The fast-changing world of decentralized finance (DeFi) is a thrilling space with immense potential for both revolutionary innovation and personal financial advancement. This innovative, fast-paced ecosystem draws the attention of bad actors looking to game the system and defraud users. Recent data indicates a concerning shift in the nature of Web3 scams: while the frequency of attacks has decreased, the economic damage caused by each incident has skyrocketed. This deepening inequity will be the focus of this article, in greater detail. We’ll take the DappRadar report as a jumping off case study and provide hands-on guidance on spotting and steering clear of high-impact scams.
As per DappRadar’s latest Web3 Walkthrough Q1 2024 report, there were 21 fraudulent activities in the Web3 ecosystem during the first quarter of 2024 alone. Fast forward to the same stretch in 2025 and the number plummeted to only 7 episodes. This is an incredible 66% reduction in the rate of fraud. At face value, this would be a surprising trend, indicating that the Web3 ecosystem is adopting more and more protective measures. Taking a deeper dive uncovers a much more sobering picture.
The rate of fee for deposit return scams decreased. As of 2024, rug pulls and similar frauds accounted for $90 million in losses, which is a sharp increase over previous years. Almost $6 billion went up in smoke due to fraudulent activities in the world of dApps in the first months of 2025. Even more shocking to reflect upon, one single episode—the so-called Mantra case—accounted for 92% of the losses. This has led to it being one of the largest single frauds ever documented in recent memory. These scams have improved dramatically in effectiveness and reach, with an increase of 6.499% versus the same time frame in 2024. Curiously, this increase happened even as the overall rate of scams has plateaued. This indicates that scammers are getting smarter, more tactical in their approach, and concentrating efforts on fewer, but more pervasive attacks.
We hope GreedyChain.com can help break down this ongoing transition, providing invaluable information to everyone looking to get a leg up on the Web3 world. It’s not even about the number anymore, but rather, the skill and development of these frauds. By learning how these new and ever-growing tactics work, users can better defend themselves and their hard-earned investments in the DeFi space from them.
Multi-Chain Vulnerabilities and Exploits
Another new trend with Web3 scams is taking advantage of multi-chain vulnerabilities. The picture of the DeFi ecosystem today is constantly changing and more interconnected than ever. As assets and applications proliferate across dozens of blockchain networks, scammers are taking advantage of new opportunities to exploit weaknesses. Users need to be extra aware of the security dangers associated with all the chains they engage with. This understanding is a tremendous start to ensuring their protective safety.
Scammers are now targeting multiple chains and exploiting vulnerabilities across different platforms, making it harder for users to stay safe. This sometimes means discovering exploits in cross-chain bridges, which allow users to move assets from one blockchain to another. These bridges can be relatively complex and are often not subject to extensive audits, making them juicy targets for bad actors. In memory of the Wormhole exploit that took the world by storm in early 2022. Hackers then stole $325 million of this crypto in this unbelievable hacker haul.
With DeFi protocols growing in speed and complexity, and the number of interoperating chains growing rapidly, this expansion creates a larger attack surface for scammers to exploit. As always, it’s important for users to stay alert and do their due diligence before engaging with any DeFi application or cross-chain bridge. It’s equally important to stay informed on the latest security news and best practices to defend yourself against new and emerging threats.
KiloEx: Ambitions vs. Risks
KiloEx, a decentralized exchange (DEX), allows users to trade perpetual contracts with leverage on any asset. This is an appealing option even for experienced traders looking to amplify their returns. It is fraught with danger, too. KiloEx carries a high risk of impermanent loss. This risk refers to the uncertainty that is associated with an option when the price of the underlying asset has significant movements.
A second risk attached to KiloEx is the real likelihood of liquidation. If a trader’s position goes against them, they can be subject to liquidation where the forced liquidation of their position occurs at a loss. This risk is further compounded by the use of leverage, which can magnify both gains and losses, creating an added layer of risk. Like any DEX, KiloEx is subject to smart contract exploits and other breaches of common cybersecurity best practices. Users need to understand these risks and trade only with money they can afford to lose.
Whether you choose to use KiloEx or any other platform, learn how perpetual contracts function before you begin trading on them. Additionally, have a really good knowledge of leverage trading. Limit your exposure at first by placing smaller positions while you learn both how to use the platform and the risks involved. Diversifying your cross-platform and multimodal portfolio is another effective way to reduce risk.
R0AR Contract Exploit: $780K Backdoor Attack
The R0AR contract exploit is a sobering example of what can happen when smart contracts aren’t properly secured. A malicious actor was able to exploit a backdoor in the R0AR contract. As a result of this attack, they were able to drain the equivalent of $780,000 in funds. This exploit serves as a reminder of the need for comprehensive smart contract audits and continued security oversight.
