Recently, I noticed a phenomenon in the security community that deserves attention: the number of victims of fake mining pool scams is clearly increasing. The SlowMist AML team discovered this trend from reports of thefts, and I think it’s necessary to delve into how these scams actually operate.

These scam groups mainly target Web3 newcomers, exploiting their unfamiliarity with the market and their desire for high returns. Their tactics appear very “legitimate,” but in reality, they are carefully designed traps. A common method is claiming that funds need to be in the pool for a period of time to generate profits, so newcomers don’t realize they’re being scammed in a short time. Even more ruthless, scammers keep pressuring victims, saying that if they don’t continue to invest, they can’t withdraw their principal, forcing victims to keep shelling out money.

I’ve noticed that scammers especially like to impersonate official groups on Telegram. Some groups have thousands or even tens of thousands of members, looking very “legitimate,” but in fact, the online membership may be less than a hundred. Newcomers often judge authenticity based on group size, which just plays into the scammers’ hands. All content within these fake mining pool scam groups, including so-called “chats,” are carefully crafted bait.

The scammers’ operation process is also quite meticulous. They provide detailed tutorials on how to check mining pool staking, download wallets, and transfer funds. Once you send money to their contract address, you receive a rebate. At this point, you might want to invest more to earn more, and that’s when you fall into the trap. Some scammers are even more ruthless, offering fake tokens as rebates—newcomers can’t tell the difference until they try to trade, only to find they’re worthless.

There’s also a variant where they lure you with phishing links to perform malicious authorizations. Scammers impersonate official sources claiming there’s a “super node mining event.” If you click the link and follow the instructions, your funds are directly stolen.

The most cunning tactic is to first trick you into a fake platform, then manipulate data to create a false impression of “profitability.” You see your account balance growing, deceived by the “investment ability” fabricated by the scammer. Then, scammers invite you to join a mining pool, requiring you to deposit 5% or 8% of your total assets in USDT daily to activate the pool. Under the threat of “not being able to withdraw your principal without recharging,” you end up depositing more money each day. The core of this scheme is a Ponzi scam.

Honestly, these fake mining pool scams don’t rely on advanced technology, but to Web3 newcomers, their novel methods and seemingly legitimate processes are especially confusing. Inexperienced people are very likely to fall into the trap.

My advice is: First, be wary of any promises of excessively high returns, as that’s usually a scam signal. Second, avoid granting permissions casually, especially don’t click on unfamiliar links to authorize transactions. Third, stay skeptical—don’t judge authenticity solely by group size, and always verify multiple sources before transferring funds.

The reason these scams can deceive people ultimately comes down to exploiting newcomers’ information gaps and their eagerness to make quick money. Learning more and staying alert are the best defenses against mining pool scams.