Launch app
Safety

How not to get scammed swapping crypto.

A swap is irreversible, one-shot, and has no chargeback — which makes swap users the highest-value target in crypto. Here is every scam that actually works, the pre-flight routine that defeats them, and an honest account of what a service like ours can and cannot do for you afterwards.

16 min read · Updated September 2026

The short version

  • The scam is almost never the swap — it is the site you reached it on. Clone domains bought through search advertising take more money from swap users than every dishonest operator combined.
  • Three requests are conclusive proof of fraud: your seed phrase, a wallet signature to "activate" an instant swap, and a payment to unlock funds a service already holds. Any one of them ends the conversation.
  • There is no support channel that finds you first. Everyone who direct-messages you about a stuck order is an attacker. Support does not have your username; the scammer watching the complaint thread does.
  • Your address is attacked more often than the service is. Address poisoning and clipboard hijacking redirect the coins you correctly sent from a legitimate site.
  • Nothing is reversible, and nobody can recover it. The recovery service advertising to victims is the second half of the same scam.
  • A twenty-dollar test swap verifies the whole path for the price of one network fee. On an unfamiliar service, take it.

Why swap users are the highest-value target in crypto

Every property that makes a non-custodial swap good makes its users worth attacking. The transfer is irreversible, so a successful theft is permanent. It is one-shot, so there is no second confirmation step where somebody might notice. There is no account, so there is no login to protect and no password reset trail to investigate. And the whole flow completes in minutes, which means the attacker's window and the victim's window are the same window.

Add the demographic. Someone deliberately using a no-KYC swap has already decided not to have an account and not to rely on a support desk — which is exactly the person least able to escalate when something goes wrong, and exactly the person a fake support agent finds easiest to help. The attacker is not exploiting a flaw in non-custodial swapping. They are exploiting the absence of the safety net you chose to do without, and the countermeasure is procedural rather than technical: a short, boring routine you run every time, which is what the rest of this guide is.

One clarification before the taxonomy, because it is the question underneath all of this: the risk in this space is overwhelmingly impersonation, not operator dishonesty. Genuine instant-swap services fail in visible, mundane ways — a bad rate, a slow payout, an order held for review. The money that actually disappears leaves through a website that was never the service at all.

The nine scams that actually take money

Ranked by how much they cost real users, not by how clever they are. The first three account for the overwhelming majority of losses.

1. The cloned swap site

An attacker registers a domain one character away from a real one — a swapped letter, a doubled consonant, a different extension, or a homoglyph such as a Cyrillic а that renders identically to the Latin one. They copy the front end pixel for pixel, because it is public HTML. Then they buy the advertising slot above the genuine search result for the brand name, and wait.

The clone behaves perfectly. It quotes a rate, produces an order page, shows a deposit address, and starts a countdown. The deposit address is the attacker's. Nothing arrives, ever, and the order page keeps saying "awaiting confirmation" for as long as you leave it open. This attack is effective precisely because the victim did everything right except one thing: they trusted a link.

Defeat it: reach the site by a bookmark you created from a URL you typed. Never through an advertisement, never through a link in a message or a comment. Then read the domain character by character before you copy a deposit address. If the address bar shows xn-- anywhere, the domain contains non-Latin characters that render as Latin ones, and you should close the tab.

2. The fake support agent

You post publicly that a swap has not arrived — in a subreddit, a Telegram group, under a tweet. Within minutes you get a direct message from "support". They are courteous, they know the product vocabulary, their display name and avatar match the real brand, and they ask you to continue in a private channel so they can look up your order.

They then ask for one of three things: your seed phrase to "restore your balance", a connection to a "verification" or "sync" page, or a small payment to "release" the stuck transaction. Each is fatal in a different way, and all three are the same scam wearing different clothes.

Defeat it with one rule: real support never contacts you first. A no-KYC service does not know your username, your handle or your inbox — it never collected them. Anyone who arrives unprompted knows only what you posted publicly, which is exactly how they found you. Initiate contact yourself, through the address published on the service's own site, and treat every inbound message about your order as hostile by default.

