Crypto impersonation scams and how criminals exploit trusted brands

A phone call from a cryptocurrency exchange's security team. A text promising free crypto. An urgent warning that someone is trying to access your wallet.

They may look like very different approaches, but investigators and regulators are increasingly drawing attention to the same problem: scammers are borrowing the names and authority of cryptocurrency exchanges, wallet providers and financial regulators to convince people to hand over access to their digital assets.

Key takeaways

• Crypto impersonation scams can take many forms. Criminals may pose as exchanges, wallet providers, regulators, investment experts or customer support representatives to gain victims' trust.
• Customer support scams rely heavily on urgency. Unexpected warnings about account problems, unauthorized transactions or wallet security can be designed to make victims act before verifying the message.
• Platform changes can create opportunities for scammers. New coin listings, delistings, service updates and other announcements can give criminals plausible stories for phishing emails, texts, fake support calls and fraudulent websites.
• Crypto remains highly attractive to cybercriminals. Where there is money, investor interest and hype, scams follow, particularly when criminals can exploit fear of missing out or confusion surrounding legitimate announcements.
• Never share a wallet recovery or seed phrase. Legitimate exchanges and hardware wallet providers will not need it to "secure" an account or protect your funds.
• Verify before you act. Don't rely on links, phone numbers or contact details provided in unexpected messages. Go directly to the exchange, wallet provider or regulator's official website or app.

A recent investigation published by Foresight News on Binance Square offers a closer look at these crypto scam operations. The report examines the mechanics of customer support impersonation scams and the criminals behind them.

The investigation centers on information published by blockchain investigator ZachXBT on Aug. 10 about an alleged US-based scammer, who, according to the researcher, allegedly participated in a fraud operation that stole at least $5 million in cryptocurrency by impersonating customer support representatives from exchanges and hardware wallet companies.

How fake crypto customer support scams work

According to the investigation, scammers contact cryptocurrency holders while pretending to work for an exchange or wallet provider. Victims may be told that suspicious activity has been detected on their accounts and that immediate action is needed to protect their funds.

Scammers can ask victims to verify account information, disclose credentials or seed phrases, or transfer cryptocurrency to a supposedly secure wallet. Once victims comply, their assets can be moved almost immediately.

In one case detailed in the report, a victim who had received a forged BitcoinIRA phishing email was directed toward a fake customer-support number. Around $1.2 million in Bitcoin and Ethereum held in a Trezor wallet was transferred to addresses linked to the incident.

Another victim reportedly lost $500,000 in Bitcoin from a Coinbase account through a similar technique.

The report also points to previous cases involving attackers impersonating Coinbase customer support and creating spoofed exchange websites to guide victims through fraudulent transactions.

The common ingredient is trust. Attackers don't need to break into a cryptocurrency exchange if they can persuade the owner of the assets to give them what they need.

Crypto impersonation scams surged in 2025

The problem extends well beyond individual cases.

Chainalysis estimates that cryptocurrency scams and fraud stole around $17 billion globally in 2025. Particularly notable was the growth of impersonation scams, which surged by more than 1,400% from the previous year.

The average scam payment also climbed from $782 in 2024 to $2,764 in 2025, an increase of 253%.

Chainalysis says scam operations are becoming increasingly industrialized, combining social engineering with phishing services, AI-generated content and sophisticated money-laundering networks.

Meanwhile….New Zealand regulator warns about fake Binance texts

New Zealand's Financial Markets Authority (FMA) has recently warned about text messages pretending to come from Binance.

According to the regulator, the messages offer recipients free cryptocurrency or a ticket prize and claim that Binance is an "FMA-approved academy."

That claim is false.

The FMA says it does not endorse or approve trading academies or cryptocurrency education providers, meaning claims that such organizations or programs are "FMA-approved" should be treated as fraudulent.

Where there's investor interest, scammers follow

Cryptocurrency is highly coveted by cybercriminals, and fraudsters have consistently followed the money trail.

Where there is strong demand, investor interest or excitement surrounding an asset, scams tend to follow. Criminals don't have to create that interest themselves. They can simply insert fraudulent offers, fake warnings and impersonation attempts into conversations that investors are already having.

We've seen this pattern repeatedly.

Bitdefender has covered warnings about fake crypto trading platforms that build trust with fabricated profits before preventing withdrawals. We've also seen cryptocurrency investment scammers take their operations offline, with the FBI warning in June that criminals were sending couriers to victims' homes to collect cash supposedly intended for crypto investments.

Other schemes use crypto ATMs to collect money from victims, while separate campaigns target people who have already lost cryptocurrency by advertising fraudulent "recovery" services.

Cybercriminals also exploit the tools investors use. Bitdefender Labs has tracked a persistent malicious advertising campaign impersonating TradingView that spread across Meta, Google and YouTube. The ads promised free access to premium trading tools but ultimately directed targets toward credential-stealing malware capable of stealing cryptocurrency wallet data.

The methods change, but the attraction doesn't. Wherever significant amounts of money are moving and people are looking for investment opportunities, scammers have an incentive to follow.

Platform changes can also give scammers the perfect cover, and crypto users should be particularly cautious when exchanges introduce new listings, remove existing assets, update their services or make other platform changes.

Instead of clicking links in messages about listings, delistings, account migrations, giveaways or security updates, open the exchange's official app or type its website address yourself and check whether the announcement actually exists.

Red flags crypto users should watch for

• You receive a notice of an urgent problem with your exchange account or wallet
• An unexpected message or caller asks for your seed phrase, recovery phrase, password or authentication codes
• Someone tells you to move cryptocurrency to another wallet to "protect" or "secure" your funds
• You’re promised free cryptocurrency, giveaways, prizes or guaranteed returns
• You are asked to connect your wallet through a link sent by text, email, social media or messaging apps
• A message claims you must act immediately because of a new listing, delisting, account migration or platform update
• An unexpected email, direct message, pop-up, or text directs you to a customer-support number contained in an unsolicited email or message
• A caller or message pressures you to install software or download trading tools from unofficial sources
• A romantic interest or stranger promises you access to exclusive investments or premium trading products for free
• You are demanded to make additional payments, pay taxes or fees before you’re allowed to withdraw your investment

How crypto investors can add another layer of protection

The safest response to an unexpected crypto message is to stop interacting with it and verify the claim independently. Go directly to the exchange, wallet provider or regulator's official website or app instead of using contact information or links supplied in the message.

If you're unsure whether a message, offer or crypto promotion is legitimate, you can ask Bitdefender Scamio. The free AI-powered scam detector can analyze suspicious texts, emails, links, QR codes and screenshots and flag signs that you may be dealing with a scam.

Received a suspicious link supposedly leading to an exchange, wallet service, airdrop or investment opportunity? Check it before visiting it with Bitdefender Link Checker. The free tool analyzes URLs for phishing, fraudulent websites, malware and other potential threats.

Crypto users should also protect the devices they use to access exchanges and wallets. A comprehensive security solution such as Bitdefender Premium Security can help detect malicious websites, phishing attempts, malware and other threats that criminals may use as part of their scams. Its Scam Protection Pro features also provide additional protection against scams encountered through email, SMS, chats and the web.