Security
Academy

Crypto scammers stole $3.5 billion in 2025 alone. The good news? Most scams follow predictable patterns. Learn to spot them and you'll avoid 95% of threats.

Common Scam Types

1. Phishing Websites

Scammers create fake versions of popular sites — MetaMask, Uniswap, OpenSea — that look identical to the real thing. When you connect your wallet or enter your seed phrase, they steal everything.

2. Fake Airdrops

You see a token appear in your wallet with a website to "claim" more. The claim transaction actually drains your existing tokens.

3. Romance/Pig Butchering Scams

Scammers build relationships over weeks or months, then introduce a "can't miss" crypto investment. The platform is fake. Your money is gone.

4. Impersonation Scams

Scammers pose as support staff, celebrities, or even family members. They claim there's a problem that requires immediate action.

5. Fake Giveaways

"Send 1 ETH, receive 2 ETH back!" These have existed since 2017 and still work. Celebrity impersonation on YouTube/Twitter with fake live streams.

Protection Checklist

• ✓ Use a hardware wallet for significant holdings
• ✓ Never share your seed phrase — not even once
• ✓ Bookmark all official websites
• ✓ Ignore all unsolicited DMs about crypto
• ✓ Verify every transaction before signing
• ✓ Use wallet guard tools (like EthosiFi Vault)
• ✓ Start with small test transactions

Understanding how wallets work is fundamental to staying safe. Let's break down the technology without the jargon.

What Is a Crypto Wallet?

A crypto wallet doesn't actually "store" your crypto. Your crypto lives on the blockchain. Your wallet stores keys that prove you own it and let you move it.

Public Key → Your Address

Your public key (derived into your wallet address) is like your email address or bank account number. You can share it freely. People use it to send you crypto.

Private Key → Your Password

Your private key is like your password or PIN. It proves you own the funds at your address. Never share it. Anyone with your private key can steal everything.

How Transactions Work

1. You initiate a transaction (send ETH, swap tokens, etc.)
2. Your wallet signs the transaction with your private key (proving you own the funds)
3. The signed transaction is broadcast to the network
4. Validators/miners confirm the transaction
5. The blockchain updates to reflect the new ownership

Wallet Types

Hot Wallets (MetaMask, Rainbow, etc.): Connected to the internet. Convenient for frequent use. Higher risk.

Cold Wallets (Ledger, Trezor): Offline storage. Best for long-term holdings. Lower risk, less convenient.

Smart Contract Wallets (EthosiFi Vault): Programmable security. Social recovery, spending limits, transaction simulation. Best of both worlds.

Your seed phrase (also called recovery phrase or mnemonic) is the single most important piece of information in crypto. Lose it = lose everything forever. Share it = get robbed.

What Is a Seed Phrase?

A seed phrase is 12-24 random words that generate all your private keys. It's a human-readable backup of your wallet.

Golden Rules

• ✓ Never type your seed phrase into any device connected to the internet
• ✓ Never take a photo of your seed phrase
• ✓ Never store it in cloud storage, email, or password managers
• ✓ Never share it with anyone — not support, not family, not anyone
• ✓ Do write it on paper or metal and store it somewhere safe
• ✓ Do consider multiple copies in different secure locations

Storage Options

Paper (minimum): Write clearly with permanent ink. Store in a fireproof safe. Laminate for water protection.

Metal (recommended): Steel plates or capsules survive fire, flood, and time. Products like Cryptosteel or Billfodl.

Shamir Backup (advanced): Split your seed into multiple shares. Require 3 of 5 shares to recover. Distribute to trusted locations.

AI-generated video and audio has become indistinguishable from reality. Scammers are using deepfakes to impersonate CEOs, family members, and support staff. Here's how to protect yourself.

Real Cases

In Q1 2026 alone, deepfake scams stole $8.4 million from crypto companies. Attackers use AI to:

• Clone CEO voices in real-time video calls
• Create fake video messages from "family members" in distress
• Generate support staff impersonations for verification calls

How to Verify Identity

For Business Transactions

• ✓ Establish a verification protocol BEFORE any emergency
• ✓ Use pre-agreed code words or questions
• ✓ Require multi-channel confirmation (video + text + call)
• ✓ Implement time delays for large transactions

For Personal Situations

• ✓ Call back on a known number
• ✓ Ask questions only the real person would know
• ✓ Be suspicious of urgent "emergency" requests
• ✓ Verify through other family members

Deepfake Red Flags

• ⚠ Unusual lighting or shadows on the face
• ⚠ Strange blinking patterns or eye movement
• ⚠ Audio that doesn't quite match lip movement
• ⚠ Unusual requests or urgency
• ⚠ Poor video quality (often intentional to hide artifacts)
• ⚠ Reluctance to continue the call