The R0AR exploit was a high-level attack that exploited a very specific vulnerability not immediately visible in the contract’s code. This provided the attacker a way to go around the intended security measure and steal funds from the contract. The speed and precision of the attack made it difficult for the R0AR team to respond in time to prevent the loss of funds.
This incident serves as a reminder for developers to make security a primary focus during smart contract development. You’ll perform in-depth code reviews, supplementing your own work with automated code-scanning tools. You will interact with the security community at large to discover and diagnose potential vulnerabilities. At the same time, users should be cautious when interacting with new or unaudited smart contracts. Because these contracts are non-fixed payment, there is a much greater opportunity for exploitation.
Major Security Breaches in the Crypto Space
The last several years have been marred by repeated security breaches that have hit the crypto industry hard. As an outcome, both users and taxpayer funded infrastructure projects have taken huge financial hits. These incursions are typically the result of technical failure, social engineering manipulation, and human fallibility. In order to protect yourself in the crypto world, you need to be aware of the most common kinds of security securities. Understanding how these breaches happen is key.
Some of the most common types of security breaches in the crypto space include:
- Smart Contract Exploits: These occur when attackers exploit vulnerabilities in the code of smart contracts, allowing them to steal funds or manipulate the contract's behavior.
- Phishing Attacks: These involve tricking users into revealing their private keys or other sensitive information through deceptive emails, websites, or social media posts.
- SIM Swapping: This involves attackers gaining control of a user's phone number, which can then be used to reset passwords and access their crypto accounts.
- Exchange Hacks: These occur when attackers gain unauthorized access to a cryptocurrency exchange, allowing them to steal funds from user accounts.
$5M in ZKsync Airdrop Funds Compromised
The crypto community had been waiting months for the ZKsync airdrop. Tens of thousands of users awaited eagerly to access their portion of the newly-distributed tokens. This excitement drew in the bad actors who wanted to capitalize on the situation for their own personal gain. In one high profile case attackers managed to drain around $5 million worth of ZKsync airdrop refund funds.
The attackers used a number of sophisticated tactics to exploit the airdrop funds. Phishing attacks, social engineering, and SIM swapping tactics helped these guys perpetrate their scheme. They deliberately focused on users who had little to no knowledge of security best practices. These users were more susceptible to their predatory schemes. Once they were in a user’s account, they wasted no time in claiming the airdrop tokens. Suddenly, they started moving those coins into their own wallets.
This attack serves as a reminder to always be vigilant when engaging in airdrops and other promotional activities. We encourage users to independently check the legitimacy of an event first before giving personal information or linking a wallet. Strong passwords and two-step verification are some of the most important ways you can protect yourself. Always exercise caution when it comes to unsolicited emails or social media messages.
ODINDOG Token Value Halved After Hack
The ODINDOG token value fell by 100% after a last hack. In this specific incident, this resulted in the theft of a large amount of tokens. The hack made the value of the token drop by about 50%, devastating many investors with large losses. This frightening experience reminds us all about the extreme volatility and danger behind investing with crypto. It’s even more the case for smaller or newer projects.
The ODINDOG hack is still shrouded in mystery. It seems that the attackers were able to exploit a vulnerability in the token’s smart contract. In order to offer tokens at a discount, they minted a massive number of new tokens. Later, they sold those tokens on the open market, creating downward price pressure. The debacle struck panic among investors, who began flooding the market with sell orders on their tokens, compounding the price drop.
This most recent incident is a bad reminder of why it pays to conduct diligent research before investing in any cryptocurrency. Investors need to learn about the project’s team, technology and security practices before investing their hard-earned money. Finally, as with any investment, remember that it’s important to diversify your portfolio and invest only what you can afford to lose.
Phishing and Social Engineering Threats
These attacks often involve common phishing and social engineering scams that target cryptocurrency users. These tactics are among the most common and the most successful ways they trick Americans into fraud. These specific, harmful attacks don’t exploit technical vulnerabilities but rather prey on aspects of human psychology. Through realizing the anatomy of such attacks, users can equip themselves to avoid becoming the victims of such attacks.
Phishing attacks usually consist of emails, texts, or website URLs designed to trick users into thinking they are interacting with trusted entities. These messages are security threats that attempt to deceive users to obtain their private keys, passwords, or other sensitive information. Phishing is a common social engineering attack that tricks users into compromising their security. For deepfakes specifically, they can fool people into sending money to a fraudster’s wallet address or downloading malware.
Fake Discord Vanity Leads to Layer3 Phishing
Discord’s popularity makes it a major draw for most crypto communities. At the same time, it turns into a breeding ground for phishing and other social engineering attacks. Many scammers set up Discord servers that look like the real thing or impersonate real projects to lure users into exposing their personal information. One of the most common tactics is setting up an all-sham “vanity” URL for a Discord server. While it may seem like this URL is genuine, it actually leads their users to a phishing site.
