Educational content, not investment advice. Crypto-asset values fluctuate.

Modulis 2 · Security and practice
2/9

Spotting Scams and Staying Protected

Video · 2 min.
Spotting scams

Three scammers write to Ruth in a single day: a fake 'administrator', a look-alike website (jup-ag.com instead of jup.ag), and 'send 1, get 2'. Plus the fake airdrop that asks for your seed phrase and the unknown token in your wallet. A scam is a fishing rod with bait: learn to see the hook.

Narrated, with light music
The full lesson with numbers and rules is below.
Watch on YouTube
Why this lesson makes you stronger

In the crypto world, you are your own bank — which means you're also in control of your own protection. Scammers rely on people not knowing what a scheme looks like. Once you know the signs, a scam becomes transparent: you'll spot it before it even gets a chance to make an offer. This lesson is those signs.

1. Phishing websites (deceptive copies) — fake Orca, Jupiter, Aave

Scammers build a visually identical copy of the real website. The only difference is the URL. The good news: the URL is the one thing they can't fake, which is exactly why you check it.

Real websiteFake exampleHow to tell them apart
jup.agjup-ag.com, jupiter-swap.ioCheck the domain VERY carefully
orca.soorca-so.com, orca-swap.appOnly the .so ending
app.aave.comaave-app.com, aave-finance.ioOnly app.aave.com
kamino.financekamino-finance.appCheck official sources
deribit.comderibit-exchange.comOnly deribit.com

  1. Save the real URLs as bookmarks

    Go to the real website (from official sources) and save it as a browser bookmark. Use ONLY the bookmark.

  2. Never click links from Telegram/Discord

    Even if a link looks correct, it can be disguised. Always use your bookmark or type the URL by hand.

  3. Check the domain itself, not the HTTPS padlock

    The padlock icon (HTTPS) doesn't mean a site is real — phishing sites carry valid certificates too. Check the domain spelling in the address bar letter by letter.

Once these three steps become a habit, a fake site will jump out at you on its own — without even thinking about it.

2. Fake airdrops in your wallet

An airdrop is a free distribution of tokens that a project sometimes uses to reward its users. Scammers use this as bait — which is exactly why there's a simple, foolproof response.

Your response: ignoring it = full protection

Scammers send fake tokens into your wallet hoping you'll try to sell them. But as long as you don't touch them, they can't do anything — the wallet itself stays safe. Ignoring it here isn't "doing nothing," it's the strongest defense there is.

How it works:

  1. An unfamiliar token appears in your wallet (e.g. "FREE-AIRDROP")
  2. The token's name or description lures you to "claim" it or sell it on a special website
  3. That website asks you to sign a transaction or grant an approval (permission to use your tokens)
  4. Once you sign, the scammer drains whichever real tokens they've just been granted access to

What to do: IGNORE IT. Don't click it. Don't try to sell it. Simply pay it no attention.

3. Malicious approvals

When you connect to a DeFi protocol, it asks for permission to use your tokens (an approval). That's normal. The difference you control: malicious protocols ask for an unlimited approval — permission to take ALL your tokens at any time. You can always choose an exact amount instead.

Approval typeRiskExample
Exact amount (e.g. 100 USDC)LowAave, Orca, Uniswap
Unlimited approvalHighUnknown websites

How to protect yourself:

4. A signature with no gas — the most dangerous button

So far you've been learning to be careful with transactions. But in 2026 the most common way to lose tokens is not a transaction — it's a signature that costs nothing.

When your wallet asks you to confirm a transaction, you see a gas fee, and that naturally slows you down. A Permit or Permit2 signature (Ethereum) costs no gas, the dialog looks harmless ("Sign message"), and most people click without thinking. That signature grants the right to take your tokens — exactly like an approval, except free and with no on-chain record you might notice.

One rule that closes this vector

Any "Sign" or "Signature request" dialog on a site you reached any way other than your own bookmark gets rejected. No deliberation. If you really do need to sign, close the page, open the protocol through your bookmark, and repeat the action there.