3. Address poisoning

This one takes money from people using entirely legitimate services. The attacker generates a vanity address whose first four and last four characters match an address you have used, then sends you a dust or zero-value transaction from it. It now sits in your wallet's transaction history looking like a familiar counterparty. The next time you copy an address out of that history rather than from its original source, you copy theirs.

It is common on account-model chains where history is easy to enumerate and vanity generation is cheap — Ethereum, BNB Chain, Tron and Polygon especially. The whole attack depends on one human shortcut: verifying the ends of an address and assuming the middle.

Defeat it: never copy an address from transaction history. Copy from the original source every time — the order page, the wallet's receive screen, a saved contact you created deliberately. Verify the first six characters, the last six, and a slice from the middle, in the destination field, immediately before signing. Unsolicited dust deserves suspicion, not curiosity.

4. Clipboard hijacking

Malware on your device watches the clipboard for anything that matches a crypto address pattern and replaces it with the attacker's, chosen to match the same chain so the wallet accepts it without complaint. You copied the correct address; you pasted a different one. This class of malware is old, cheap and still widely deployed because it needs no interaction beyond the copy you were always going to make.

Defeat it: the same visual check catches it, because the substitution happens between copy and paste — compare the pasted string against the source with your eyes, on screen, before you sign. On a machine you do not fully trust, the visual check is the only defence you have. For meaningful amounts, a hardware wallet that displays the destination on its own screen moves the verification off the compromised device entirely.

5. The wallet-drainer signature

A site asks you to "connect your wallet" to complete an instant swap, then presents a signature request. The prompt is framed as a login, a verification, or a gas-free approval. What it actually authorises is unlimited spending of a token, or a batch of transfers of everything the wallet holds. Approve it and the wallet empties in one transaction, with your own valid signature on it.

Defeat it structurally: a genuine instant swap does not need your wallet connected at all. The model is deposit-address-based — the service gives you an address, you send to it from anywhere, it pays out to the address you typed. If a self-described instant swap requires a wallet connection and a signature before it will quote you, it is not doing what it says. On-chain DEXs legitimately need signatures, which is a different product with a different risk profile; the swap versus DEX comparison covers where that boundary sits.

6. The seed-phrase harvest

Presented as wallet validation, a synchronisation error, an airdrop claim, a migration to a new contract, or a support agent restoring your balance. The interface is often a convincing replica of a real wallet's recovery screen. Twelve or twenty-four words go in, and the wallet is emptied — sometimes immediately, sometimes weeks later so the victim cannot identify the source.

Defeat it absolutely: the seed phrase is entered in exactly one place, your own wallet, when you are deliberately restoring it on a device you control. There is no legitimate second context. Any prompt for it, anywhere, from anyone, is a scam with certainty — and unlike every other item on this list, this one requires no judgement call.

7. The advance-fee release

A platform shows you a balance and then refuses to send it until you pay something: an AML compliance deposit, an unlock fee, a tax prepayment, a wallet-activation charge, a liquidity contribution. Sometimes the "balance" is a number in a database that never corresponded to any coins; sometimes it is the deposit you genuinely sent to a fake site.

The tell is structural and does not require you to evaluate the story. A service that holds your funds and owes you a payout deducts its costs from the payout. It never needs a fresh, separate deposit to send you money it already has. And the fee is never the last one — pay it and a customs charge appears, then a verification bond, for as long as you keep paying.

Defeat it: the moment the phrase "pay to receive" appears in any form, stop. There is no version of that sentence that is legitimate.

8. The impossible rate

A service quotes several percent better than every competitor on a major pair. Sometimes it pays out correctly on small amounts for weeks, harvesting reviews and screenshots, and then stops paying on large ones. This is the exit-scam pattern, and the early good behaviour is the marketing budget.

