Fraud on Bitsy Wiki

Anatomy of a Crypto Scam

Mon, 01 Jan 0001 00:00:00 +0000

The frauds in this section have almost nothing in common at the level of technique. A honeypot token is a few lines in a transfer function; pig butchering is six months of conversation conducted by a trafficked worker reading from a script. What they share is a set of problems every one of them has to solve in the same order, and the order is what makes them recognisable to somebody who does not know the specific technique.

Rug Pull

Mon, 01 Jan 0001 00:00:00 +0000

A rug pull is the removal, by the people who issued a token, of the value backing it. Nothing about the token breaks: balances stay where they are, transfers still succeed, and the explorer still reports the same total supply. What disappears is the other side of every trade — the liquidity pool holders would have sold into — and with it any price at which they can leave.

The mechanism follows from how a decentralized exchange prices an asset rather than from a defect in any contract. A rug pull sits in the market-and-issuance group of crypto fraud beside the honeypot token, which blocks the exit inside the transfer function instead of draining the pool, and hidden admin controls, the general case of both.

Honeypot Token

Mon, 01 Jan 0001 00:00:00 +0000

A honeypot token is one that can be bought and cannot be sold. The trap sits in the transfer path from the first block, so the price history reveals nothing: buys confirm, the holder count climbs, the chart rises, and every attempt to exit reverts or returns nothing. A rug pull removes the pool after the fact and leaves a real, if worthless, market behind; a honeypot never had an exit, and the deployer is the only address that ever realises a price.

Hidden Admin Controls

Mon, 01 Jan 0001 00:00:00 +0000

Hidden admin controls are privileged functions in a token contract that let one key holder take, freeze, or dilute balances belonging to other people. The category is awkward because almost every one of them is also a real feature of a real token. Tether’s USDT and Circle’s USDC both carry a blacklist and both have used it. The function tells you what is possible, not what is intended, and the same mint that backs a redeemable dollar backs an unlimited rug pull. Automated scanners resolve that ambiguity by reporting the capability and letting the reader supply the intent, which is why an honest token with any of these functions gets flagged — see token false alarms.

Pump and Dump

Mon, 01 Jan 0001 00:00:00 +0000

A pump and dump is an accumulation, a manufactured burst of buying, and an exit into that buying, run by the same person in that order. Nothing about the asset changes across the three steps: the price rises because order flow arrived on a book too thin to absorb it, and returns to roughly where it started once the flow stops and the organiser’s supply meets it.

Congress wrote a prohibition on it into Section 9(a)(2) of the Securities Exchange Act in 1934, and the crypto version inherited the mechanics intact. A 1990s microcap boiler room bought a block of an obscure stock, put a floor of salespeople on the phones, and unloaded the block into the retail buying they generated. Permissionless issuance changed three inputs and none of the mechanics: creating the asset costs a few dollars of gas rather than a shell registration, the sales floor is a Telegram channel, and the accumulation happens on a public blockchain where anyone can see it.

Wash Trading

Mon, 01 Jan 0001 00:00:00 +0000

Wash trading is trading with yourself. The same beneficial owner stands on both sides, so no ownership changes and no risk is transferred, but the trade settles and prints like any other. What it manufactures is the record — volume, a last-sale price, a floor, a position in a ranking — rather than a price the market has to sustain.

A pump and dump needs someone else to buy; wash trading needs someone else to read. Its victims are downstream of the record: the bidder who checks a floor price, the listing committee ranking venues by volume, the market maker allocating inventory to the busiest book, and the protocol distributing tokens in proportion to volume traded. Each is making a decision off a number that the person on both sides of the trade produced on purpose. The same self-dealing turns up as one stage inside larger schemes, where it manufactures the price history a pump is then sold into.

