Know the Scam is SimpleSwap’s educational project on crypto fraud — an ongoing series documenting how the attacks that cost people money actually work. This page collects the patterns it covers. Each one links to the full write-up published by SimpleSwap.
The premise behind the series: a scam is not a hack. A hack breaks code. A scam needs a decision from you — a click, a signature, a transfer — and that dependency is also its weakness. It has to show itself before it can work.
Exploits code or gains unauthorised access. It happens to systems, usually without any action from you.
Needs your participation. It has to persuade, so it has to appear — and that is where it can be caught.
Any one of these is reason enough to stop.
What happens, the detail that exposes it, and the full breakdown from SimpleSwap.
A copy of the interface on a near-miss domain. The swap screen works, the rate looks right, and the deposit address belongs to someone else.
Gives it away: Read the address bar, not the design. The padlock proves encryption, not identity.
See it in the Safety Academy →
The old giveaways — broken English, crude layouts — are gone. Current phishing mirrors real sites closely enough that spotting the copy is no longer a defence.
Gives it away: Reach services through a bookmark or a typed address, never a link in a message.
Read on the blog →A relationship built patiently over weeks, then steered toward a platform that shows growing balances and blocks withdrawals.
Gives it away: Any friendship that arrives at a trading platform is the pattern, however long it took.
See it in the Safety Academy →
A synthetic video of a known figure promising to return double what you send. Send 1, get 2 back — except nothing comes back.
Gives it away: No legitimate giveaway asks you to send first. That rule has no exceptions.
Read on the blog →
One signature on a malicious approval hands a contract permission to move your tokens. The wallet empties later, without another prompt.
Gives it away: Read what a signature authorises. Revoke approvals you no longer use.
Read on the blog →
Bots read pending transactions and trade around yours, so the price you get is worse than the price you saw.
Gives it away: Tight slippage and private routing shrink the surface.
Read on the blog →
An attacker seeds your history with an address whose first and last characters match one you use. Later you copy from history and send to theirs.
Gives it away: Verify the middle of the address, not only the ends.
Read on the blog →
Malware watches for a copied wallet address and substitutes the attacker's before you paste.
Gives it away: Compare the pasted address against the original, in full, every time.
Read on the blog →
The token buys normally and cannot be sold. The contract blocks exits, or liquidity vanishes once enough people are in.
Gives it away: Check whether anyone has successfully sold before you buy.
Read on the blog →
A script or code promising a SimpleSwap bonus. It exists to harvest credentials or push a signature.
Gives it away: No bonus requires running a script or connecting a wallet.
Read on the blog →
Impersonated support accounts find people already asking for help in public, then request a seed phrase or a “verification” transfer.
Gives it away: Support never messages first, and never asks for a seed phrase.
Read on the blog →
Unexpected tokens appear in a wallet. Claiming them means visiting a site and signing something that drains it.
Gives it away: Tokens you did not expect are bait. Interacting with them is the attack.
Read on the blog →Anything else carrying the name is a copy, however close the interface.
Layout, logo and colours clone trivially. The domain does not.
HTTPS encrypts the connection. A phishing site can hold a valid certificate.
Standard swaps never require one, and never a seed phrase.
An account that messages you first did not come from SimpleSwap.
Once confirmed on-chain there is no chargeback. The check happens before you send.
Every pattern here comes from SimpleSwap’s own scam documentation, which covers each case in greater depth with current examples.