What to read in the signature dialog: look for the words Permit, Permit2, spender, allowance, deadline. If the spender address is unfamiliar or the deadline is very far out — reject it.

Why this matters in numbers: according to Scam Sniffer, in January 2026 phishing hit 4,741 users for $6.27M in losses (+207% month over month), and the leading vector was exactly these Permit/Permit2 signatures — not broken code.

5. When seeing is no longer believing

The old tells — bad translation, clumsy grammar, poor graphics — stopped working in 2026. Scammers use AI: the text is clean, and a video may show a face you recognise. TRM Labs reports that losses from deepfake crypto campaigns in 2026 have already exceeded the entire 2025 total by 263%.

The new rule: judge not how it looks, but what it asks for

Polish is no longer a signal. The request is the signal. Whether it's a slick video with a familiar face or a perfectly written message — if it asks for your seed phrase, a signature, a transfer "for verification", or to move the conversation off-platform, the answer is the same.

A practical check: if a "well-known person" or an acquaintance offers you something over a video call or a message, reach them through a separate channel you already know and ask. A real person will wait; a scammer will rush you.

6. Discord and Telegram scams

The golden rule that alone kills most schemes

A real admin NEVER messages you first in private. The moment someone messages you first claiming to be "support" — you already know the answer: it's a scam. This one filter rejects almost every conversational scheme.

Most common schemes:

Protection:

7. Fake tokens

Scammers create tokens with the same name as real ones:

Real tokenFake tokens
USDC (Circle)USDCoin, USD-C, USDC2
SOL (Solana)SOLANA, $SOL-NEW
JUP (Jupiter)Fake JUP with a different contract address

How to tell them apart:

Before buying an unfamiliar token:

  1. Match the contract address against the project's official source (its site, its docs) — not against whatever search results show you
  2. Check it on RugCheck SOL
  3. Watch the fee: on tokens younger than 24 hours Jupiter charges 0.5%, versus 0.02% on the SOL–stablecoin pair. The fee size is itself a risk signal — the protocol treats such tokens as a different category (rates as of 2026-09; they change — check jup.ag)

8. Rug pull warning signs

A rug pull (literally "pulling the rug out from under you") is when a project's developers withdraw all the liquidity and disappear. The token price goes to $0. You don't have to guess which project will do this — the warning signs are visible in advance.

Red flags — your checklist

These signs are visible BEFORE you invest. Spot even one, and you simply walk away — the risk never reaches you:

SignWhy it's dangerous
Anonymous teamCan't be held accountable
No audit reportThe code may have a backdoor
APY > 1000%Economically impossible to sustain
Project younger than 1 weekNot enough track record
Only Telegram, no documentationSerious projects have docs
Liquidity not lockedDevelopers can withdraw at any time

Our strategy only uses vetted protocols:

Deribit: "large" does not mean "EU-regulated"

Deribit holds neither a MiCA nor a MiFID II authorisation in the European Union. An EU retail client becomes a customer of DRB Panama Inc., so EU investor protections — compensation schemes, the MiFID suitability test, dispute resolution — do not apply. Treat this as counterparty and regulatory risk, not as "regulated exchange" status. EU-regulated alternatives for options: OKX Europe (Malta), Crypto.com (Cyprus).

9. Checking a smart contract

Solana SOL

Go to Solscan:

Ethereum ETH

Go to Etherscan:

Protection checklist

Print it out and keep it by your computer

This checklist can save your money.

#RuleAm I doing this?
1I only use bookmarked URLs☐
2I never click links from DMs☐
3I ignore unknown tokens in my wallet☐
4Check my approvals every week☐
5I only connect to known protocols☐
6First transfer = a test☐
7Seed phrase only on paper☐
8DMs from strangers turned off☐
9Check the contract address before swapping☐
10Never "send X, get Y"☐

Scams specific to Lithuania

These scam patterns are especially common in Lithuania — but the underlying tricks are universal, only the local brands and channels change. If you're elsewhere, watch for the same patterns dressed up in your own country's banks, platforms, and language. Each one below has a single clear tell you can use to recognize it instantly.

