Spotting Scams and Staying Protected
Why this lesson makes you stronger
In the crypto world, you are your own bank — which means you're also in control of your own protection. Scammers rely on people not knowing what a scheme looks like. Once you know the signs, a scam becomes transparent: you'll spot it before it even gets a chance to make an offer. This lesson is those signs.
1. Phishing websites (deceptive copies) — fake Orca, Jupiter, Aave
Scammers build a visually identical copy of the real website. The only difference is the URL. The good news: the URL is the one thing they can't fake, which is exactly why you check it.
| Real website | Fake example | How to tell them apart |
|---|---|---|
| jup.ag | jup-ag.com, jupiter-swap.io | Check the domain VERY carefully |
| orca.so | orca-so.com, orca-swap.app | Only the .so ending |
| app.aave.com | aave-app.com, aave-finance.io | Only app.aave.com |
| kamino.finance | kamino-finance.app | Check official sources |
| deribit.com | deribit-exchange.com | Only deribit.com |
Save the real URLs as bookmarks
Go to the real website (from official sources) and save it as a browser bookmark. Use ONLY the bookmark.
Never click links from Telegram/Discord
Even if a link looks correct, it can be disguised. Always use your bookmark or type the URL by hand.
Check the domain itself, not the HTTPS padlock
The padlock icon (HTTPS) doesn't mean a site is real — phishing sites carry valid certificates too. Check the domain spelling in the address bar letter by letter.
Once these three steps become a habit, a fake site will jump out at you on its own — without even thinking about it.
2. Fake airdrops in your wallet
An airdrop is a free distribution of tokens that a project sometimes uses to reward its users. Scammers use this as bait — which is exactly why there's a simple, foolproof response.
Your response: ignoring it = full protection
Scammers send fake tokens into your wallet hoping you'll try to sell them. But as long as you don't touch them, they can't do anything — the wallet itself stays safe. Ignoring it here isn't "doing nothing," it's the strongest defense there is.
How it works:
- An unfamiliar token appears in your wallet (e.g. "FREE-AIRDROP")
- The token's name or description lures you to "claim" it or sell it on a special website
- That website asks you to sign a transaction or grant an approval (permission to use your tokens)
- Once you sign, the scammer drains whichever real tokens they've just been granted access to
What to do: IGNORE IT. Don't click it. Don't try to sell it. Simply pay it no attention.
3. Malicious approvals
When you connect to a DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → protocol, it asks for permission to use your tokens (an approval). That's normal. The difference you control: malicious protocols ask for an unlimited approval — permission to take ALL your tokens at any time. You can always choose an exact amount instead.
How to protect yourself:
- Only connect to well-known protocols (KaminoKaminoSolana lending protocol. In our strategy: SOL collateral to a USDC loan.Read the lesson →, OrcaOrcaA Solana DEX with concentrated liquidity (Whirlpool). The basis of our LP strategy on the Solana network.Read the lesson →, AaveAaveEthereum lending protocol (v3). In our strategy: ETH collateral to a USDC loan.Read the lesson →, UniswapUniswapAn Ethereum concentrated-liquidity protocol (V3/V4). Its Solana counterpart is Orca.Read the lesson →, MeteoraMeteoraA Solana DLMM (bin-based) liquidity protocol. An alternative to Orca, with dynamic fees.Read the lesson →, DeribitDeribitA crypto options exchange. In our strategy this is where we buy put protection and sell covered calls.)
- Regularly check your approvals (revoke.cash ETH, Solscan SOL)
- More on this in the lesson on token approvals and revoking
4. Discord and Telegram scams
The golden rule that alone kills most schemes
A real admin NEVER messages you first in private. The moment someone messages you first claiming to be "support" — you already know the answer: it's a scam. This one filter rejects almost every conversational scheme.
Most common schemes:
- An "admin" messages first: "I see you have a problem, let me help" → hands you a fake link
- Fake giveaway: "Send 1 SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson →, get 10 back" → you never get anything
- Fake announcement: "New airdrop! Join through this link" → phishing
- Impersonating friends: copies a profile's name and avatar
Protection:
- Turn off private messages from strangers (Discord: Privacy Settings)
- Never take part in "send X, get Y back" promotions
- Check official channels, not links from messages
5. Fake tokens
Scammers create tokens with the same name as real ones:
How to tell them apart:
- Check the contract address against official documentation
- Use Jupiter — it only shows verified tokens SOL
- Etherscan/Solscan show whether a token is "verified"
6. Rug pull warning signs
A rug pull (literally "pulling the rug out from under you") is when a project's developers withdraw all the liquidity and disappear. The token price goes to $0. You don't have to guess which project will do this — the warning signs are visible in advance.
Red flags — your checklist
These signs are visible BEFORE you invest. Spot even one, and you simply walk away — the risk never reaches you:
| Sign | Why it's dangerous |
|---|---|
| Anonymous team | Can't be held accountable |
| No audit report | The code may have a backdoor |
| APYAPYAnnual Percentage Yield — the annual interest rate WITH compounding. Always higher than the equivalent APR.Read the lesson → > 1000% | Economically impossible to sustain |
| Project younger than 1 week | Not enough track record |
| Only Telegram, no documentation | Serious projects have docs |
| Liquidity not locked | Developers can withdraw at any time |
Our strategy only uses vetted protocols:
- AaveAaveEthereum lending protocol (v3). In our strategy: ETH collateral to a USDC loan.Read the lesson → — since 2020, $10B+ TVLTVLTotal Value Locked — the total value deposited in a DeFi protocol. An indicator of how popular a protocol is.
