happen in several ways, such as connecting to a fake web3 app or website, restoring a wallet that’s already been compromised by the scammer, or if a scammer gains access to your wallet and changes its permissions.

One example involves a feature called EIP-7702, which allows an Ethereum or EVM address to be delegated to a smart contract. Using this feature, a scammer may try to trick you into delegating your address to a malicious smart contract that transfers your funds to them.

Once your address has been delegated, the scammer's contract can instantly forward any funds sent to it. Any new deposits may disappear immediately.

If your address has been delegated to a malicious smart contract, or you've restored a scam wallet, it's best to consider the wallet compromised. For more information, see: What should I do if my wallet is affected by an ownership or honeypot scam?

To help protect yourself:

  • Never enter or share your secret key or private keys

  • Don't restore a wallet with a secret key or a private key that someone gives you

  • Double-check and verify the legitimacy of dApps and websites before signing requests. To learn more, visit: Stay safe in DeFi and web3.​


Solana authorization scam

There is another variation of this scam, specific to Solana, in which scammers trick you into signing a malicious web3 app request that grants them ownership of your address.

This scam often occurs through fake web3 apps and websites disguised as NFT minting, staking, or swap platforms. After you connect your wallet to the scam web3 app, you'll be prompted to sign a request.


The request might look legitimate, but if you approve it, the scammer becomes the owner of your Solana address. Then they can access it and steal your funds, including SOL and any Solana tokens.

Once ownership of your Solana address is transferred, there is no way to reverse it. You will permanently lose access to the address and any funds it contains.

For more information on what to do if the ownership of your Solana addresses has changed, see: What should I do if my wallet is affected by an ownership or honeypot scam?

To help protect yourself:

  • Double-check and verify the legitimacy of dApps and websites before signing requests. To learn more, visit: Stay safe in DeFi and web3.​


XRP disabled master key scam

In XRP ownership scams, scammers take control of an XRP address by disabling the original master key and assigning ownership to a different key they control.

If you try to access that wallet even though you see the funds, you won't be able to access them, because the original keys no longer control that wallet. However, the scammer can access the wallet with the key that controls the address.

The scammer tries to trick you into believing you have access to the funds in the wallet. However, you won't be able to send any funds from the wallet, and the scammer can also steal any funds you deposit.

If you restored an XRP ownership scam wallet, or if the ownership of one of your addresses has changed, see: What should I do if my wallet is affected by an ownership or honeypot scam?

To help protect yourself:

  • Never restore a wallet with a secret key or a private key that someone gives you

  • Never send funds to a wallet you don't trust

  • Never share your own secret key, private keys, or sync QR code


Hedera account ownership scam

Hedera ownership scams involve scammers exploiting the ability to change which private key controls an Hedera account.

Scammers may try to trick you into restoring a wallet where the ownership has already been changed, or into transferring the ownership of your Hedera account to the scammer's private key.

Once the ownership has changed, you might see the funds in the wallet, but you won't be able to access them with the original private key. Instead, the scammer's key controls the account and can steal any funds you deposit.

If you restored a Hedera scam wallet, the entire wallet should be considered compromised. You can create a new wallet by following the guide: How do I delete my wallet and start over?

In Exodus Desktop, you might see a prompt that your wallet is at risk. To learn more, see: What should I do if my wallet is affected by an ownership or honeypot scam?

To help protect yourself:

  • Never restore a wallet with a secret key or a private key that someone gives you

  • Never send funds to a wallet you don't trust

  • Never share your own secret key, private keys, or sync QR code


What should I do if my wallet is affected by an ownership or honeypot scam?

If you've restored a wallet affected by a honeypot or ownership scam, you won't be able to withdraw funds from the compromised address. Because you no longer have full access, the entire wallet should be considered compromised.

If Exodus Mobile or Desktop detects an ownership or permission change related to a scam, you may see a warning prompting you to create a new wallet or move your funds. Wallet actions, such as sending and receiving, may also be limited to help protect you. If you see a warning in Exodus, visit the relevant section:

Scam warnings may not appear for every type of scam and are not available in Exodus Web3 Wallet. If you suspect your wallet is affected by a scam but do not see a warning, follow the steps below to help keep your funds safe:

  1. Send any remaining assets in addresses not affected by the ownership scam to another wallet. For instructions, visit: How do I send Bitcoin and crypto from Exodus?

  2. Stop using the compromised wallet and create a new Exodus wallet. For instructions, visit: How do I delete my wallet and start over?


Mobile

If Exodus Mobile detects an ownership or permission change related to a scam, you might see a warning that your wallet is at risk.

If the warning includes the option to Create New Wallet, the warning cannot be closed. To protect you from further risks, Exodus will limit wallet actions, and sending and receiving will be disabled.

