Skip to content
Education only · not financial, tax or legal adviceCanadian facts checked 2026-10-31 · a MITEY site
Menu
Risk explainer

Rug pulls and scams: the risks designed to fool you

How rug pulls, honeypot tokens, fake front-ends, approval drainers and social engineering work, the red flags to watch, and how to report a scam in Canada.

Green circle · beginner8 min readFacts checked 2026-10-31
Mitey the yeti, blue-eyed with a blond tuft, holding out an open paw, with a warning sign
Mitey says: If someone contacts you first with an opportunity, a fix or a free token, close the chat and open your own bookmark instead.

Trail notes

  • Scams are built to look legitimate until the moment your money leaves.
  • Rug pulls, honeypot tokens, fake front-ends, approval drainers and social engineering are the main patterns.
  • Most losses come from a transaction or signature you approved, so the network treats them as valid.
  • In Canada, report scams to the Canadian Anti-Fraud Centre and your local police, and beware of recovery offers.

What this risk is

Most risks on this site come from things breaking: code, pegs, bridges. Scams are different. They are built by someone who intends to take your money, and they are designed to look legitimate until the moment they are not. In DeFi, where transactions are final and anyone can launch a token or a website, recovery after a scam is rare.

About this danger rating

We rate rug pulls and scams 5 (extreme) on the Mitey risk scale, our editorial teaching scale inspired by avalanche danger ratings: 1 low, 2 moderate, 3 considerable, 4 high, 5 extreme. It is a general teaching guide, not advice. We put it at the top because losses are usually fast and total, and scams adapt to whatever people are excited about this month.

How it happens

  • Rug pulls. A team launches a token, attracts buyers and liquidity, then removes the liquidity, mints a huge supply for itself or abandons the project. Holders are left with a token no one will buy.
  • Honeypot tokens. The token contract lets you buy but quietly blocks selling for anyone except insiders, or charges a sell fee close to 100%. The price chart only rises because no one else can sell.
  • Fake front-ends. A copy of a real app’s website, reached through an ad, a misspelled domain or a link in a message, sends your transactions to the scammer’s contract instead.
  • Approval drainers. A site asks you to sign an approval or a signature message that gives a contract permission to move your tokens. Later, often minutes later, the contract empties your wallet. See wallet approvals and signing.
  • Social engineering. Fake support agents, romance and friendship scams, impersonated public figures and self-described investment coaches build trust, then steer you to a fake platform or ask for your seed phrase.
  • Fake airdrops and giveaways. Free tokens appear in your wallet with a link to “claim” more. The claim site is a drainer.
  • Recovery scams. After a loss, someone offers to get your funds back for a fee. This is often a second scam aimed at the same person.

The Canadian Anti-Fraud Centre keeps a page of investment scam warning signs, including crypto investment scams, which is worth reading alongside this one.

Risk mapLikelihood for an ordinary user →Severity →ScamsBridgeSmart contractLiquidationDe-pegOraclePlatform failureLost keysRegulatorywatch closely
DeFi risk map: likelihood and severity (editorial). An editorial teaching map, not a measurement. Positions reflect how often each risk tends to affect ordinary users and how badly when it does.

See the full infographic with notes.

A hypothetical example

Example: the claim page
A message in a community chat says early users can claim a new token. The link looks almost like a well-known app’s address.
The site connects to your wallet and shows a “Claim” button. Your wallet pops up a signature request full of technical text.
You sign. Nothing seems to happen, and the site says your claim is “processing.”
The signature was a permission for a contract to spend your stablecoins. Ten minutes later, $3,000 leaves your wallet in a single transaction.
Because you signed it, the network treats the transfer as valid. There is no one who can reverse it.

The scenario is fictional, but the pattern is common: urgency, a familiar-looking link and a signature you could not read. Break any one of those links and the scam fails.

Warning signs

  • Anyone contacting you first, especially with an opportunity or an offer to help.
  • Promises of high or steady returns, or claims that you cannot lose.
  • Pressure to act now, keep it secret or recruit friends.
  • Requests for your seed phrase, private key or remote access to your device.
  • Signature requests you cannot read, or approvals for unlimited amounts.
  • A token with no visible way to sell, or large sell fees.
  • Anonymous teams that control the token supply or liquidity with no limits.
  • Website addresses that differ slightly from the real one, or that arrive through ads and messages.

