Crypto Scams Targeting Businesses: Address Poisoning, Wallet Drainers and Fake Payments

Most warnings about crypto scams are written for individual investors. But businesses that accept or hold crypto are attractive targets too: they move larger amounts, they send and receive payments every day, and their staff are busy. A copied address, a convincing screenshot or a support message that looks official can cost more than a month of profit. The good news is that almost every scam aimed at merchants relies on a handful of tricks, and each one has a simple defense. If you are still deciding whether to take crypto at all, start with our overview of whether crypto payments are safe.

This guide covers the scams hitting businesses in 2026: address poisoning, wallet drainers, fake payment confirmations, overpayment and refund tricks, impersonation and fake tokens, plus a protection checklist and what to do if you are hit.

Why Scammers Target Businesses

Scammers go where the money is and where mistakes are likely. Businesses that work with crypto offer both.

• Frequent transactions. A business sends and receives payments every day, which gives scammers many chances to slip in a wrong address or a fake confirmation.
• Larger amounts. Supplier payments, payroll and treasury transfers are often far bigger than personal transfers.
• Several people involved. Owners, accountants, support staff and developers all touch payments, and the weakest link decides the outcome.
• Time pressure. Customers want orders shipped and suppliers want to be paid, so staff move quickly.
• Final settlement. Crypto payments cannot be reversed by a bank. Once funds leave your wallet, getting them back is difficult.

None of this makes crypto unsafe for business. It means the controls that protect you are your own, and they need to be deliberate.

The Scale of Crypto Fraud

The numbers show why this matters.

These are reported losses, so the real figures are higher. Investment fraud aimed at individuals makes up the largest share, but impersonation, address poisoning and phishing affect businesses directly.

Address Poisoning

Address poisoning is one of the simplest and most effective scams in crypto, and businesses that send many payments are prime targets.

How it works:

1. The scammer watches the blockchain for wallets that send payments regularly, such as a business paying a supplier.
2. They generate a lookalike address that starts and ends with the same characters as the supplier’s real address.
3. They send a tiny or zero-value transfer from that lookalike address to your wallet, so it appears in your transaction history.
4. Next time someone on your team copies “the supplier’s address” from recent transactions, they copy the fake one.
5. The payment goes to the scammer, and it cannot be reversed.

The scale is enormous. A 2025 academic study counted about 270 million address-poisoning attempts on Ethereum and BNB Smart Chain over two years, reaching around 17 million victims and causing at least $83.8 million in confirmed losses. In December 2025, a single victim reportedly lost about $50 million in USDT to this trick.

How to defend against it:

• Never copy a payment address from your transaction history.
• Save verified supplier addresses in an address book or whitelist and pay only from there.
• Check the full address, not just the first and last few characters.
• Send a small test payment before a large one, and confirm receipt with the recipient through a separate channel.
• Ignore unexpected tiny or zero-value transfers. They are often bait.

Wallet Drainers and Malicious Approvals

A wallet drainer is malicious code, often sold as a ready-made kit, that empties a wallet after the owner signs the wrong thing. It does not need your seed phrase. It needs one signature.

On networks like Ethereum, tokens can be moved by a smart contract if you have approved it. Legitimate apps use approvals all the time. Drainers abuse the same mechanism: a fake website asks you to “claim an airdrop”, “verify your wallet” or “connect to receive a payment”, and the signature you give actually grants the attacker permission to move your tokens.

Common delivery routes include:

• fake airdrop and reward pages
• hacked social media accounts of real projects posting malicious links
• search and social ads that lead to lookalike websites
• fake browser extensions and wallet apps
• messages pretending to be a customer, partner or payment provider

How to defend against it:

• Never sign a transaction or message you do not fully understand, especially one marked “approve”, “permit” or “set approval for all”.
• Use a separate wallet for interacting with apps, and keep business funds in a wallet that never connects to websites.
• Keep large balances in a hardware wallet or a multi-signature wallet.
• Review and revoke old token approvals regularly, for example with the token approval checker built into Etherscan.
• Protect seed phrases offline. Our guide to seed phrase security explains how.

Fake Payment Confirmations and Screenshots

This scam targets merchants directly. The buyer claims to have paid and pushes you to ship or deliver before you check.

Typical versions include:

• a screenshot of a wallet “sent” screen, edited or taken from another transaction
• a real transaction hash that belongs to a different payment
• a payment made with a fake token named “USDT” or “USDC” that has no value
• a transaction on a test network, which looks real but carries no money
• an email that imitates your payment gateway and says the order is paid
• a story about sending to the wrong network, followed by pressure to ship anyway

How to defend against it:

• Never ship or deliver based on a screenshot or a message.
• Confirm every payment in your payment gateway dashboard or on a block explorer: the exact amount, the token’s official contract, your receiving address and the required confirmations.
• Make it a rule that only the system marks orders as paid. Staff should not override it because a customer is in a hurry.

A payment gateway that verifies payments on chain and updates the order automatically removes most of this risk, because the decision no longer depends on what the customer says.