In the warning, you have two options:

  • a) Tap Contact Support to reach out to Exodus Support for additional help.

  • b) If you wish to permanently delete your current wallet and create a new one, tap Create New Wallet.

If your wallet detects an EIP-7702 smart contract scam on Ethereum or another EVM network where EIP-7702 delegations are possible, and you still have assets in unaffected addresses, you'll see an option to move those funds.

  1. You'll see a warning when you try to transact with ETH or ERC20 tokens, or when you tap the warning banner in your wallet.

  2. The warning will indicate your wallet is at risk and give you the option to move funds. Tap Move funds.

  3. You'll see the list of assets that need to be moved. If you're using multiple portfolios, a) tap the portfolio selector to view assets that need to be transferred. b) Tap Start transfer to send the first asset.

  4. After sending the first asset, you'll need to send the remaining assets manually. For a guide on sending assets, visit: How do I send Bitcoin and crypto from Exodus?

  5. Once you have sent all the funds to another wallet, you can create a new wallet. If you see the prompt to create a new wallet, tap Create New Wallet.

    ​If you don't see a prompt to create a new wallet, follow this guide: How do I delete my wallet and start over?


Desktop

If Exodus Desktop detects an ownership or permission change related to a scam, you might see a warning that your wallet is at risk.

If the warning includes the option to Create New Wallet, it cannot be closed. To protect you from further risks, Exodus will restrict wallet activity, and sending and receiving will be disabled.

In the warning, you have two options:

  • a) Click Contact Support to reach out to Exodus Support for additional help.

  • b) If you wish to permanently delete your current wallet and create a new one, click Create New Wallet.

In some cases, depending on which scam is detected, if you still have assets in unaffected addresses, Exodus might show a warning with the option to move those funds.

  1. Click Move funds.

  2. a) You'll see the list of assets you need to move out. b) Click Move funds to send the first asset.

  3. After sending the first asset, you'll need to send the remaining assets manually. For a guide on sending assets, visit: How do I send Bitcoin and crypto from Exodus?

  4. Once you have sent all the funds to another wallet, you can create a new wallet. If you see the prompt to create a new wallet, click Create New Wallet.

    ​If you don't see a prompt to create a new wallet, follow this guide: How do I delete my wallet and start over?


Malicious software

These scams involve malware or attempts to gain access to your device.

Once malware is installed or access is granted, the scammer can monitor your activity, steal your information, or take control of your wallet.

In these cases, the attack starts from your device itself, putting your funds and personal data at serious risk.

Here are some examples of this kind of scam.


Malware and cryptoshuffler

Malware scams involve software designed to gain unauthorized access to your device, monitor your activity, and steal your crypto.

One especially dangerous type of malware, often distributed through phishing emails or malicious websites, is a cryptoshuffler.

A cryptoshuffler silently runs on your device and monitors your clipboard. When you copy a crypto address to send funds, the malware replaces it with the scammer’s address. If you don’t notice the change and proceed with the transaction, your crypto is sent to the scammer’s wallet.

Because crypto transactions are permanent once confirmed, you cannot get your funds back from the scammer.

If you suspect your device has been infected with malware, disconnect from the internet immediately and run a full antivirus scan. Do not send any funds until your system is confirmed to be clean. To learn more, visit: Removing malware.

To help protect yourself:


Fake wallets and apps

While Apple and Google are good at screening their app stores, fake and malicious apps can sometimes get through. When scammers get fake versions in official stores, they use screenshots, pictures from the real app, and fake reviews to make their wallets look legitimate.

Checking to ensure your app is authentic is key to protecting your funds. Find in-depth instructions here:

If you are more technical, you can use a checksum, look for the release hashes, and verify that your download is signed. You can also turn on auto-update in your mobile settings or the desktop app.

Exodus Mobile is available on Apple devices running iOS 16 or higher and Android devices running Android 10 or higher. Only download Exodus through the Google Play Store for Android, App Store for iOS, or links on our official website.

To help protect yourself:


Resources and support

How do I contact Exodus Support?

Please get in touch with Exodus Support only through our official channels.

For information on all the ways to contact Exodus Support, visit:

Please note that Exodus Support will never send unsolicited emails. Exodus doesn't have your email address unless you sign up for our newsletter. We will only contact you by email in reply to an inquiry you've already sent us.

Likewise, we have staff on major social media channels, but our staff will never DM you. If someone messages you on a social media platform, they are likely a scammer. Our social media team will only post public replies.

If you have already been scammed, note that blockchain transactions are permanent and can't be reversed. This is a core component of blockchain technology. Exodus provides a software interface to interact with the blockchain.

Your local law enforcement agency might be able to assist you. Learn how to report scams here: How do I report the crime?

For more tips on how to protect your wallet, visit: How do I keep my money safe?

Did this answer your question?