Rates on liquid pairs are set by the same underlying markets everywhere. A genuine service can beat another by tenths of a percent through better routing or a thinner margin. Nobody can beat the market by five percent, repeatedly, for strangers, at scale. If the number looks like free money, the free money is the bait — the fees guide shows how to compute the effective rate so you can tell a genuinely good quote from an impossible one.

9. The reversible-payment trap

This one lives in peer-to-peer trading rather than instant swaps, but it catches the same people, because P2P is a common on-ramp before a swap. A buyer pays for your crypto with a method that can be clawed back — a card payment, a bank transfer flagged as fraudulent, a consumer payment app with buyer protection — and reverses it after you have released coins that cannot be reversed. The related variant is a fake escrow: a third party invented by your counterparty, or a cloned escrow page, that takes both sides.

Defeat it: only accept irreversible settlement, only use escrow that belongs to the platform itself and that you reached through the platform, and never move a trade to a private channel — moving off-platform is the request that precedes almost every P2P loss. The cash-out guide covers which fiat rails are genuinely final.

The seven-check pre-flight

Run this every time, in order. It takes about a minute after the first few repetitions, and it is the difference between the scams above being interesting reading and being your problem.

  1. Arrive by a URL you typed. Your bookmark, or the domain typed by hand. Never a sponsored result, a DM, a QR code or a link in a comment.
  2. Read the domain character by character. Including the extension. Any xn-- prefix means non-Latin characters are being rendered as Latin ones — close it.
  3. Confirm the model. A single-use deposit address per order, a payout address you type. No seed phrase, no wallet signature, no account balance.
  4. Read the refund policy before depositing. If a service will not say in writing what happens to a flagged order, you have no exit.
  5. Sanity-check the rate. Compare received-over-sent against the mid-market rate. A quote far better than everyone else is bait.
  6. Verify both addresses in the field you send from. First six characters, last six, and a slice from the middle — deposit address and payout address alike.
  7. Test small on anything unfamiliar. Minimum swap, confirm the payout landed, then send the real amount.

Red flags, ranked by how much they should scare you

  • Fatal — stop immediately. A request for your seed phrase or private key. A demand to pay a fee before funds are released. A signature request to complete a deposit-address swap. A support agent who contacted you first. Any of these alone ends the transaction; there is no explanation that rehabilitates them.
  • Severe — do not proceed without independent verification. A rate several percent better than the market. A live-chat agent pushing you to hurry. A deposit address that changes after the order is created. An "account balance" on a service that advertises itself as non-custodial. A payout address field the site pre-fills for you.
  • Serious — treat as a warning. No published refund or flagging policy. No named security contact. A domain registered weeks ago. Reviews that are uniformly five-star and uniformly generic. A support address on a free consumer mail domain rather than the service's own.
  • Worth noticing. Aggressive countdown timers on a page that is not a rate lock. Testimonials with stock photography. Guaranteed returns or yield mentioned anywhere near a swap product — a swap converts assets, it does not generate income.

What a legitimate service actually looks like

The positive signals are less discussed than the red flags and more useful, because they are structural rather than aesthetic — a clone can copy a design in an afternoon but cannot easily fake any of these.

  • A published, specific policy on flagged orders — including what happens to your deposit and whether identity is ever demanded to release it. Ours is on the AML page, and it commits to refunding rather than requesting documents.
  • A named security contact and a security.txt file at the well-known path. Cheap to provide, and almost never present on a clone.
  • An explicit statement of what is logged and for how long, on a privacy page that makes a falsifiable claim rather than a vague promise.
  • A disclosed architecture — who provides liquidity, what the service holds and for how long. A transparency page that names the upstream is a page that can be checked.
  • Stable, boring mechanics. The rate is ordinary, the fee is stated, the deposit address is single-use, the payout address is yours, and nothing on the page is in a hurry.
  • Honest documentation of limitations. A service that publishes where it loses to competitors is describing a real product. Uniform superlatives describe a landing page.

