What To Do If You Fall Victim To A Crypto Scam

An ounce of prevention is worth a pound of cure, and most of your crypto security efforts should take place before an incident occurs. Good safety practices and healthy skepticism will prevent many attack vectors. But sometimes, despite our best efforts, the unthinkable happens. What do you do if you fall victim to a crypto scam?

What to do if you get scammed in crypto varies wildly depending on what happened and how you were compromised. Understanding your exact situation is key to a correct incident response. Jump to the relevant section here:

I Visited A Malicious Website

If you visit a malicious website, you have the same risks as a web2 malicious site (malware, etc.), in addition to crypto-specific risks.

There are a whole host of attack vectors to worry about here. After you deal with any web3 threats, make sure you run detailed anti-virus scans or get an expert to determine if your computer is compromised.

What did you do on the malicious website?

… And Entered My Private Key/Seed Phrase

Your private key or seed phrase is compromised.

You have to take immediate action to move your assets from the compromised wallet(s), or you will lose your assets. See the private key compromise and seed phrase compromise sections.

… And Unlocked Metamask

You may have compromised your Metamask password, leading to private key compromise.

Malicious sites can spoof a Metamask lock screen popup. If you enter your password into the malicious mimic, the attacker can use your password to unlock your Metamask and reveal the private keys for any account. This leads to private key compromise.

Note this only applies to accounts for which Metamask holds the private keys – generated or imported. Hardware wallets connecting through Metamask do not expose their private keys to your computer.

What to do after a Metamask password compromise? Immediately transfer the assets from every account in that Metamask extension to a brand new wallet. Make sure your new wallet has a new, clean seed phrase! It cannot just be another account in that same compromised Metamask profile.

… And Signed a Transaction

You may have sent assets to a scammer, or approved transfer to a malicious address.

Your first priority is figuring out what you signed. If you signed a transfer, your assets are gone, permanently. Sorry to break it to you. If you signed an approval, you may be able to revoke the approval before the attacker steals your bags.

If you signed a message instead of sending a transaction, you could be at risk for attacks on Opensea or other platforms which allow trades to execute against signed offchain messages. In this case, revoke your approvals for these platforms immediately.

… And Downloaded a File

Any crypto activity on your computer is at risk.

If you download files, click links, or engage in other traditionally dangerous activities that can infect your computer with viruses, your security risks are essentially unlimited. Malware can find private keys where they’re stored on your PC, keylog your password, spoof windows, etc.

If this happens, you need to move your assets off that computer (you did write down your seed phrase, right?), professionally wipe the computer, and start over. Or get a new machine for crypto only. Don’t play around with hosting your assets on a compromised machine.

I Sent Tokens To a Scammer

Sorry anon, but if you already sent the tokens, they’re gone. Nothing you can do.

The next best thing to getting your money back is to report the scammer. Any social media accounts used by the attacker can be reported (with evidence). Certain assets like USDT and USDC have centralized bodies that can freeze assets, preventing the scammer from accessing his ill-gotten gains. Freezing is unlikely unless you have very strong proof you were scammed, and it still won’t get your money back.

I Approved a Malicious Address

You need to figure out what approval you performed, then revoke it immediately.

If the services are available, you can use Etherscan token approvals tool or revoke.cash to view and manage your approvals. In some incidents like a high-profile exploit, these services can bog down under the load and become unusable. In that event, you can manually revoke token approvals without Etherscan if you have a little technical savvy.

It is critical that you revoke all approvals to the malicious address as soon as possible! Your funds are at risk until you do so.

Also, don’t miss this key point: even if the attacker already stole your funds, you still have to revoke the approval. Otherwise, if you put any more of that token into your wallet, the approval will still be valid, and that attacker can take those tokens also!

I Signed a Malicious Message

You may have assets at risk on platforms which allow execution against signed offchain messages.

One example of this is Opensea sell orders. If Opensea has approval to transfer a token (which they may already have for legitimate reasons), the only other thing they need is a signed message.

Anyone can present a valid, signed, offchain message from you saying that you’re offering it for sale with X price and Y parameters, and execute that order. If you are tricked into signing a malicious Opensea order, an attacker could arrange a sale to his own address for a 0 price.

Your response here is to revoke approvals for all sites, and withdraw any staked assets that are at risk.

I Shared Screens With a scammer

Your private keys may be compromised.

A common tactic by scammers posing as some kind of support is to have you share your screen, and navigate through your Metamask to expose your private key. If you clicked on “Export Private Key” for any account, that private key is compromised.

If you did compromise a private key, read on to learn how to react. Even if you don’t think you compromised anything, it’s still best to move your assets to a new, safe, uncompromised wallet.

