Digital Asset Threat Atlas
Crypto fraud is rarely a new idea — it is the same handful of mechanics, rewritten with a fresh interface. The Atlas maps the recurring vectors behind digital asset scams, the evidentiary trail each one leaves, and the documentation gap it exploits, so banks, exchanges, legal advisers and holders can tell an engineered loss from a genuine transaction.
Why an atlas, not a warning list
Fraud playbooks get reused across chains, languages and platforms. Naming the mechanism — not just the latest brand it is wearing — is what lets a pattern be recognised the next time it appears.
Every vector below is read the same way: the mechanism, the tell, and the evidence gap it leaves behind for a bank, exchange or investigator trying to reconstruct what happened.
How the loss happens. The technical or social step that moves an asset out of a victim's control — a signature, a fabricated balance, a counterfeit counterparty.
What usually gives it away. The detail that is hard for a scam to fake convincingly — timing, unsolicited contact, a permission request that outlives its stated purpose.
What compliance review is missing. The record — a signed log, a custody trail, a source-of-funds note — that would let a reviewer distinguish this pattern from a legitimate transaction.
Threat vectors
Filter by mechanism signal to narrow the list. Selecting more than one signal shows vectors that match any of them.
Wallet Drainers
A single malicious signature can hand a script standing permission to move everything in a wallet. Drainer kits are pushed through cloned mint pages, fake exchange support chats and compromised browser extensions, built to execute before a victim can react.
Approval Phishing
Attackers don't need a private key — they need standing permission. An unlimited token approval, once granted, can be exercised at any point in the future, often long after the phishing page that requested it has disappeared.
Fake Tokens & Honeypots
A rising balance on a dashboard means nothing if the contract blocks selling. Honeypot contracts, fabricated stablecoin balances and engineered liquidity events all rely on a holder never testing the sell function until it is too late.
Bridge Exploits
A bridge is a promise: lock an asset on one chain, mint a claim on another. When the verification layer between the two sides is compromised, the claim keeps circulating even after the underlying collateral is gone.
OTC & Cash Fraud
Large over-the-counter trades are negotiated privately, settled quickly, and rarely reviewed by a neutral third party. That combination — high value, low scrutiny — is what counterfeit proof-of-funds and disappearing intermediaries depend on.
AI-Powered Scams
Synthetic video calls impersonating founders, AI-generated audit reports, and autonomous agents authorised to sign on a user's behalf move fraud from a human timescale to a machine one — compressing the window a victim has to notice something is wrong.
Protocol Exploits
Flash-loan manipulation, oracle mispricing and re-entrancy bugs turn a protocol's own logic against its users. The exploit is often legal by the letter of the code and indefensible by the intent of the design.
Laundering Networks
Stolen or scammed funds rarely stay in one wallet. Layered mixer deposits, chain-hopping through bridges, and structured cash-outs through unlicensed exchanges are designed to break the audit trail before recovery becomes possible.
Investment Fraud
Guaranteed returns, staking yields detached from any underlying revenue, and referral structures that only pay early entrants are the oldest pattern in finance, now issued as a token instead of a signature.
Data Breaches
A leaked exchange database or a leaked KYC document set doesn't just expose identities — it hands attackers the exact personal detail needed to make a follow-up phishing message convincing.
Airdrop Fraud
Fake claim pages, wallet-draining "connect to claim" prompts, and phantom airdrops advertised through cloned project accounts exploit the genuine excitement around real distribution events.
Seen one of these patterns?
The Atlas is descriptive, not diagnostic. If you are looking at a live situation, these are the two starting points IDAA supports.
- Structured intake for suspected scams involving digital assets
- Evidence organised for legal, compliance or regulatory review
- Considered for inclusion in the Case Registry
- Not a recovery service — documentation and escalation support only
- Custody, source-of-funds and legal records structured before a transaction is challenged
- Built on the same evidence layers referenced throughout this Atlas
- Reviewed against the 1CAD Protocol Standard
- Applicable across wallets, funds, and institutional holdings