Facebook "investment groups"

What it looks like:

The reality: 100% a scam. No Facebook group can guarantee profit.

Protection: Ignore all Facebook crypto "investment" groups. Real investors never offer profit to strangers online.

Fake Revolut / Binance / Nexo support

What it looks like:

The reality: The link leads to a phishing page. Enter your details and you lose your account.

Protection:

SMS about "profitable trading"

What it looks like:

The reality: This is a "binary options"/CFD scam. The money goes to the scammers.

Protection: Block the number. No "bot" guarantees profit.

Telegram "pump" groups

What it looks like:

The reality: This is a "pump and dump" scheme. The organizers sell once members have bought in → the price collapses → you're left holding the loss.

Protection: If someone actually knew which token was about to "moon," why would they share it with you? Because they need you as a buyer.

The golden rule that cuts through everything else

If anyone promises guaranteed profit from crypto — it's always a scam. No exceptions. Remember this one rule and you'll recognize the scheme before digging any deeper: DeFi offers opportunities, but it never guarantees outcomes. Real investors know this and never promise otherwise.

Bringing the risk into one place

Every danger in this lesson shares one thing in common: each has a simple response that you control. Here they are in one place — not a list of fears, but a list of levers:

  • Fake website (phishing) → only ever go through your own bookmarks, the URL is the one thing scammers can't fake
  • Fake token in your wallet → ignore it, left untouched it can't do anything
  • Unlimited approval → choose an exact amount, revoke old ones periodically via revoke.cash / Solscan
  • A gas-free signature (Permit/Permit2) → always reject a "Sign" dialog on a site you didn't reach through your own bookmark — a free signature takes tokens just as an approval does
  • Polished AI content or a deepfake → judge what it asks for, not how it looks; verify any real person through a channel they already know
  • An "admin" messages first → real admins never message first, a message from "support" = automatic scam
  • Guaranteed profit → always a scam, one rule cuts through Facebook groups, SMS bots, and pump channels

Every risk has a solution. You're not afraid of them — you know how to shut each one down.

Quick check
An unrecognized token called FREE-AIRDROP shows up in your wallet. What should you do?
Practice task
0 / 5
Scam hunt — find a scammer in a safe environment

The best way to learn to spot scammers is to find one yourself, before they find you. It takes about 10 minutes — you won't need to click or send anything.

Don't click any suspicious links — the goal of this task is to recognize, not to test. If you click one by accident: don't enter anything, don't confirm anything, and close the page.

This is learning, not investing — use only small amounts you treat as tuition.

You just built your own protection system — bookmarks, DMs turned off, a personal rule — and spotted scammers before they could even get close. Most people only start learning this after they've already been burned.

Wallet security and seed phrasesDeFi risks
Mark as read

Support

Free material is easy to put off

Something practice teaches: when you paid nothing to learn, it is easy to postpone learning indefinitely. If these lessons actually gave you something — saved you a mistake, or explained what nobody else did — you can pay whatever you think they were worth.

This is not a price, a subscription, or a fee for access. The amount is yours to choose, and paying nothing is entirely fine.

Solana address

CUj6wYQLSBxidzm7Lqtkxbw2d8Sv2H2tbJELyAjR756M

Solana network only

Send SOL or SPL tokens (e.g. USDC) only on the Solana network. Sending from an exchange over a different network loses the funds permanently — nobody can recover them.

What you get for it

Nothing extra, and that is deliberate. Every lesson, all three difficulty levels and every calculator stay free and sign-up-free, with or without a donation. There is no gated section, no share of profits, no future token and no claim on anything.

Where the money goes

A donation becomes my own money. I use it to keep the site running and to fund a public demonstration position on a lending protocol — real money, so the lessons have something to show instead of only theory. I publish the results, losses included, publicly and free for everyone. It is my position and my risk, not a pooled fund.

This is a gift for content already received, not an investment and not a payment for a service. Non-refundable. Educational content, not an investment recommendation.