Home › Knowledge Hub › Fake support on Telegram & Discord
Fake crypto support on Telegram and Discord
If you post a problem in a crypto group on Telegram or Discord and a helpful support agent, admin, or moderator messages you privately soon after, it is almost certainly a scam. Real support does not work that way. The impostor will steer you toward a site or bot that asks you to validate, sync, or restore your wallet, which means handing over your recovery phrase, or toward giving them remote access to your device. One rule defeats every version: no legitimate support ever needs your seed phrase or control of your screen.
How the trap springs
You have a problem: a transaction stuck, a balance that looks wrong, a wallet that will not connect. You post about it in a project's Telegram group or Discord server, hoping someone can help. Within minutes, a direct message arrives from someone whose name and picture look official: "Support", "Admin", a moderator, a helpdesk. They are friendly, they seem to know the product, and they offer to sort it out.
That message is the scam. It works because it arrives exactly when you want help, wearing exactly the identity you were hoping to hear from.
Why the unsolicited DM is always the signal
Here is the rule that cuts through all of it: real support does not message you first.
Legitimate help is something you go to, through a channel you find on the official website. Scammers monitor public crypto groups, watch for anyone asking for help, and reach out privately because a one-to-one chat is where they can work on you without other members warning you off. The direction of contact is the entire tell. If you did not initiate it, treat it as hostile, no matter how convincing the profile looks.
Impersonators copy the exact display name and avatar of real admins, sometimes with a single changed character you would never notice. The name looking right is not verification. It is the baseline of the disguise.
What they are actually after
Once in your DMs, the impostor steers toward one of two outcomes. Both end with your funds gone.
Your recovery phrase. They send you to a website or a bot to "validate", "sync", "verify", "restore", or "migrate" your wallet, and that process asks you to enter your seed phrase or private key. There is no legitimate tool anywhere that needs your recovery phrase to fix a problem. The moment you enter it, they have full control of your wallet and empty it. No real wallet, exchange, or support service will ever ask for it.
Remote access to your device. They ask you to install a screen-sharing or remote-control app, AnyDesk, TeamViewer, or similar, so they can "help you fix it." Once connected, they can see your screen, capture what you type, and operate your wallet as if they were you. No legitimate support needs to take control of your device.
Anything heading toward either of these is the scam, however reasonable the reason sounds.
Telling real support from the impostor
The contrast is reliable. Genuine support is reached through the official site, works on the record, never messages you first, and never needs your recovery phrase or your screen. The impostor appears uninvited in your DMs, replies suspiciously fast, pushes you into a private chat, and works steadily toward your phrase or remote access. When you see the pattern on the right, you do not need to debate the individual: close it.
Discord has a few extra tricks
Discord's features give impersonators more to work with.
Watch for fake verification bots: a DM or a channel prompt telling you to "verify" by connecting your wallet to a site, or to use a bot that imitates a well-known one like Collab.Land or MEE6. Real server verification does not ask for your seed phrase or for a signature that grants access to your funds. Watch too for fake "mod" or "ticket" DMs, messages claiming a support ticket has been opened for you, or that you have been selected for help, leading to the same destinations. And be wary of announcement links in a server that has been compromised: even a real server can have a hijacked webhook or admin account posting a malicious link, so a link's presence in an official channel is not a guarantee.
For the broader habits that protect you across all these apps, our guide to impersonation scams and to Telegram and WhatsApp scams go wider.
How to get real help safely
Find support yourself, through the official source. Go to the project or exchange's official website, found through your own search or a bookmark, and use the support channel it lists there. Do not use a link someone DMs you, and do not trust a group you found by searching, since scammers run convincing fakes of those too.
When someone contacts you claiming to be support, the safe move is to not reply, and instead reach the organisation through its official channel to ask whether the contact was real. It will not have been, and you will have lost nothing.
If you have already acted
If you entered your recovery phrase anywhere, assume the wallet is compromised and move any remaining funds immediately to a new wallet with a fresh phrase. Our guide on an exposed seed phrase covers the steps.
