Fraud patterns

Irreversible transfers, pseudonymous recipients, global reach and a population of new participants make this an unusually attractive environment for fraud. The schemes themselves are almost entirely conventional.

The recurring forms

Rug pull. A token launches, liquidity is provided, price rises, and the creators withdraw the liquidity and the proceeds. Often the contract itself permits this, visibly, to anyone who reads it.
Pig butchering. A long-running relationship scam. Contact begins socially or romantically, trust is built over weeks or months, and the victim is introduced to an investment platform that shows growing balances and permits small withdrawals — until a large deposit is made. The platform is fictitious throughout. This is now among the largest categories by value and it is run by organised operations.
Fake support. Someone helpful appears when you post a problem publicly, and asks you to "validate" your wallet or enter your seed phrase into a recovery tool.
Approval draining. A site asks you to sign a transaction granting a contract permission to move your tokens. The theft occurs later. Nothing happens at the moment of signing, which is why it works.
Address poisoning. An attacker sends a tiny transaction from an address resembling one you use, so that copying from your history sends funds to them.
Fake applications and extensions. Counterfeit wallets in app stores, capturing the phrase at setup.
Recovery scams. Targeting people who have already been defrauded, promising to retrieve the lost funds for a fee. A second theft from the same victim.

The signals that generalise

Interpretation

Guaranteed returns are the one reliable tell
Every genuine investment can lose money, and anyone offering a guaranteed return either does not understand what they are selling or is lying. This single filter catches the large majority of schemes, and it has done so for a century in every asset class. The vocabulary changes; the promise does not.

Urgency. Limited time, closing soon, price about to rise. Pressure exists to prevent checking.
Unsolicited contact. Nobody profitable needs to find you.
Returns paid from new deposits. Where the yield comes from should be explainable in one sentence. If it is not, assume it comes from the next depositor.
Withdrawals that require a payment first. A fee, a tax, an unlock charge. Always fraud, without exception.
Celebrity endorsement, which is routinely fabricated and now trivially faked in video.

Checks that take two minutes

Can you find the contract's source code, verified and readable, at the address?
Is liquidity locked, and for how long? Unlocked liquidity can be removed at any moment.
Who holds the supply? A handful of addresses holding most of it is a rug waiting to happen. See tokenomics and on-chain analysis.
Does the team exist outside the project's own website?
Search the name with the word "scam" before, not after.

If it has already happened

Move any remaining assets to a new wallet created on a device you trust, revoke outstanding token approvals, and report the incident to your national fraud reporting body — theft data does contribute to investigations. Then be extremely sceptical of anyone who contacts you offering recovery, because that contact is a near-certain second attempt.

The uncomfortable summary: transfers here are final by design, which is the property that makes the system useful and the property that makes fraud profitable. Caution before sending is the only protection that exists, because there is nothing after.

Education, not advice. These lessons explain how things work. They do not tell you what to buy, and Wealth Signal does not publish recommendations. Full disclaimer.