Across a large sample of crypto scam reports, a small number of warning signs show up again and again, well before the project collapses or the AI-generated founder disappears. With AI-driven scams, deepfake identities, and increasingly complex DeFi exploits now common, the honest, low-effort projects and the sophisticated traps can look identical on the surface. These five checks are what actually separate them.
Is the Profit Model Transparent and Realistic?
Mining, lending, staking, and yield farming are all legitimate ways to earn a return in crypto. What isn't legitimate is a fixed, guaranteed yield with no clear explanation of where it comes from, a pattern increasingly dressed up in 2026 with 'real-world asset' or 'liquid restaking' language. A legitimate CeFi platform states plainly what it does with customer funds and publishes its fee schedule. A legitimate DeFi platform publishes its token allocation, links a whitepaper, and keeps its smart contract source open. Closed-source code and an undisclosed business model are both disqualifying on their own.
Is the Project Actually Sustainable?
Even a genuine project needs a business model that scales. A lot of current 'AI-integrated' tokens amount to a basic smart contract with an AI narrative attached and no real technological substance behind it. A token built for a narrow niche, or one riding a buzzword without a real use case, isn't a long-term hold regardless of how it performs early on.
Is There Independent, Ongoing Verification?
Be especially cautious of any platform offering to trade or invest funds on a user's behalf, in the US, that requires registration as a hedge fund or brokerage under FINRA or the SEC, and scammers routinely clone the professional profiles of real advisors. Verify credentials independently through FINRA BrokerCheck or a direct LinkedIn search, not through links the platform provides itself.
A single audit is no longer sufficient either, several major hacks in recent years hit protocols that had already passed one. Look instead for ongoing on-chain auditing, active bug bounties, and a transparent multi-sig setup with timelocks. Any contract with a hidden function to mint unlimited tokens or block withdrawals is disqualifying regardless of what else checks out.
Can You Independently Verify the Token or Platform?
- Access services only through official, bookmarked URLs, never through a support link surfaced by a search engine, since scammers buy ads that mimic legitimate platforms.
- Watch for address poisoning, zero-value tokens sent from an address that visually resembles yours, designed to get copy-pasted into your next transaction.
- If buying a token on a DEX, confirm the contract address matches exactly what is listed on an official block explorer or aggregator, character for character.
Is the Team Reputable and Verifiable?
Some legitimately successful DeFi projects are anonymous, but a CeFi platform withholding its management team is a real red flag. AI now makes it straightforward to generate a convincing fake LinkedIn profile or a deepfake 'Ask Me Anything' video, so a polished team page isn't proof of anything on its own. Check for verifiable on-chain technical experience rather than counting followers, a large social following can be purchased for a few dollars and says nothing about legitimacy.
No single sign here is conclusive by itself. Two or three showing up together on the same project is a strong reason to slow down and dig further before committing any meaningful amount.
The Pattern Across Victim Reports
The fraud reports we've reviewed share a consistent shape: unrealistic guaranteed returns, high-pressure outreach, sales pitches delivered through direct messages, AI-generated team profiles, and an audit history that stopped after launch. Bot networks pushing tokens across X, Telegram, Instagram, and Farcaster are now routine, and a recommendation from a friend's account isn't reliable either, account takeovers used to push scams are common enough that social proof from a compromised account looks identical to a genuine one.
None of these checks require deep technical skill, and most take only a few minutes. Run them before committing funds, not after something already feels wrong.