If you've launched a token, you've seen it: the Telegram group fills up, and within minutes the scammers arrive. Most of these attacks are boringly predictable, which is good news, because predictable attacks can be blocked.
Here are the seven I see most often in small crypto communities, with a free fix for each.
1. The fake contract address
Someone posts "CA: 0x..." or a Solana address that looks almost like yours. Buyers in a hurry copy the first address they see.
Fix: pin your real CA, tell members to only trust the pinned one, and use a bot that deletes any other contract address posted by non-admins.
2. The lookalike admin
A new account joins with your admin's name and photo ("Dev | Support"), then DMs members offering help.
Fix: put "Admins will never DM you first" in your description and welcome message. Have a bot alert you when a new member's name closely matches an admin's, including Cyrillic or Greek lookalike letters.
3. The "support" link
"Having trouble claiming? Validate your wallet here." This is wallet-drainer bait.
Fix: block links from brand-new members for their first hours, and delete messages that combine wallet words (seed, validate, claim, sync) with a link.
4. The raid flood
Dozens of accounts join at once and spam emojis or the same message to bury real conversation.
Fix: captcha for new members, plus automatic slow-mode or join lock when joins spike.
5. The "airdrop" announcement
A fake announcement for an airdrop or presale, often with a QR code image.
Fix: only admins can post announcements; delete forwarded "airdrop" posts from unknown channels.
6. The DM-me recovery scam
"Lost funds? DM me, I can recover." Targets people who just got scammed.
Fix: a filter for recovery-scam phrases, and a pinned message saying no one in the group does recovery.
7. The compromised mod
A real mod's account gets hacked and starts posting drainer links.
Fix: give mods only the permissions they need (no "add admins"), and keep an owner-only kill switch to restrict a mod fast.
What I built
I got tired of seeing the same seven attacks, so I wrote BlockGuard, a self-hosted Telegram bot (Python, aiogram) that handles these: it keeps your real CA as the only one allowed, alerts on lookalike admins, removes scam links and floods, and gives the owner one-tap Restore and Ban buttons so a wrong deletion is never lost.
You can try to scam it yourself in the public demo group: https://t.me/blockguard_demo
If you run a small project group and want help setting it up, reach me on X at @Blockbuildlab1. Even if you don't use my bot, the free fixes above will stop most of what hits a new group.
Top comments (0)