If you granted remote access, disconnect the device from the internet, remove the remote-access app, change passwords from a different device starting with your email, and have the machine checked before you log into anything sensitive.
Then preserve the evidence, the profile, the messages, the links, and report it. And be ready for a recovery scam approach afterwards.
Red flags
- A support agent, admin, or mod who messages you first, uninvited
- A reply arriving within minutes of your public request for help
- Being moved from a public channel into private DMs
- Any request to "validate", "sync", "restore", or "migrate" your wallet
- Any request for your seed phrase, private key, or password
- A request to install screen-sharing or remote-access software
- A verification "bot" asking you to connect your wallet or sign for access
What this guide cannot do
It cannot vet individual accounts for you, and impersonators change names and avatars constantly. What it can do is give you the two rules that make the vetting unnecessary: real support never messages you first, and never needs your recovery phrase or your screen. Hold those two and the specific disguise does not matter.
This is general information, not financial or security advice.
Use Chain Pursuit's free tools to understand your options, preserve evidence, and identify possible recovery scams. Do not share your seed phrase or private keys with anyone.
Sources
Federal Trade Commission, What To Know About Cryptocurrency and Scams. https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams, on impersonation of support and businesses, and the rule that legitimate services do not ask you to pay or hand over access unexpectedly.
Cybersecurity and Infrastructure Security Agency, Avoiding Social Engineering and Phishing Attacks. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks, on unsolicited contact and requests for credentials or remote access as the core of social-engineering fraud.
The rule that no legitimate wallet, exchange, or support service requests a recovery phrase is standard guidance from every major wallet and exchange provider. Reviewed quarterly.
Frequently asked questions
A support agent messaged me on Telegram right after I asked for help. Is it real?
Almost certainly not. Real support does not message you first; it is something you reach through the official website. Scammers monitor crypto groups and DM anyone asking for help, because a private chat is where they can work on you. Treat the unsolicited DM itself as the warning sign.
The admin's name and picture match the real one exactly. Doesn't that prove it's them?
No. Impersonators copy the exact display name and avatar, sometimes changing a single character you would not notice. A matching profile is the baseline of the disguise, not verification. What matters is that real support does not contact you first and never needs your recovery phrase.
They want me to "validate" or "sync" my wallet on a website. Is that normal?
Never. No legitimate tool needs your recovery phrase to validate, sync, restore, or migrate a wallet. Any process that asks you to enter your seed phrase is designed to steal your funds. Entering it gives the scammer full control of your wallet.
They offered to fix my problem over screen share. Should I let them?
No. No legitimate support needs remote access to your device. Once connected, they can see your screen, capture what you type, and operate your wallet as you. Never install screen-sharing or remote-control software at the request of someone claiming to be support.
How do I reach real support safely?
Go to the official website yourself, through your own search or a bookmark, and use the support channel listed there. Do not use a link someone sends you in a DM, and do not trust a support group you found by searching, since scammers run convincing fakes of those too.
Is Discord verification through a bot safe?
Legitimate server verification does not ask for your seed phrase or for a signature that grants access to your funds. Be wary of bots imitating well-known ones and of DMs claiming a support ticket was opened for you. If a "verification" step wants wallet access, it is a scam.
Can a link posted in an official channel still be dangerous?
Yes. Even a real server can have a compromised webhook or admin account posting malicious links. A link appearing in an official channel is not a guarantee of safety. Verify important actions through the official website rather than acting on an in-channel link.
I already entered my seed phrase on a site they sent. What now?
Assume the wallet is compromised and move any remaining funds immediately to a new wallet with a fresh recovery phrase that has never been entered anywhere. Then secure your other accounts, preserve evidence, and report it. Our guide on an exposed seed phrase covers the steps.
A 'support agent' asked for your recovery phrase?
Eleven questions on what to do now and how to secure what's left.
Check my case