GoPlus reported that scammers launched fake projects offering USDT rewards to attract crypto users. These scams used synthetic media, including deepfake videos of well-known figures, to gain trust. According to GoPlus, the scammers’ strategy involved gaining wallet permissions before stealing funds.
The firm emphasized that the fraud campaign affected multiple users across various blockchain networks. The use of deepfake technology marked a significant rise in crypto scam tactics in 2025.
GoPlus Security Details Token Approval Scam Structure
GoPlus described a multi-step process that starts with micro-transactions. Victims receive small amounts of USDT and tokens over several days. These payments come from addresses linked to fake crypto projects claiming to offer stable rewards at no cost.
These steps build trust. The final stage involves convincing users to approve token transfers to externally owned accounts (EOAs). Once approved, scammers monitor balances and wait. When a wallet hits a specific threshold or shows signs of activity, high-speed front-running bots execute a full drain.
“This is a long game to catch big fish,”
GoPlus said in its statement. The firm warned against giving unlimited token approvals, especially to unknown EOAs.
The scam includes fake on-chain transactions and fake activity from other wallets to build credibility. GoPlus traced all linked wallet addresses and flagged them for high-risk behavior.
Deepfake Videos Used in Crypto Fraud Campaigns
Deepfake crypto scams are using synthetic videos to impersonate public figures and lure victims. Binance co-founder Changpeng Zhao confirmed this trend.
“There are deepfake videos of me on other social media platforms. Please beware,”
In Ghana, scammers faked a video of Ashesi University President Patrick Awuah Jr. The video promoted a fraudulent platform called “Crypto Klutz” and was embedded in a fake article mimicking Graphic Online. The university denied any connection and labeled the campaign fraudulent.
GoPlus included this case in its research as an example of how deepfake videos now serve as tools for crypto-related impersonation and fraud.
McAfee Identifies Signs of Deepfake Crypto Scams
McAfee reported that an average American sees three deepfake videos every day. The cybersecurity firm shared a list of common signs seen in deepfake crypto scams in 2025.
These include fake endorsements by crypto figures, offers of unrealistic rewards, and pressure tactics. The scammers also create fake exchanges and wallets that do not exist. McAfee added that requests for private keys or urgent payments are key red flags.
The findings match previous advice by on-chain investigator ZachXBT, who shared a list of steps to verify token contracts, check wallet permissions, and track approvals.
Moreover, total deepfake crypto scam losses in Q1 2025 exceeded $200 million, driven by these advanced tactics.
Wallet Approvals Remain Main Target in Scam Strategy
GoPlus Security and other experts identified token approvals as the main focus of these scams. Victims unknowingly allow transfers to EOAs. After this, bots execute automated trades to drain wallets. These bots prioritize gas speed over cost to prevent any user revocation.
ZachXBT recommended tools that show token approval history. Additionally, he advised checking for dormant permissions and limiting wallet access using reliable on-chain trackers.
Notably, GoPlus continues monitoring wallets and addresses tied to scam operations. The company confirmed that most of the fraud networks use cross-chain bridges, fake reward dashboards, and social media impersonation to spread the scams.
