How to avoid crypto scams on BNB Chain: rug pulls, honeypots, drainers, and phishing

BNB Smart Chain combines deep liquidity and low fees with a permissionless environment where anyone can deploy contracts. That same openness creates a target-rich environment for scammers. Understanding the mechanics behind the most common attack types on BSC is more effective than any checklist. Once you know how a rug pull or a wallet drainer actually works, spotting one becomes much easier.

The main scam categories on BNB Smart Chain

Scams on BSC fall into a handful of structural categories, each with different mechanics and warning signs.

Rug pulls occur when token deployers attract liquidity through marketing, then remove it abruptly by withdrawing the LP tokens they kept after providing the initial liquidity. From the outside, the price chart looks like a rocket followed by an instant crash to near zero. The technical signature is simple: the deployer retained LP tokens that were never locked, then burned or transferred them to drain the pool. On BscScan, a rug pull leaves a clear trail: a few large Remove Liquidity transactions immediately after a sharp price spike.

Honeypots are contracts that let users buy but block selling. The contract code includes a modified transfer function or a fee set to 100% on sells, or a hidden whitelist that excludes everyone except the deployer from completing a sell. Users can buy in, watch the price rise, but cannot exit. Tools like TokenSniffer and Honeypot.is scan for these patterns automatically. If either returns a warning, do not buy regardless of how the price looks.

Approval drain attacks happen when you sign a transaction granting a contract unlimited spending authority over one of your tokens. The approval looks like a routine interaction: connecting to a DEX, entering a competition, claiming a reward. The contract quietly transfers your token balance at any later moment, sometimes weeks after you forgot about the approval. The solution is revoke.cash, which connects to your wallet and displays every active approval with a revoke button. Reviewing approvals monthly and before moving large balances is a useful discipline.

Fake support scams target users who post questions in public Telegram groups or Discord servers. Minutes later, a private message arrives from someone claiming to be official support. They will eventually ask for your seed phrase, offer to verify your wallet, or direct you to a fake recovery tool. Legitimate support teams from Binance, MetaMask, PancakeSwap, or any other major protocol will never initiate a private message and will never ask for your seed phrase, private key, or password under any circumstances.

Phishing websites replicate the visual design of legitimate platforms: PancakeSwap, Binance, MetaMask, and other high-traffic crypto sites. You land on one by clicking an ad in Google results, a link shared in a Telegram channel, or a promoted tweet. The site may function normally while capturing your credentials or presenting a wallet connection request that executes a drain. Bookmarking official URLs and accessing them only through your bookmarks is the simplest protection.

Fake airdrop and reward schemes lure users with promises of free tokens. To claim, you connect your wallet to a site or sign a transaction. The act of claiming is itself the drain. The transaction you sign either approves unlimited token spending or directly transfers assets. Legitimate airdrops from protocols you already use require no on-chain interaction beyond a claim transaction to the official contract address, which you should verify directly on the project official site.

How to verify a token or contract before interacting

BscScan is your starting point. Open the contract address on bscscan.com and check four things before anything else.

First, how old is the contract? Contracts deployed hours or days before a social media push are higher risk. Established protocols have contracts that are months or years old with extensive transaction histories.

Second, is liquidity locked? On the contract BscScan page, look at the holder list for LP tokens. If the top holder is a burn address (0x000...dead or 0x000...0000), the liquidity is permanently locked. If the top LP holder is the deployer wallet, they can remove it at will. Third-party lock services like PinkLock or Unicrypt also appear as large LP holders when used.

Third, has the contract been audited? Reputable projects link to audits from firms like CertiK, Hacken, PeckShield, or SlowMist. An audit does not eliminate risk, but an unaudited contract with no public team and locked liquidity under $50,000 is a combination of red flags.

Fourth, how distributed are the holdings? If the top ten wallets control 50% or more of the supply, and those wallets are clearly linked to each other or to the deployer, the risk of a coordinated dump is high.

TokenSniffer and DexScreener security tab run these checks automatically. They are imperfect: they can miss novel exploit patterns. But they filter out the most common template-based scams quickly.

The anatomy of a phishing attack on BSC

Understanding how phishing attacks are structured makes them easier to identify in practice. A typical attack sequence: the attacker registers a domain visually similar to a legitimate one (pancakeswaap.finance, pancakeswap-app.io), copies the frontend code, and modifies the wallet connection logic to either redirect to a drainer contract or record entered credentials.

When you connect your wallet to this fake site, your wallet shows a connection request that looks identical to a legitimate one. The site then prompts you to approve a transaction, which may be labeled as claim tokens, verify wallet, or enable trading. The actual transaction is an approval granting the drainer contract unlimited access to your tokens, or in more sophisticated attacks, a Permit signature (EIP-2612) that requires no on-chain approval transaction at all, just a signature that the attacker submits on-chain later.

The defense is to read what your wallet shows before confirming. A legitimate DEX interaction for a swap will show the specific token amounts being exchanged. If your wallet shows approve unlimited USDT to an unfamiliar address when you only wanted to swap, that is a red flag to reject immediately.

Practical habits for BSC users

Using a dedicated browser profile exclusively for crypto, with no extensions except your wallet, reduces your attack surface. Browser extensions, especially unofficial or recently updated ones, can intercept wallet interactions.

A hot wallet and cold wallet split reduces your exposure. Keep a small working balance in the wallet you connect to DeFi, and maintain a separate wallet (ideally hardware) for larger holdings. A compromised approval on your hot wallet can only drain what is in that wallet, not your cold storage.

Testing new contracts with small amounts first before committing meaningful funds is a simple discipline that catches many problems. If the contract does not behave as expected with a small amount, it will not behave better with a large one.

Checking revoke.cash before moving large balances identifies lingering approvals from interactions you may have forgotten. An approval granted months ago to a contract that has since been compromised is a silent risk that a periodic review catches.

What to do if you have already been scammed

If you believe you have been the target of a scam, the priority order is: revoke all approvals immediately via revoke.cash; move remaining assets from the affected wallet to a new wallet with a fresh seed phrase (the current wallet should be considered compromised); do not interact further with the compromised wallet or any contracts associated with the scam; document the transaction hashes, contract addresses, and amounts for any future report.

Reporting on-chain scam contracts to the BscScan community watchlist, and to the AvengerDAO safety API used by BNB Chain official safety database, helps flag the contract for other users. While recovery of stolen funds is generally not possible in a non-custodial environment, the reports reduce the reach of the same attack on the next user.