Skip to main content
Other Assets

Scams and Rug Pulls

Pomegra Learn

Scams and Rug Pulls

Cryptocurrency operates in a regulatory gray zone where innovation thrives and fraud flourishes in equal measure. Unlike traditional finance, where regulatory oversight, deposit insurance, and custodial standards protect retail investors to a meaningful degree, crypto offers no such guardrails. If you send funds to a fraudulent address, they are gone. If a project creators abscond with billions in raised capital, no government agency recovers your money. This asymmetry makes due diligence and security discipline not optional niceties but non-negotiable survival skills.

Rug pulls—where developers build a legitimate-appearing project, accumulate capital or liquidity, then withdraw all funds and disappear—represent the existential threat at the high end of crypto fraud. A successful rug pull can evaporate billions in weeks. Pump-and-dump schemes follow the same playbook as their penny-stock ancestors: insiders hype a worthless token to retail investors, accumulate vast holdings at low prices, then dump them when the crowd drives the price up, leaving late entrants with losses. Ponzi schemes, whether denominated in traditional currency or crypto, promise unsustainable returns and rely on fresh capital from new investors to pay earlier participants.

Phishing remains the vector through which most individuals lose crypto—not through hacking sophisticated security but through social engineering. A fraudster sends an email or message that appears to come from a legitimate exchange, wallet provider, or trusted contact, requesting verification of credentials or seed phrases. You click, enter your information, and hours later your holdings are drained. SIM-jacking attacks, where criminals convince your mobile carrier to transfer your phone number to their device, allow them to intercept two-factor authentication codes and seize exchange accounts. Romance scams prey on emotional vulnerability: a beautiful stranger develops a relationship with you online, gains your trust, and eventually suggests investing in a profitable crypto opportunity—which turns out to be a siphon for your funds.

Red Flags and Due Diligence​

Suspicious tokens flood new exchanges daily. Legitimate projects have transparent teams with verifiable backgrounds, active GitHub repositories showing genuine development, clear use cases, and audited smart contracts from reputable firms. Projects that lack these fundamentals or pressure you to invest quickly should be treated as high-risk. The SEC maintains a list of known fraudulent schemes; check it before deploying capital.

Fake wallet applications, installed through phishing links or typosquatted domain names, steal private keys the moment you import or generate them. An official mobile wallet has proper code signing, is distributed only through legitimate app stores, and never solicits recovery phrases on-app. Romance scams and impersonation schemes targeting crypto holders exploit the pseudonymity of the ecosystem. A celebrity or well-known figure will never DM you on social media offering investment advice or partnership opportunities; assume any such contact is a fraud.

Reporting and Recovery​

If you fall victim to a scam, reporting it to the FBI's Internet Crime Complaint Center (IC3) and your local law enforcement creates a record that may help victims of subsequent schemes. Most scams involving U.S. exchanges can be reported to the SEC or CFTC. Unfortunately, recovery is rare. Once funds exit a legitimate exchange to a wallet you cannot trace, the money is effectively irretrievable absent extraordinary circumstances.

Operational security—OPSEC—is your primary defense. Use hardware wallets for significant holdings. Never share seed phrases or private keys with anyone, regardless of the context. Enable two-factor authentication on all exchange accounts using authenticator apps rather than SMS, which is vulnerable to SIM-jacking. Verify URLs before entering credentials; a fraudulent lookalike domain can cost you everything. Question unsolicited opportunities with the same skepticism you'd apply offline, and remember that if an investment sounds too good to be true, it invariably is.

Articles in this chapter​