The test swap, and the tension with fee optimisation

Two pieces of advice in this library point in opposite directions, so let us reconcile them explicitly. The fees guide is correct that splitting one swap into several multiplies flat network costs, and that small swaps are proportionally expensive. This guide is also correct that a test swap is worth it. Both hold, because they optimise different things.

The test swap is not a way to move money — it is a one-time verification cost, paid once per service and once per new payout address, not on every trade. On a first swap through an unfamiliar service, or before sending an amount you would genuinely miss, the arithmetic is not close: one extra network fee and ten minutes against the total irreversible loss of the principal. Once a service and an address have proven themselves, stop testing and follow the fee guidance — batch, choose cheap chains, and swap once rather than three times.

Do the test properly or not at all. Send the minimum, wait for the payout to actually arrive in your wallet — not for the order page to say "completed" — and then send the real amount to the same verified payout address, in the same session, from the same tab you already verified.

You already sent it. What now, honestly

The unwelcome truth first: if the coins reached an attacker's address on a public chain, they are gone. There is no reversal on any major chain, no issuer to appeal to, and no private party with the power to move somebody else's coins. Anyone who tells you otherwise is selling something. What remains is worth doing anyway, in this order.

  • Establish which failure you actually had. A swap that is late, held for review, or missing a memo is not a scam, and those cases usually resolve. Work through the troubleshooting guide before concluding you were robbed — the majority of "I have been scammed" posts are chain confirmation times.
  • Secure everything the attacker may have touched. If you entered a seed phrase, every account derived from it is compromised: move remaining funds to a wallet generated on a clean device, now, and treat the old one as public. If you approved a signature, revoke token approvals for that address. If it was clipboard malware, the device is compromised — do not use it for the recovery.
  • Record the evidence while it exists. Transaction IDs, the exact domain, timestamps, screenshots, message handles. Clone sites disappear within days; what you did not capture is not recoverable later.
  • Report it where reporting has leverage. Your national cybercrime authority, the registrar and hosting provider of the clone domain, and the platform that carried the advertisement or the message. If the funds landed on an identifiable custodial service, notify that service with the transaction ID — a custodian can freeze an account, which is the one genuine recovery path that exists and it is rare.
  • Refuse every recovery offer. Assume anyone who approaches you after a public loss is the same operation returning for the remainder. The offer will be plausible, urgent, and require a fee up front.

What we do, and what we cannot do

Held to the standard this guide sets. What our structure gives you: no account, so there is no balance to be locked out of and no credential to be phished; a single-use deposit address per order; a payout address you type and we never rewrite; a written commitment on the AML page to refund a flagged deposit rather than demand documents; a named security contact and a security.txt at the well-known path; and a transparency page that states what we hold, what we log, and who provides liquidity, so the claims can be checked rather than believed.

What we cannot do, stated plainly. We cannot reverse a transaction you sent to the wrong address, whether it was poisoned, hijacked or mistyped — nobody can. We cannot recover funds sent to a site impersonating us, because those coins never touched our infrastructure. We cannot stop clone domains from existing; we can only report them, which is slower than registering them. And because we hold no identity, we cannot verify who you are if someone impersonates you either — which is a deliberate trade you are making, and worth understanding as a cost as well as a benefit.

The honest summary is that the security model of a no-KYC swap moves responsibility toward you and pays you in privacy and finality. That trade is a good one for most people. It is only a good one if you run the checks, because there is no institution positioned to catch the mistake afterwards.

For the mechanics of a swap that is late rather than stolen, start with the troubleshooting guide. For computing an effective rate so you can spot bait quotes, see crypto swap fees explained. For the address and device hygiene that defeats poisoning and clipboard attacks, see wallet hygiene for privacy swaps. For how services compare on policy rather than marketing, see the best no-KYC swaps of 2026. For what a swap does and does not conceal, see is crypto swapping anonymous, and for the vocabulary used throughout, the glossary.