In a particularly crafty recent example, scammers used a fake Discord vanity URL to impersonate Layer3, a popular Web3 platform. Those who clicked on the link were sent to a fraudulent website that prompted users to link their wallets. As soon as a victim linked their wallet, the fraudsters could raid their funds. This case is yet another example of why it’s important to be careful when clicking links in Discord. Our last important reminder is to always check that you’re connecting to the correct website!
Make sure to always verify the URL of any Discord server and website you are visiting. Watch out for any invitation to connect your wallet or enter personal details. If you are unsure about the legitimacy of a Discord server or website, contact the project's official team for confirmation.
Social Engineering Scam Impersonates X Support
Social media platforms such as X (formerly Twitter) are an increasing hotspot for social engineering scams and scams. Scammers often used fake support accounts or team members from the project. Their goal is to trick users into sharing sensitive details or transferring them funds. These scams are hard to sniff out, because the scammers have a habit of pretending they’re real through high-pressure tactics and strict rules.
One common tactic is to create a fake X account that looks almost identical to the official support account of a popular crypto project. Scammers will then quickly jump on users who tweet about problems with the project. They will express a desire to help fix the issue. Scammers aren’t going to actually help you. Instead, they’ll attempt to trick users into revealing their private keys or transferring them funds.
Always confirm that the account you’re engaging with is the real deal on X. This easy precaution will keep you safer from social engineering frauds. Look for the blue verification badge, but be on the lookout for red flags in the account’s profile or tweet history. Always be suspicious of requests to share your private keys or send money. If you ever doubt the legitimacy of an account, reach out to the real project’s core team to verify.
The Impact of Rug Pulls and Scams
Rug pulls and scams generally leave investors empty handed and erode public trust in the crypto community. These events are costly and lead to erosion of faith within the ecosystem. Consequently, they turn away potential new users who might otherwise embrace the space. Understanding the common types of rug pulls and scams and their potential consequences is essential for protecting oneself and promoting a safer crypto environment.
Rug pulls, in which the creators of a cryptocurrency project abandon the project and run off with investors’ money, are unfortunately common in the crypto space. Or they can dump all of their tokens, empty the project’s liquidity pool, or simply run off with no accountability. These actions can be subtle and often times insidious with far reaching impacts. Unlike scams, which range widely from phishing attacks, Ponzi schemes to fraudulent ICOs.
The Collapse of $OM: A Case Study
The $OM token fiasco goes to show the risks when investing in meme coins. This ongoing crisis should be seen as a cautionary tale regarding the dangers of all other speculative cryptocurrencies. The $OM token skyrocketed in price, buoyed entirely by social media-driven hype and speculation. At the conclusion of the project, there was a lack of tangible usefulness or fundamental worth. In response, the price plummeted, creating deep losses for most investors.
The $OM token was promoted as a community-focused, hyper-deflationary, decentralized financial freedom movement. In fact, just a handful of people made all the decisions on the project. They effectively rigged the price and filled their wallets on all the speculation. When the excitement passed, the price of the $OM token cratered, and the project sort of collapsed in on itself.
This occurrence highlights the importance of doing extensive research before putting any money into a cryptocurrency. That’s doubly true when it comes to meme coins or other speculative fare. Each investor must do their own diligence on the team behind the project, tech, and underlying value of the project before investing their capital. As with all things, it’s very important to be cautious of hype and speculation and only invest what you can afford to lose.
A $30K Rug Pull in Plain Sight
A recent incident involving a $30,000 rug pull demonstrates how easily scammers can defraud unsuspecting investors, even when the red flags are apparent. Developers of a new cryptocurrency project successfully executed a rug pull, defrauding investors of more than $30,000. They were able to do this because they started a sham project that provided no actual utility or intrinsic value.
And the scammers got pretty creative with how they manipulated investors to steal their money. They whipped up a slick website, printed up egregiously misleading marketing materials, and even engaged social media influencers to promote their half-baked project. For one, they manufactured a sense of urgency by telling people that the token was about to skyrocket. It created a sense that investors had to move fast and buy in early! After they’d raised a sufficient amount of money, the scammers vanished without a word, leaving investors holding tokens that had no value.
This saga is a reminder to always be skeptical and conduct plenty of independent research before investing in a cryptocurrency or blockchain initiative. Investors need to be on guard against projects that overstate returns on investment or induce pressure to make quick decisions. It's essential to verify the legitimacy of the project's team, technology, and underlying value before committing any funds.
