Token Scam

Overview

A token scam is a fraudulent or deceptive scheme that uses a token, sale, airdrop, migration, investment claim, wallet interaction, or fake project to steal value or credentials.

Common methods include counterfeit contracts, honeypots, rug pulls, fake claims, malicious approvals, impersonated teams, guaranteed returns, and false reserve or partnership claims. The security effect of Token Scam depends on the exact contract, credential, policy, and enforcement point. When assessing Token Scam, teams should recognize that a warning label or interface setting is insufficient unless the deployed system actually rejects unauthorized actions and records the decision.

A token can execute correctly on-chain and still be fraudulent because blockchain validity does not verify issuer identity, promises, legality, or economic intent. Threat analysis for Token Scam should identify the actor, protected asset, required permission, attack path, and evidence available after an incident. A practical review of Token Scam must account for the following: Controls may involve contract roles, signatures, transaction simulation, allowlists, revocation, rate limits, or independent approval.

Risks include irreversible transfers, drained wallets, stolen seed phrases, blocked selling, worthless assets, identity theft, and secondary losses through fake recovery services.

Users should verify official domains, contract, issuer, code, liquidity, sellability, authorities, distribution, audits, claims, and should never disclose keys or seed phrases. For Token Scam, high-risk actions need a recovery plan before they are enabled.

Token Scam is closely related to Token Sale and ID Token, yet those concepts should remain separate in custody and accounting.

Token Scam is a deceptive scheme involving a token, issuer, promotion, market, or contract behavior; it is distinct from a legitimate but risky approval permission.