Ponzi Scheme

Mon, 01 Jan 0001 00:00:00 +0000

A Ponzi scheme pays returns to existing investors out of deposits from new ones and calls the payments profit from some economic activity. The activity need not exist. What the operator needs is a story about where the yield comes from, deposits arriving faster than withdrawals, and enough friction on redemptions to keep the second condition true. Charles Ponzi’s 1920 original offered 50% in 45 days on arbitrage in international postal reply coupons and ran about eight months.

Initial Coin Offering Fraud

Mon, 01 Jan 0001 00:00:00 +0000

An initial coin offering (ICO) sells a token against a promise. The buyer sends ether to an address, a sale contract mints them a balance in a new ERC-20 token, and what they hold afterwards is a ledger entry plus a document describing what the issuer intends to build. Nothing in the transaction obliges the issuer to build it, to hold the proceeds in escrow, to deliver on a date, or to return anything if they stop.

Exit Scam

Mon, 01 Jan 0001 00:00:00 +0000

An exit scam is an operator that took custody of other people’s assets legitimately, ran a service for a while, and then left with the balance. The service usually worked: withdrawals processed, support answered, fees collected, sometimes for years. What ends it is a decision taken at a moment of the operator’s choosing to stop honouring withdrawals and move the pooled assets somewhere depositors cannot follow.

The history is the distinction. A rug pull is fraudulent at deploy — the mechanism was in the contract before anybody bought. An exchange collapse is insolvency: the assets are gone and the operator is still standing there, filing for bankruptcy. An exit scam is a business that could have continued, whose operator concluded the accumulated float was worth more than the franchise. The three blur at the end, and the same facts often support more than one label, so the fraud taxonomy is a set of tendencies rather than a partition.

Exchange Collapse

Mon, 01 Jan 0001 00:00:00 +0000

A custodial exchange keeps customer coins in wallets it controls and records who owns what in a database it also controls. Nothing on the blockchain distinguishes a coin held for a customer from a coin the exchange is free to lend, trade, or pledge; that distinction lives only in the exchange’s ledger and in the terms of service the customer accepted. A collapse is the moment the wallets and the ledger stop matching and withdrawals are suspended.

Pig Butchering

Mon, 01 Jan 0001 00:00:00 +0000

A pig-butchering scam is a long-form investment fraud that uses a stranger’s friendship as the delivery mechanism. First contact is unsolicited and mundane — a text message addressed to a wrong number, a match on a dating app, a connection request on a professional network. Money goes unmentioned for weeks. Once the relationship is established the operator introduces trading as an aside, walks the target through a small deposit to a platform that is not a market, shows a profit, permits a withdrawal, and then absorbs escalating deposits until the balance on the screen is large and the money behind it is gone. It is the largest crypto fraud category by dollars lost and the least technical: nothing about it requires a contract bug, a compromised key, or a malicious signature.

Giveaway and Impersonation Scams

Mon, 01 Jan 0001 00:00:00 +0000

A giveaway scam offers to send back more than it receives: transfer 1 ETH to the address on screen and 2 ETH comes back, restricted to the next hour, endorsed by someone with a name. The arithmetic is impossible and the offer is broadcast rather than aimed, so the operation is indifferent to how many people work that out. Reaching another hundred thousand accounts costs nothing once the distribution channel is stolen, and a single transfer covers the cost of the campaign.

Wallet Drainers

Mon, 01 Jan 0001 00:00:00 +0000

A wallet drainer is a hosted script that turns a wallet connection into a sequence of signature requests. The victim arrives at an attacker-controlled page and connects; the script reads every asset the address holds across every chain the wallet will talk to, prices them, and asks for the cheapest signature that moves the most valuable one. The person who put the page in front of the victim usually wrote none of it: they rented it, and the developer takes a percentage of everything it takes.

Approval Phishing

Mon, 01 Jan 0001 00:00:00 +0000

Approval phishing takes a victim’s assets with the victim’s own permission, granted in advance. The signature moves nothing; it grants a standing right to move things later, and the transfer that follows is submitted by the attacker, from the attacker’s account, paying the attacker’s gas, usually after the victim has closed the tab.

