Short answer
A crypto impersonation scam copies a real project, exchange or team member to win a user's trust, then asks for a wallet signature, a seed phrase or a transfer. The copy can be a lookalike domain, a fake Telegram admin, a cloned X account, a token with the same ticker or a fake airdrop page. Chainalysis estimates impersonation tactics grew 1400% year over year in 2025.
Who this is for: Crypto founders, community managers and anyone new to Web3 security.
The forms it takes
| Fake | What it looks like | The ask |
|---|---|---|
| Lookalike domain | A copy of your site on a typo or extra-word domain | Connect a wallet, sign a permit |
| Fake support admin | A Telegram or Discord account with your admin's name and photo | Open a "support" link, share a seed phrase |
| Cloned X account | Your handle with one letter changed, replying under your posts | Claim an airdrop |
| Copycat token | A token with your name or ticker on a DEX | Buy the fake token |
| Fake channel or server | A Telegram channel or Discord server with your branding | Join a presale, follow "announcements" |
| Poisoned address | An address that starts and ends like yours | Send funds to it by mistake |
Most campaigns combine several: a cloned X account posts a link to a lookalike domain that hosts a wallet drainer, and fake admins repeat the link in DMs.
How big the problem is
| Figure | Value | Source |
|---|---|---|
| Crypto scam and fraud revenue, 2025 (estimate) | USD 17 billion | Chainalysis |
| Growth of impersonation tactics, 2025 | 1400% year over year | Chainalysis |
| Cryptocurrency losses reported to the FBI, 2025 | USD 11.366 billion | FBI IC3 |
| Imposter scam losses reported to the FTC, 2025 | USD 3.5 billion (all imposter scams) | FTC |
| Share of phishing attacks against crypto, Q2 2026 | 7.2% | APWG |
Why small projects are targets
- Few people know the real links. A new project's domain and handles are not familiar yet, so a copy is easy to believe.
- Community runs on chat. Telegram and Discord groups show who the members are, which gives scammers a list to DM.
- Events are predictable. Launches, listings and airdrops are announced in advance, and fake claim pages appear around them.
- No one is watching. Enterprise brand protection is sold on annual contracts, so small teams usually learn about a fake from a victim.
Warning signs for users
- Someone from "the team" writes first, or offers support in DMs.
- A link arrives in a reply, a DM or with an unexpected token, not from the official site.
- The page asks for a seed phrase, or a signature to "claim", "verify" or "fix" a wallet.
- There is a deadline: claim in the next hour, limited spots.
The best defence for a project is one official links page that users can check every link against.
Sources
- Chainalysis: crypto scams 2026 report
- FBI IC3 Internet Crime Report 2025 (PDF)
- FTC: imposter scam losses in 2025
- APWG Phishing Activity Trends Report, Q2 2026
Frequently asked questions
Is impersonation a hack of the project?
No. The project's contracts and servers are untouched. The scam targets users who trust the copy, which is why the project only learns about it from victims unless it monitors for fakes.
How much is lost to these scams?
The FBI's IC3 recorded USD 11.366 billion in cryptocurrency-related losses in 2025, and Chainalysis estimates USD 17 billion stolen in crypto scams and fraud that year. Neither figure is limited to impersonation.
Who gets impersonated?
Any project with users: tokens, NFT collections, wallets, exchanges and the people behind them. Small projects are easy targets because few people know their real links.