My Private Key Was Compromised

Anyone with your private key can execute any action as if they were you.

There’s no worrying about approvals or anything like that. They have full access to your account, just as if they were you. It does not matter if you had your keys on a hardware wallet. It does not matter if any of your electronic devices are connected to the internet. If someone gets your private keys, they get your coins. End of story.

After any private key compromise, you have to put your assets in a fresh wallet. Using the compromised wallet is extremely unsafe and can result in the immediate loss of anything you put back into it.

If your private key is compromised, your response depends on the state of your wallet. Are your assets already gone, is the hack in progress, or has the attacker laid a trap for you?

… And My Assets Are All Gone

If everything is already gone, there’s no getting it back.

All you can do at this point is mark that address as compromised, remove it from your address book, and never send any of your assets to it again. Don’t forget to burn the wallet in this manner, or you’ll lose it all again when you transfer something into the compromised account.

… And The Hacker Is Actively Transferring Items Out

If you can see the hacker working in real time, you can save some items – but you’re in a race.

Sophisticated hackers will plug your private key into a script that will immediately loot anything that’s not nailed down. By the time you notice one of these attacks it’s probably all over.

Less sophisticated attackers, however, may transfer your assets out manually. In this case, your objective is simple: send all your assets to a safe wallet before the attacker can send them to his.

Start with your most valuable items, and bump up your gas for faster transactions. Metamask “Instant” setting is recommended. Remember the attacker is also prioritizing your most valuable items, so your transactions need to execute quickly.

If your situation is desperate and you have friends you can trust, you can reveal your private key to them and have them help race the hacker to transfer your items out. Five people manually transferring items will beat one person manually transferring. One major NFT collector did this to mitigate his losses when a wallet containing hundreds of valuable NFTs was compromised. Be absolutely sure that you trust anyone you do this with, however, or you’ll be out of the frying pan and into the fire.

… And There Are Valuables Left But No ETH For Gas

This is a trap.

Some attackers will leave valuable items in a compromised wallet, but take all the ETH. Without any gas to pay for transactions, you’re forced to send ETH to your wallet before rescuing your assets. The attackers will watch for your incoming transaction, and transfer the ETH out instantly as soon as it lands.

The end result: They get more ETH out of you, and then when you’ve given up they’ll transfer the bait out too.

Luckily, there is a way around the trap. It requires combining the ETH transfer and the rescue transaction into a single transaction bundle, and submitting that bundle to Flashbots. Flashbots is a protocol of Ethereum miners that allow you to submit bundles of transactions. All the transactions in a bundle will be atomically included in the same block, in your specified order.

By submitting a bundle, you provide the gas and rescue the bait assets in one fell swoop, without allowing the attacker time to respond.

If you’re not technically savvy, you can go to whitehat.flashbots.net and receive assistance with the rescue. Note: they only help with recoveries of > $1,000. If you are code-proficient, you can execute the maneuver yourself using the resources here, and here.

My Seed Phrase Was Compromised

All accounts using that seed phrase is compromised. Move your assets to a totally new wallet.

Quick background: One seed phrase can generate multiple private keys. This is how Metamask allows you to have one seed phrase, but multiple accounts with their own private keys. If you have access to the seed phrase, generating the other accounts with it is a much easier cryptographic task, and it’s only a matter of time before your specific accounts are compromised.

To save your assets, you have to first create a new wallet with a different seed phrase. In an emergency, you can open a fresh Metamask on another computer and create a new wallet. Make sure you’re not just generating an account, but an entirely new seed phrase! Next, generate an account or accounts on the new wallet, and migrate all your assets from the compromised accounts.

What To Do After An Attack Is Over

Secure Your Assets

Make sure no more of your assets are at risk. Did you revoke all malicious approvals? Are there any funds left in an exposed wallet? If your private key or seed phrase was exposed, make sure everything is moved to a new, safe location. Even if you don’t think a particular account was breached, better safe than sorry. Why play with fire?

Do A Post-Mortem

After the dust settles and you’re sure no more of your assets are at risk, it’s time to take a step back and do a post-mortem analysis. There are several important questions to ask yourself.

  • Exactly what happened?
  • What actions did you take that led to the attack?
  • Were there any security measures you could have taken that would have prevented the attack?

Exactly what happened? If you don’t understand what happened, you can’t draw the right conclusions, or protect yourself against future attacks.

