Common DeFi Scams and Red Flags
The previous two lessons covered rug pulls (malicious projects) and exploits (bugs in legitimate ones). This lesson covers a third category that targets you directly rather than a protocol: scams that rely on social engineering and interface tricks, aimed squarely at the wallet, approval, and transaction mechanics you learned in Module 2. These scams are worth studying last in this risk module specifically because every one of them depends on a victim misunderstanding a mechanic this course has already taught — which means you're now equipped to recognize exactly how each one works.
Phishing sites mimicking real protocols are the most common entry point: an attacker builds a pixel-perfect copy of a real DEX, wallet download page, or lending protocol's interface, hosted on a domain that looks almost identical to the real one (a single swapped character, an extra word, or a different top-level domain), then drives traffic to it through search ads, fake social media accounts impersonating the real project, or compromised Discord and Telegram channels. Anything you sign while connected to a phishing site — an approval, a swap, a "claim" — is signed in a context the attacker fully controls. Fake token airdrops exploit the approval mechanic directly: a site invites you to "connect wallet and claim" a free token, but the transaction you're asked to sign isn't actually a claim at all — it's framed to look routine, but it's really an unlimited approval (exactly the mechanic from Module 2) granting the scammer's contract permission to later drain a valuable token from your wallet, sometimes not immediately, so the connection to the "airdrop claim" you signed weeks earlier isn't obvious when the drain finally happens. Malicious approval requests disguised as routine transactions are the more general version of the same trick — a prompt engineered to look like a normal "sign to continue" step, when it's actually a spending approval, relying on users clicking through prompts quickly without reading them (precisely the habit the approvals lessons told you to break). Too-good-to-be-true "guaranteed yield" offers rely on a different lever entirely: urgency and greed rather than a technical trick, promising fixed, high, "guaranteed" returns that no legitimate DeFi protocol can actually promise, since real yield — as the "Where Yield Comes From" lesson explained — is variable and tied to real trading activity, incentive emissions, or staking economics, never a fixed guarantee from a counterparty with no real backing.
The single pattern running through all four categories is that each one depends on you skipping a verification step this course has already taught you to perform: checking a URL carefully, reading an approval prompt line by line, recognizing that real yield fluctuates, and resisting pressure to act immediately.
Worked Example
A concrete, well-documented pattern: a user sees a post on social media (from an account that appears, at a glance, to be a real project's official account, having been compromised or spoofed) announcing a surprise token airdrop with a limited claim window, creating urgency. The linked site looks identical to the real project's interface — same logo, same layout, same color scheme — because copying a public website's appearance costs an attacker nothing. The user connects their wallet and clicks "claim," and the wallet shows a signing prompt. Because the user is excited about free tokens and the countdown timer is creating pressure to act fast, they click through the prompt without reading it line by line, exactly the habit the approvals lessons warned against. The transaction they actually signed wasn't a claim at all — it was an approval granting the attacker's contract permission to spend a valuable token the user already holds, say their stablecoin balance, at the attacker's discretion. No funds are drained immediately, which is itself part of the deception; weeks later, once the user has forgotten about the "airdrop" entirely, the attacker uses the standing approval to drain the approved token in a single transaction, with no new signature required from the victim, exactly as the "Approval Risks" lesson described.
This single example touches every mechanic from Module 2 and this module combined: the fake site relied on a URL the user didn't check carefully (Module 2's wallet-setup lesson), the fake claim relied on an approval prompt read too quickly (the approvals-explained and approval-risks lessons), and the entire scheme relied on urgency overriding caution (this lesson's core warning).
Exercise
Write a personal checklist of at least five concrete red flags drawn from this course so far — for example: unsolicited DMs or social posts promoting a claim or opportunity, any "guaranteed" fixed APY, a request to approve or sign before you've read and understood exactly what the prompt says, a URL that's slightly misspelled or uses an unfamiliar domain ending, and pressure to act within a short countdown window.
For each of your five red flags, write one sentence connecting it back to a specific mechanic from an earlier lesson in this course (the approval mechanics from Module 2, the realistic yield-sources lesson from Module 4, or the rug-pull signals from earlier in this module) — this connects the social-engineering pattern to the technical mechanic it's exploiting. Keep this checklist: the next lesson asks you to combine it with your rug-pull and exploit checklists into one complete, pre-transaction safe workflow.
Recap
- Phishing sites, fake airdrop "claims," disguised approval requests, and guaranteed-yield offers are the four most common scam categories, and each one specifically exploits a mechanic covered earlier in this course.
- Fake airdrop claims are especially dangerous because the actual malicious action (an unlimited approval) is disguised as a routine step, and the drain often happens weeks later, obscuring the connection.
- A five-item red-flag checklist tied to specific course mechanics — not vague caution — is the practical takeaway to carry into the next lesson's complete safe workflow.