How to reduce it

  • Reach apps from bookmarks, not links. Save the correct address once, from the project’s official documentation, and use that bookmark every time.
  • Read before you sign. If your wallet cannot explain what a signature does, do not sign it. Approve exact amounts rather than unlimited ones.
  • Use a separate wallet for experiments. Keep only small amounts in the wallet you connect to new sites.
  • Revoke old approvals. Review and remove permissions you no longer need.
  • Ignore unsolicited help. Real support teams do not message you first and never need your seed phrase.
  • Be wary of any token you cannot sell. If you cannot confirm that selling works and who controls the supply, leave it alone.
  • Learn the patterns. The scam red flags tool and our guide to DeFi scams in Canada cover more examples.

The Canadian angle: how to report

If you think you have been scammed, act quickly. Speed will not reverse a blockchain transaction, but it can stop further losses and help investigators.

  1. Stop sending money, and do not pay anyone who offers to recover your funds.
  2. If your keys or approvals may be compromised, revoke approvals and move any remaining assets to a new wallet with a new seed phrase.
  3. Write everything down: wallet addresses, transaction identifiers, website addresses, usernames, messages and dates.
  4. Report it to the Canadian Anti-Fraud Centre and to your local police. If a platform was involved, contact it as well.
  5. If the scam involved a fake investment firm or platform, check it in the CSA National Registration Search and tell your provincial securities regulator.

Our report fraud page walks through the Canadian reporting options step by step, and the scam response checklist helps you organize your evidence.

Keep the records

CRA’s records page (modified 2025-11-10) asks crypto users to keep transaction details and wallet addresses. As of 2026-10-30, CRA’s crypto pages do not specifically address losses from scams, so keep full records and ask a tax professional how a loss applies to you.

Your checklist

Questions people ask

What is a rug pull?

A rug pull is a scam in which a token’s creators attract buyers and then remove the liquidity, mint themselves a huge supply or abandon the project, leaving holders with tokens they cannot sell for meaningful value.

What is a honeypot token?

A honeypot token is a token whose contract lets people buy but blocks or heavily taxes selling for everyone except insiders. The rising price chart is part of the trap.

Where do I report a crypto scam in Canada?

Report it to the Canadian Anti-Fraud Centre and your local police, and contact any platform involved. Our report fraud page lists the steps and the evidence to gather.

Can stolen crypto be recovered?

Rarely. Blockchain transfers are final, so recovery usually depends on law enforcement or a platform freezing funds. Be very wary of anyone who offers to recover funds for a fee, as this is a common follow-up scam.

Is an approval drainer the same as a hack?

Not quite. A drainer usually works because you signed a permission, so the network treats the transfer as authorized. That is why reading every signature request matters.

Sources and dates

  • Ethereum security and scam prevention — ethereum.orgreference
    No date shown on page · checked 2026-10-31. Wallet security habits and common scams.
  • Report fraud and cybercrime — Canadian Anti-Fraud Centrereference
    No date shown on page · checked 2026-10-31. How Canadians report fraud and cybercrime, including crypto scams.
  • Investment scams — Canadian Anti-Fraud Centrereference
    No date shown on page · checked 2026-10-31. Warning signs of investment and crypto investment scams.
  • Are they registered? (National Registration Search) — Canadian Securities Administratorsreference
    Page date 2026-01-13 · checked 2026-10-30. Check registration, disciplinary history and investor alerts.
  • Investor tools — crypto assets — Canadian Securities Administratorsreference
    Page date 2025-10-22 · checked 2026-10-30. Crypto assets can be very volatile and risky; you could lose some or all of your funds.
  • Keeping books and records of crypto-assets for tax filing — Canada Revenue Agencyin force
    Page date 2025-11-10 · checked 2026-10-30. What to record per transaction, wallet addresses, yearly balances; export platform history; keep records at least six years.
  • Information for crypto-asset users and tax professionals — Canada Revenue Agencyin force
    Page date 2025-10-29 · checked 2026-10-30. CRA's current crypto-asset guidance set (replaced the older 'Guide for cryptocurrency users').

Education only. Nothing on this page is financial, investment, tax or legal advice, or a recommendation to buy, sell, stake, lend or borrow any crypto-asset. Crypto-assets can lose some or all of their value and are not covered by CDIC. Canadian rules change: check the dated sources above and talk to a qualified professional about your situation. Full disclaimer.