Frequently asked questions

How do I know if a crypto swap site is legit?+
Check the domain character by character in the address bar — not the logo, not the design, both of which are trivially copied. Reach the site by a bookmark you created yourself or by typing the domain, never through a search advertisement or a link in a message. Then look for the three structural tells of a real non-custodial swap: a single-use deposit address generated per order, a payout address you type yourself and can verify, and no request for a seed phrase, a wallet signature, or an identity document at any point. A service that satisfies those three is at worst a bad service; a service that fails any one of them is a trap.
Can a crypto swap be reversed if I get scammed?+
No. A confirmed blockchain transaction is final by design — there is no issuer, no chargeback and no reversal mechanism on any major chain. That is the same property that makes crypto censorship-resistant, and it cuts both ways. The only funds that can be returned are those still held by an honest counterparty who chooses to refund them, which is why a legitimate swap can refund a flagged or failed order but a scammer cannot be compelled to return anything.
Why did my crypto go to an address I did not intend?+
Almost always one of two attacks. Address poisoning: an attacker sends you a dust or zero-value transaction from an address whose first and last characters match one you have used, so that when you copy an address out of your transaction history you copy theirs. Or clipboard hijacking: malware on your device watches for a copied crypto address and silently substitutes its own. Both are defeated by the same habit — verify the pasted address against the source in the destination field, checking the middle of the string as well as the ends, immediately before you sign.
Are no-KYC swaps more likely to be scams?+
The category attracts more impersonation, not more dishonest operators. Because no-KYC users deliberately avoid accounts and support desks, they are attractive targets for clone sites and fake support — the attacker knows the victim will not be able to phone anyone. The underlying model is actually harder to abuse than a custodial exchange: a genuine swap holds your funds for minutes, not months, and never holds a balance you could be locked out of. Judge the individual service on its structure and its published policy, not on whether it asks for identity.
Should a swap service ever ask for my seed phrase?+
Never, under any circumstance, for any reason, on any service. A seed phrase reconstructs your entire wallet — anything that has it can empty every account it derives, permanently. No swap, exchange, wallet vendor, support agent or "validation" tool has a legitimate use for it. The request itself is conclusive proof of a scam; there is no follow-up question worth asking.
I was told to pay a fee to unlock my withdrawal. Is that real?+
No. Paying to receive is the defining shape of the advance-fee scam, and it recurs under many names: an AML unlock fee, a compliance deposit, a tax prepayment, a wallet-activation charge, a mining fee, a liquidity top-up. A legitimate service deducts its costs from what it sends you; it never asks for a fresh deposit to release funds it already holds. Once you pay, the story simply changes and a second fee appears.
Can a recovery service get my stolen crypto back?+
Effectively never, and the offer is usually the second half of the same scam. Recovery operations advertise into the exact places victims post — reply guys under a complaint thread, direct messages within hours of a public loss, sponsored results for "recover stolen crypto" — and they charge an up-front fee for work that no private party has the legal power to perform. Nobody can compulsorily move coins off a chain. Report the theft to your national cybercrime authority and to the receiving service if the funds landed somewhere identifiable, and treat every unsolicited recovery offer as an attacker who already knows you are vulnerable.
How do I avoid fake crypto exchange advertisements?+
Do not click sponsored results for crypto services at all — the advertising slot above an organic result is the single most reliable delivery channel for clone sites, because it is purchasable, targetable and faster to deploy than any takedown process. Navigate by a bookmark you made from a URL you typed. If you must search, scroll past every result marked "sponsored" or "ad" and verify the domain string before you interact with the page.
Is a test swap worth the extra network fee?+
On a service you have never used, on a large amount, or the first time you send to a new payout address — yes, comfortably. A twenty-dollar test costs you one extra network fee and roughly ten minutes, and it verifies the entire path end to end: that the site is genuine, that the deposit address works, that your payout address is correct, and that the service actually pays out. That is cheap insurance against an irreversible mistake on the amount that matters.

Ready to put this into practice?

Open the swap widget More guides