[✅ AUDITED] - UniswapUniswapAn Ethereum concentrated-liquidity protocol (V3/V4). Its Solana counterpart is Orca.Read the lesson → — $1T+ in trading volume history
[✅ AUDITED] - OrcaOrcaA Solana DEX with concentrated liquidity (Whirlpool). The basis of our LP strategy on the Solana network.Read the lesson → — the standard of the SolanaSolanaA fast blockchain (under 1s, gas under $0.01). Home to the Kamino, Orca and Meteora ecosystem.Read the lesson → ecosystem
[✅ AUDITED] - KaminoKaminoSolana lending protocol. In our strategy: SOL collateral to a USDC loan.Read the lesson → — actively audited, funded
[⚠️ NEWER] - Deribit — a regulated exchange
[⚠️ CEX]
7. Checking a smart contract
Solana SOL
Go to Solscan:
- Enter the token or program address
- Check: is there a Verified badge
- Check: is the code open source
- Check: TVLTVLTotal Value Locked — the total value deposited in a DeFi protocol. An indicator of how popular a protocol is. and user count
Ethereum ETH
Go to Etherscan:
- Enter the contract address
- Check: the "Contract" tab → is the code verified
- Check: is there an audit report (usually on the project's website)
- Use DeFi Safety for ratings
Protection checklist
Print it out and keep it by your computer
This checklist can save your money.
| # | Rule | Am I doing this? |
|---|---|---|
| 1 | I only use bookmarked URLs | ☐ |
| 2 | I never click links from DMs | ☐ |
| 3 | I ignore unknown tokens in my wallet | ☐ |
| 4 | Check my approvals every week | ☐ |
| 5 | I only connect to known protocols | ☐ |
| 6 | First transfer = a test | ☐ |
| 7 | Seed phrase only on paper | ☐ |
| 8 | DMs from strangers turned off | ☐ |
| 9 | Check the contract address before swapping | ☐ |
| 10 | Never "send X, get Y" | ☐ |
Scams specific to Lithuania
These scam patterns are especially common in Lithuania — but the underlying tricks are universal, only the local brands and channels change. If you're elsewhere, watch for the same patterns dressed up in your own country's banks, platforms, and language. Each one below has a single clear tell you can use to recognize it instantly.
Facebook "investment groups"
What it looks like:
- A group named "Investing in Lithuania 2025" or "Crypto Profit LT"
- "Members" post screenshots showing huge profits
- The admin offers "mentoring" or "a bot that trades for you"
- Asks you to transfer EUR to a "broker" (actually a scammer's account)
The reality: 100% a scam. No Facebook group can guarantee profit.
Protection: Ignore all Facebook crypto "investment" groups. Real investors never offer profit to strangers online.
Fake Revolut / Binance / Nexo support
What it looks like:
- An SMS or email: "Your Revolut account has been blocked due to suspicious activity"
- The link looks real:
revolut-security.comorbinance-verify.eu - Asks you to log in and "verify your identity"
The reality: The link leads to a phishing page. Enter your details and you lose your account.
Protection:
- Revolut/Binance/NexoNexoA centralized exchange (CEX) for buying crypto with euros. Custodial — the exchange holds the keys.Read the lesson → NEVER send links saying "your account is blocked"
- Always go directly to the official app, not through a link
- If in doubt, call the official number from within the app
SMS about "profitable trading"
What it looks like:
- SMS: "Earn €500/day with a crypto bot! Sign up: [link]"
- Sometimes uses the names of well-known people (Lithuanian business figures, politicians)
The reality: This is a "binary options"/CFD scam. The money goes to the scammers.
Protection: Block the number. No "bot" guarantees profit.
Telegram "pump" groups
What it looks like:
- A Telegram channel "VIP Crypto Signals LT" with 10,000+ members
- "Today we're buying TOKEN_X — +500% in 24h!"
- Urges you to buy a specific token "before everyone else" (but they've already bought in cheap)
The reality: This is a "pump and dump" scheme. The organizers sell once members have bought in → the price collapses → you're left holding the loss.
Protection: If someone actually knew which token was about to "moon," why would they share it with you? Because they need you as a buyer.
The golden rule that cuts through everything else
If anyone promises guaranteed profit from crypto — it's always a scam. No exceptions. Remember this one rule and you'll recognize the scheme before digging any deeper: DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → offers opportunities, but it never guarantees outcomes. Real investors know this and never promise otherwise.
Bringing the risk into one place
Every danger in this lesson shares one thing in common: each has a simple response that you control. Here they are in one place — not a list of fears, but a list of levers:
- Fake website (phishing) → only ever go through your own bookmarks, the URL is the one thing scammers can't fake
- Fake token in your wallet → ignore it, left untouched it can't do anything
- Unlimited approval → choose an exact amount, revoke old ones periodically via revoke.cash / Solscan
- An "admin" messages first → real admins never message first, a message from "support" = automatic scam
- Guaranteed profit → always a scam, one rule cuts through Facebook groups, SMS bots, and pump channels
Every risk has a solution. You're not afraid of them — you know how to shut each one down.
The best way to learn to spot scammers is to find one yourself, before they find you. It takes about 10 minutes — you won't need to click or send anything.
Don't click any suspicious links — the goal of this task is to recognize, not to test. If you click one by accident: don't enter anything, don't confirm anything, and close the page.
This is learning, not investing — use only small amounts you treat as tuition.
You just built your own protection system — bookmarks, DMs turned off, a personal rule — and spotted scammers before they could even get close. Most people only start learning this after they've already been burned.