What did you do that led to the attack? This question can be as simple as “I clicked on a malicious Google ad instead of bookmarking my DEX”, or it can be an opportunity to dig deeper. A 5 Why analysis or a similar tool can help get to the root cause. Make sure you understand, at least, the proximate root cause, like clicking the phishing link, or entering your seed phrase to win a giveaway.

Would any security measures have prevented the attack? If you had Discord DMs blocked, maybe the convincing giveaway scam wouldn’t have gotten through. If you had a hardware wallet, your private keys wouldn’t have been exposed. Etc.

Improve Your Security

After you understand the issues that led to your loss, implement the security fixes you identified. DeFi Education has an excellent detailed guide, BowTiedBull has more (part 1, part 2, part 3) and here’s some quick best practices.

  • Use a hardware wallet for any account holding more value than you would carry in your pocket
  • Never leave your hardware wallet connected while it’s not in use
  • Use a dedicated computer for crypto use (cheapo Ebay laptops work fine)
  • Always back up your seed phrases in a secure location
  • Make sure your Discord DMs are closed by default
  • Learn how accounts, approvals, and private keys work, so you know what exploits are possible
  • Bookmark your sites so you don’t have to Google to navigate to them.
  • Double check transactions before signing them
  • Don’t sign anything if you don’t know exactly what it does

Make sure to approach everything with a healthy dose of skepticism. Until thoroughly proven otherwise: DMs are scams. Giveaways are scams. Free stuff is a scam. No one legitimate will ever ask for your seed phrase, private keys, or password. That isn’t the founder messaging you.

Report The Scammer

While a long shot, you can report criminal activity to the authorities. US-based users can submit a report to the Internet Crime Complaint Center. Be aware that this will link your wallet to your identity, so make sure you’ve paid your taxes and such.

If you want to report, be prepared to provide all the information you have regarding the scam, the scammer, and the relevant transactions.

The odds of ever seeing your money again are pretty low. But you may help prevent others from falling prey to the same attacker.

Keep an Eye On Your Mental Health

Finally, on a serious note: if you lose money to a scam, don’t beat yourself up about it. Money can be re-earned. Even if you lost everything, you can come back smarter and stronger. If you find yourself struggling with depression or suicidal thoughts, please seek help. No amount of money is worth your life.

It can be tough to admit you were victimized, but don’t suffer in silence. Your friends and family can’t support you and look out for you if they don’t know what you’re going through.

Stay safe out there, anon.

Photo of author

Written By BowTiedPickle

Anonymous cartoon pickle inspired by BowTiedBull. Degen chemical engineer, moonlighting as a Solidity developer.

Disclosure

This article may contain links to third-party websites or other content for information purposes. BowTiedIsland may receive a commission at no cost to you if you purchase a product after clicking one of these links. The Third-Party Sites are not under the control of BowTiedIsland, and BowTiedIsland is not responsible for the content of any Third-Party Site. All information contained herein is the opinion of the writer and does not constitute financial advice. We aim to act as a neutral third party and aid in your research and analysis.


The Jungle


Crypto, Investing, and E-Commerce with BowTied Bull

The future is internet based, therefore we have a triangle based approach with crypto, e-commerce business making and Investing in traditional assets

The Culture War with BowTiedRanger

Whether you’re a political junkie or just interested in current events. 

You’ve come to the right place for analysis of the most relevant current events and political issues.

Fitness With BowTiedOx

BowTiedOx provides you a place to find all of his latest programs and guides.

Weekly newsletters that cover fitness, health, and mindset, all grounded in the fundamentals of physiology.

Media Production with BowTied Turkey and BowTied Tamarin

Video is no longer optional.

Don’t get left behind.

Your brand deserves professional videos to engage your audience.

Art & Graphic Design with BowTied Patriot

BowTied Patriot is a graphic artist who specializes in photography, mixed medium custom artwork, and NFT creation.

Join BowTiedPatriot as he dives into making Art in Web3.0 and The Metaverse.

Cooking with BowTiedOctopod

Learn secrets from a fine dining chef for maximum flavor and time-saving efficiency

Newsletters on Ingredients, Techniques and Flavor hacks that will have you eating better. We will never eat bugs!

Meme Warfare with DgenFren

Increase your online engagement, organically influence narratives, and build your online persona by using marketing that your target audience actually wants: memes.

Learn How to Sell with BowTiedSalesGuy

Sales is one of the most transferrable life skills, yet few know how to actually sell.

Traditional sales tactics don’t cut it in today’s hyper competitive world.

Learn the secrets from a Chad Salesman and change your Life forever.

Ecommerce with BowTiedOpossum

Learn the skills to start and build your first online business.

Want to build a business that travels with you?

Learn from an industry veteran that has worked on and with brands you already know.