Approval attacks (ice phishing): A malicious token is airdropped to a wallet unsolicited. The token itself is often harmless — the exploit happens when the user interacts with it (approving a transfer, attempting to sell) and unknowingly signs an approval granting the attacker's contract spend permission over other assets in the wallet. This is why unsolicited tokens should never be interacted with, and why periodic approval audits via tools like revoke.cash matter as basic wallet hygiene.

Address poisoning: Attackers send negligible-value transactions from addresses crafted to match the first and last few characters of a victim's frequently-used addresses. Because most UIs truncate addresses for display, a user scanning transaction history and copying an address by visual pattern-match rather than full-string comparison can send funds directly to the attacker. This is a UX failure as much as a user error — wallets that show full addresses or implement checksum-highlighting reduce this risk significantly.

Rug pull detection: On-chain signals are actually fairly detectable pre-collapse — concentrated token distribution among few wallets (visible via Etherscan/Solscan), unlocked or absent liquidity locks (checkable via team.finance/Unicrypt), and sell-restriction logic embedded in contract bytecode. Tools like TokenSniffer, RugDoc, and GoPlusLabs automate much of this scanning.

If you're interested in the full scam taxonomy — including the higher-loss but less technical categories like pig butchering and Ponzi schemes — this guide covers all 10 with mechanism-level detail and a protection checklist.