Trust Erosion in the Crypto Community
Rug pulls and scams easily poison trust with the crypto community. When investors lose money due to fraudulent activity, they are understandably disillusioned. Then this disappointment discourages them from ever participating in the ecosystem again. This has the potential to stifle innovation and adoption of cryptos and decentralized technologies.
Trust is the bedrock of all successful financial systems, and this includes the rapidly evolving crypto space. When investor trust is undermined, even the most legitimate projects have trouble finding willing investment partners. This growing lack of trust further encourages users to migrate away from centralized exchanges. This, in turn, leads to a vicious cycle of increasing distrust and further decline.
BullX Meltdown: Trust Issues and Lost Rewards
The BullX project has recently experienced a catastrophic meltdown due to lack of trust and missing rewards. As a result, millions of new users now feel betrayed and disillusioned. At first, the project was positioned as a truly decentralized protocol—with the power to earn rewards by staking coins and participating in governance. The project’s builders opted for a number of outrageous decisions that furthered the mistrust and eventually sailed the project to its death.
Given this confusion, one of the biggest missteps was the lack of transparency and communication from the project’s team. In this process, users were repeatedly and rudely denied a say in critical decisions and modifications made on the platform. This only resulted in a breeding ground for speculation and rumors, which further corroded trust. Users complained about the difficulty in claiming their reward. Many were shocked to discover that their rewards were much less than they thought they would be.
This incident serves as a reminder that transparency and clear communication go a long way in establishing trust within the crypto community. It’s simple—open, honest projects cultivate loyal, like-minded users. This kind of transparency makes long-term success much more likely. It's essential for projects to deliver on their promises and ensure that users are able to claim their rewards without any issues.
BASE’s Consecutive Token Launch Failures
It follows a string of consecutive token launch failures on the BASE blockchain that have led to questions about the security and reliability of the platform. These failures have contributed to significant erosion of regular trust in the BASE ecosystem and dissuaded newer assignments to launch out on the BASE platform. Each one of these incidents has highlighted the need for better security measures, particularly at sensitive facilities. We need to have stronger vetting processes before projects are allowed to go live on BASE.
BASE has recently endured some string of failed token launches in a row. These problems are the result of a confluence of things like smart contract vulnerabilities, phishing attacks, and social engineering scams. In other instances, the projects were outright scams, set up to go rug pull investors from the outset. Many of the projects were valid. These vulnerabilities were known and as such, malicious actors exploited vulnerabilities in the platform’s security to turn them into exploits.
These incidents have made clear the vital role of security and due diligence in a burgeoning crypto ecosystem. It’s critical for platforms like BASE to build secure platforms from the ground up. They need to do better and impose real vetting requirements to protect users and projects from scams. Which brings us to the second point that users need to be wary and do their own research before investing in any new token or project.
Navigating Crypto Security Challenges
Understanding the complicated landscape of crypto security might feel overwhelming, especially for beginners. The ecosystem is changing rapidly and new threats have been appearing nearly every day. By understanding the common security risks and implementing best practices, users can significantly reduce their risk of falling victim to scams and other fraudulent activities.
Some of the key security challenges in the crypto space include:
- Smart Contract Vulnerabilities: Smart contracts are complex pieces of code that can be vulnerable to exploits if they are not properly written and audited.
- Phishing Attacks: Phishing attacks are a common way for scammers to steal users' private keys and other sensitive information.
- Social Engineering Scams: Social engineering scams involve manipulating users into performing actions that compromise their security.
- Exchange Hacks: Cryptocurrency exchanges are often targeted by hackers who seek to steal funds from user accounts.
The Staking Scam Debate: Opportunity or Trap?
Staking can be a very profitable method to earn rewards on your crypto holdings. It can quickly become a death spiral if you’re not careful. We are seeing a growing trend of staking scams. Fraudsters are enticing crypto users with false promises of guaranteed high returns and employing shady tricks to coerce users into staking their tokens. That means it’s important to know how to tell an above-board staking opportunity from a scam.
The first and most obvious type of staking scam is to lure you in with vastly inflated, unrealistic returns that are just too good to be true. These frauds typically guarantee returns of 300% and even 1,000% per annum! In reality, such returns are not sustainable and the project is destined to fail, leaving investors high and dry. Other scammers rely on simply misleading users to commit fraud. They lure people into staking their tokens with counterfeit projects. This could mean designing a fraudulent project website, releasing deceptive sponsorship marketing collateral, or direct impersonation of credible projects.
To make sure you and your assets are safe from staking scams, be sure to research any project before staking your tokens with them. Watch out for any cryptocurrency project promising guaranteed returns or misleading you on their platform’s capabilities. Make sure there’s real underlying value to the project’s technology and see who’s behind the project. Know what you’re getting into when it comes to staking. These smart contracts can subject you to impermanent loss, or worse, lose your staked tokens if the project is hacked or otherwise fails.
