The most common scams during shutdowns and migrations

Why scams spike at these moments

Shutdowns and migrations come with deadlines, and many people ask for help in public in a hurry. ethereum.org says support scammers search public channels for people asking questions, then send a private message offering help, aiming to get your private keys or your funds.

MetaMask likewise lists time pressure built around deadlines as a typical sign of a malicious approval request. The closer the deadline, the slower you should go.

The most common scams

Each of these has been publicly flagged by a project or wallet provider.

• 'Support' that finds you: you mention a problem on X, Discord or Telegram, and someone DMs you claiming to be official support, or replies with a 'help' link. Horizen says its team will never DM you first; MetaMask says it will never DM you offering support, has no phone support, and never contacts you about a support case on X.
• Fake migration and airdrop sites that look like the real thing. Sophon warned: 'use only official Sophon links and be careful of fake migration sites.' Abstract warned about impersonation, fake migration sites and DMs claiming to represent it. Sophon's docs add: never follow an unsolicited claim, migration or token-swap link.
• 'Approve to unlock / migrate': an approval lets a site or contract move a given token out of your wallet, and a gas-free signature such as a permit can do the same job. MetaMask's advice: check exactly what a site is requesting before you approve, and cap the amount where you can; if a site asks you to approve all your NFTs to receive an airdrop, don't fall for it, because you shouldn't need that kind of approval to receive anything.
• Tokens or NFTs you never asked for, with a message sending you to a website to claim them. MetaMask calls this a common airdrop scam: the site is most likely after your seed phrase or an approval, so don't interact; hide it. ethereum.org adds that such sites ask you to connect your wallet and 'approve' a transaction that hands your assets to the scammer.
• Paid 'recovery': someone claims they can get back your stolen or stuck money, for a fee up front. The FBI warns these operators appear on social media, in comment sections and in search results; they take an initial payment and disappear, or hand over an incomplete or inaccurate 'tracing report' and ask for more. Some pose as law firms or government bodies. Private companies cannot issue seizure orders, and law enforcement doesn't charge victims to investigate.

How to check a link

A scam link can look identical to the real one, so judge it by where it came from.

• Take links only from posts by the official account itself, or click through from the official homepage. Abstract's advice: use only the official link and cross-check it on Discord and other official channels.
• Check the account itself: make sure the @handle matches the one listed on the official website, rather than going by the picture and display name.
• Don't use links from search results, ads, comment threads or DMs. The FBI notes that fake recovery services show up in comment sections and search results.
• Check again in the wallet pop-up: MetaMask says the approval prompt shows the site's name and web address at the top so you can confirm it's the site you meant to use. Then see whether the step is a transfer, an approval or a signature.
• If you can't tell what the pop-up is doing, don't confirm it; ask in the official Discord first.

What legitimate projects don't do

If you run into any of these, you can stop right there.

• DM you first. (Horizen: its team will never DM you first. MetaMask: it will never DM you offering support.)
• Ask for your seed phrase, private keys or password. ethereum.org says no legitimate service, support agent or website will ever ask for them; MetaMask says the only times you need to enter your seed phrase are when creating a wallet and when restoring one.
• Ask you to send them your funds. (Horizen: 'We will never ask you to send your funds to us.')
• Call you, or ask for remote access to your computer. (MetaMask has no phone support. ethereum.org: never allow anyone remote access to your computer.)
• Charge a fee to 'speed up', 'unlock' or 'recover' your funds.
• DeFiExit only asks your wallet to share its address — it never asks you to sign, approve or send anything, and we never message first.

If you already clicked or signed

The faster you act, the better your chance of limiting the damage.

• If you approved a suspicious site: MetaMask says to revoke the approval as quickly as you can (for example, review and revoke it in MetaMask Portfolio) before funds are taken. Once the wallet has been drained, there is little you can do.
• If your seed phrase or private key leaked, or transactions you didn't make appear: MetaMask advises creating a new wallet right away, moving what's left into it and abandoning the old one; if you suspect a sweeper script, don't send more gas to the old wallet.
• On-chain transactions can't be reversed. Keep the transaction records and report it to your local police; in the US, you can report to the FBI's IC3.
• Expect people to DM you offering to get it back. That is the follow-up scam the FBI warns about; don't give them any money or personal information.

Related

• Exit deadlines: Sophon chain shutting down
• Exit deadlines: Abstract chain shutting down
• Exit deadlines: Blast L2 has shut down; official withdrawal site open until November 2027
• A chain is shutting down: how do I get my money out?