Overpayment and Refund Scams

Overpayment scams play on a merchant’s wish to be fair.

How it works: the “customer” sends more than the invoice amount, or claims to have done so, and asks you to refund the difference quickly, often to a different address. In some versions the original payment never confirms, is made with a fake token, or comes from stolen funds that are later traced and frozen. Either way, you end up sending real money out.

Refund scams follow the same pattern: a buyer requests a refund to a new address, claims the order never arrived when it did, or pays with one method and asks for a refund in another.

How to defend against it:

• Refund only after the original payment is fully confirmed on chain.
• Refund only the verified excess, in the same coin and network.
• Send refunds only to the original sending address or to an address verified through your normal customer account, never to a new address supplied in a hurry.
• Write a refund policy and follow it every time.

Our guide to crypto payment refunds explains how to set up a refund process that is fair to customers and safe for you.

Impersonation and Fake Support

Impersonation is the fastest-growing category of crypto scam, according to Chainalysis. Scammers pretend to be someone you trust and ask you to act.

Common forms aimed at businesses:

• Fake support from your wallet, exchange or payment provider, usually on Telegram, X or Discord, asking for your seed phrase or a “verification” signature.
• Supplier invoice fraud. An email that appears to come from a supplier says its wallet address has changed. The account may be hacked or the domain slightly different.
• Fake executives. A message that seems to come from the owner or CFO asks an employee to make an urgent transfer.
• Fake compliance or government notices that demand payment or wallet access to “avoid a freeze”.

How to defend against it:

• No legitimate company will ever ask for your seed phrase or private keys.
• Confirm any change of payment address with a phone call to a number you already have, not one in the message.
• Require two people to approve large or unusual payments.
• Contact providers only through their official websites and dashboards.

Fake Tokens and Dust Attacks

Anyone can create a token and give it any name, including “USDT” or “USDC”. Scammers send these worthless tokens to business wallets to make fake payments look real, to lure staff into selling them on a malicious site, or to plant lookalike addresses in your history.

How to defend against it:

• Check the token contract address, not the name or logo.
• Do not interact with tokens you did not expect, and do not try to sell or swap them.
• Use a gateway that accepts only the official contracts for each coin.

Red Flags at a Glance

How to Protect Your Business

The best defense is a few simple rules that everyone follows every time.

1. Separate your wallets: one for receiving payments, one for operations and cold storage for reserves.
2. Use an address book or whitelist for every outgoing payment.
3. Require two-person approval for large payments and for any change of payment details.
4. Never trust screenshots; let your gateway confirm payments on chain.
5. Keep seed phrases offline and limit who knows where they are stored.
6. Use hardware or multi-signature wallets for significant balances.
7. Revoke old token approvals on a regular schedule.
8. Train staff on these scams at least twice a year, including new hires.
9. Write down your payment and refund policies so nobody has to improvise under pressure.
10. Keep records of transaction hashes, addresses and approvals for every payment.

What to Do If You Are Hit

If a scam succeeds, act quickly. Speed improves the small chance of recovering funds and limits further damage.

1. Stop all outgoing payments from the affected wallet and stop talking to the scammer.
2. Secure what is left. If a wallet may be compromised, move remaining funds to a new wallet created with a new seed phrase on a clean device.
3. Revoke token approvals linked to the affected wallet.
4. Record everything: transaction hashes, addresses, times, messages, emails and website links.
5. Report it. In the US, file a complaint with the FBI’s IC3 and contact local law enforcement. Report fake accounts and websites to the platforms that host them.
6. Alert issuers and exchanges. If stolen funds are stablecoins or reach an exchange, the issuer or exchange can sometimes freeze them, especially when law enforcement is involved.
7. Trace the funds. Blockchain transactions are public, and our guide on how cryptocurrency tracking works explains how investigators follow stolen money.
8. Beware of recovery scams. Anyone who contacts you promising to recover your funds for an upfront fee is almost always another scammer.
9. Fix the weakness that allowed the attack, and update your procedures and training.

How a Non-Custodial Payment Gateway Helps

Many merchant scams depend on a person making a judgment call: is this screenshot real, is this the right address, is this token genuine? A good payment gateway takes those calls away from your staff.

With Bcon Global, each order gets its own payment request with the exact amount, coin and network. The gateway watches the blockchain, accepts only the official token contracts, and marks the order as paid only after the payment is confirmed on chain. Funds go straight to your wallet with a flat 1% fee, and because the gateway never holds your money, there is no gateway account balance for scammers to target.

Crypto scams aimed at businesses are not technically sophisticated. They exploit habits: copying an address from history, trusting a screenshot, signing a message without reading it or helping a customer who seems to be in a hurry. That is why the best protection is not expensive software but clear rules, followed every time.

Combine those rules with a payment gateway that verifies every payment on chain and sends funds straight to a wallet you control, and crypto becomes one of the safest ways to get paid. The money is final, the record is public and the decision about whether a payment is real is made by the blockchain, not by whoever sounds most convincing.