The Biggest Crypto Scams of 2025
A record year for crypto fraud - and a shifting one. Token rug pulls exploded, AI deepfakes went mainstream, and, against the trend, classic wallet-drainer phishing actually fell. Here's the 2025 landscape by the numbers, with the documented cases behind each category.
Honeypots, tax-flip setups, scam factories - flagged in 10 seconds, free, no signup.
Note: most figures below come from third-party reports (Chainalysis, Scam Sniffer, Check Point, the World Economic Forum) and press coverage, listed at the bottom. They measure different things and shouldn't be summed. The point is the shape of 2025, not a single grand total.
Rug pulls
~$6B lost in 2025, a 6,499% jump YoY
Token projects that collapse - by design or by insider dump - leaving holders with worthless bags.
What happened
Token rug pulls were the year's biggest scam category by value: roughly $6 billion, versus ~$90 million the year before. But the number is top-heavy - a single event, the Mantra (OM) collapse, accounted for around 92% of it. In April 2025 OM crashed ~94% (from ~$6.35 to ~$0.37) after a cluster of wallets moved tens of millions of tokens onto exchanges; the team blamed forced exchange liquidations, while many holders called it an insider dump (the characterisation is disputed). The rest of the category is the familiar long tail: honeypots, sell-tax flips and mass-deployment 'scam factories' - the on-chain playbook we break down in the tactics guide.
Notable cases
- Mantra (OM) - ~$5.5B wiped in a ~94% crash (April 2025); ~92% of the year's rug-pull losses
- MetaYield Farm - ~$290M drained from 14,000+ participants before vanishing
- Aquabot (AQUA) - ~$4.65M presale, then -61% in 75 minutes (Sept 2025)
How to protect yourself
Test a small sell before buying, check the deployer's history, and never trust a token whose liquidity isn't locked. A scan flags honeypots and tax-flip setups in seconds.
AI deepfake impersonation
~$897M cumulative, ~$410M in H1 2025 alone
AI video/voice clones of public figures promoting fake giveaways and 'investment platforms'.
What happened
2025 was the year deepfakes went mainstream in crypto fraud. AI-generated clones of business leaders and celebrities - Elon Musk above all, the single most deepfaked endorser - pushed fraudulent 'crypto giveaways' and fake trading platforms across YouTube, X and Facebook. Deepfake fraud losses reached roughly $897 million cumulatively, with about $410 million in the first half of 2025 alone (the World Economic Forum logged over $200M in Q1). Impersonation-style deepfakes accounted for an estimated $401M of that. This is the through-line of Chainalysis's 2025 report: AI made high-trust impersonation cheap and scalable.
Notable cases
- An Ontario woman lost ~$1.7M to a Musk deepfake investment video seen on Facebook
- An 82-year-old retiree drained ~$690K into a deepfake Musk crypto scheme
- Musk deepfakes circulated across YouTube and X throughout 2025 promoting fake giveaways
How to protect yourself
No real company or celebrity runs a 'send 1 ETH, get 2 back' giveaway. Treat any video promising guaranteed returns as fake, and only ever get a contract address from a project's own verified source.
Phishing & wallet drainers
$84M lost - down 83% YoY (the year's one bright spot)
Malicious sites and signatures that drain a wallet once you connect or approve.
What happened
Against the trend, classic wallet-drainer phishing actually shrank in 2025: losses fell to ~$84 million from ~$494 million in 2024, and victims dropped 68% to about 106,000 (Scam Sniffer) - the result of better in-wallet warnings and takedowns. The drainer-as-a-service economy is far from dead, though: Inferno Drainer, which publicly 'shut down' in 2023, kept draining wallets via its old contracts - 30,000+ new victims and $9M+ between late 2024 and early 2025 (Check Point). Address-poisoning, where attackers seed lookalike addresses into your history, hit ~17 million addresses for ~$83.8M, including one $50M theft in a single December incident.
Notable cases
- Inferno Drainer (drainer-as-a-service) - still active via 2023 contracts, 30,000+ victims into 2025
- Address poisoning - ~$83.8M across ~17M addresses; largest single hit ~$50M (Dec)
- Phishing losses overall: $494M (2024) -> $84M (2025), a rare decline
How to protect yourself
Revoke stale token approvals, verify addresses character-by-character (not just the first/last four), and never sign a transaction you don't understand. A drainer needs your signature - don't give it one.
What this list does not cover
Protocol hacks and exploits. The biggest single crypto theft of 2025 - the ~$1.5B Bybit hack attributed to North Korea's Lazarus Group - was a security breach, not a scam. Hacks attack the platform; scams attack the person.
Exchange exit scams. Fake and collapsing exchanges get their own running list - see the fake exchanges page.
The on-chain token playbook. For the contract-level mechanics behind most rug pulls - honeypots, sell-walls, bytecode templates, deployer-funder graphs - see scammer tactics.
Cross-references
- Scammer tactics
The on-chain ERC-20 attack taxonomy behind the rug pulls - Fake crypto exchanges
Documented exchange exit scams, from OneCoin to JPEX and MTFE - Risk signals reference
The 115+ on-chain signals RektRadar checks on every token - Crypto risk glossary
The terms behind the scams, in plain language