Everything below is signature semantics: what each prompt authorises, what it costs, and what evidence it leaves. How the victim reached the page that asks, and who built the script doing the asking, is on wallet drainers. Address poisoning takes funds with no signature at all.

Address Poisoning

Mon, 01 Jan 0001 00:00:00 +0000

Address poisoning attacks the habit of copying a recipient address out of a wallet’s own transaction history. The attacker generates an address that matches the victim’s real counterparty in the first and last few characters, arranges for it to appear in the victim’s history, and waits. Nothing is signed under false pretences and no contract misbehaves: the victim’s next payment is authorised, correctly formed, and sent to the wrong place.

SIM Swap

Mon, 01 Jan 0001 00:00:00 +0000

A SIM swap moves a phone number off the subscriber’s device and onto one the attacker controls, using the carrier’s own provisioning tools. Nothing is broken into. The number is a routing entry in a subscriber database, a customer-service representative can rewrite that entry in a few minutes, and every account that treats the number as proof of identity follows it to the new handset.

The phone number became an identity credential without anyone designing it as one: a routing address that picked up a second job delivering one-time codes, and ended up as the recovery path of last resort for email, banking, and exchange accounts. The party holding write access to that credential is a call-centre or retail employee at a company whose relationship with the account holder is a monthly bill. No keys are stolen and no chain is touched: the swap belongs to the social-engineering group rather than to the contract attacks.

Fake Job Offers

Mon, 01 Jan 0001 00:00:00 +0000

Two unrelated frauds run through the same pipeline. One is a targeted intrusion: an engineer at a crypto company is approached by a recruiter, taken through a convincing interview process, and asked to run code as part of it. The code installs a backdoor, and the objective is the employer’s signing keys. The other is a mass-market deposit trap: an advertisement for “crypto task work” or “order boosting” that pays small sums until the worker is required to deposit their own money to unlock the next tier, at which point the money is gone.

Fake Tokens and Spoofed Contracts

Mon, 01 Jan 0001 00:00:00 +0000

A token contract can claim any name and symbol it likes. In ERC-20 those two fields are ordinary strings in contract storage, returned by ordinary view functions, with no registry behind them, no uniqueness constraint, and no authority that checks them against anything. Deploying a second contract that calls itself “USD Coin” with the symbol USDC costs a few dollars of gas and requires nobody’s permission, and a permissionless token factory will produce one from a web form.

Recovery Scams

Mon, 01 Jan 0001 00:00:00 +0000

A recovery scam charges a fee to return money already lost to a different fraud. The approach comes from a “blockchain forensics firm”, a “certified recovery agent”, a law-enforcement liaison, or a class-action administrator, with a case number, a dashboard showing the traced funds, and a request for a retainer, a filing fee, or a tax. Payment produces a further fee rather than a return, and the sequence runs until the target stops paying.

Money Mules

Mon, 01 Jan 0001 00:00:00 +0000

Every fraud eventually needs an account. Converting a victim’s wire, an exchange balance, or a stolen card number into spendable value requires a bank or exchange account that survives know your customer checks, transaction monitoring, and the institution’s own risk scoring. Opening one under a fabricated identity is slow and increasingly hard; renting one from a person who already has it is cheap, fast, and available in bulk.

A money mule is that person: someone whose verified identity absorbs the transaction. The mule receives funds, keeps a percentage, and forwards the rest onward as instructed, usually by a route that puts a second and third identity between the money and its origin. From the receiving institution’s side, the transfer looks like a payment to a real customer whose documents checked out.

Cashing Out

Mon, 01 Jan 0001 00:00:00 +0000

Stolen crypto is a number in a public database. It buys nothing and pays no rent, so every fraud upstream of this page — the rug pull, the pig butchering portfolio, the drained wallet — is unrealised until the balance becomes currency, and that conversion means touching a regulated institution or a person willing to stand in for one. That requirement is the whole enforcement surface, and it is where most crypto prosecutions are built. Several of the best-known laundering techniques now buy time rather than anonymity.