Crypto Scam Playbooks in the Chinese-Speaking World: Investment Groups, Fake Exchange Apps, Fake Support, Telegram Impersonation Groups and Fake Recovery Firms

Crypto scams in the Chinese-speaking world follow a handful of scripts: the “teacher” in an investment group, fake exchange apps, fake customer support, Telegram groups posing as Binance or OKX, and “recovery firms” that come back for a second bite after the first scam. This article breaks down the five playbooks: how each one finds you, what they say, where the cracks show, how to check for yourself, and whom to contact in each region if you have already sent money.

The short version: all five playbooks end at the same step. They want you to send coins or money to a place they choose, approve a permission in your wallet, or pay a “fee” before you can withdraw. The exchanges’ official pages all state that they will not privately ask you for funds or tell you to send coins to anyone. If a stranger adds you to a group, or someone messages you asking you to send coins or approve something, stop, check them with the exchange’s official verification tool, and if you have already sent money, go straight to the police. Do not turn to a “recovery firm”.

This article is a compilation of information. It is not investment or legal advice and does not replace help from the police. Report hotlines and the URLs and features of exchange verification tools may change. Every source in this article is marked with the date it was checked (2026-10-12); check the official websites before relying on them.

Five crypto scam playbooks: the shared warning signs in one table

The table below is my comparison based on public statements from exchanges and law enforcement. The “most obvious warning sign” column is this article’s own summary, not the wording of any single source.

Playbook	How it finds you	Typical pitch	Most obvious warning sign	How to check
Investment groups and “teachers”	Social media ads, dating apps, LINE groups	Copy my trades for sure profits; group members post screenshots of gains	You are asked to deposit on a platform or app they provide	Check the platform name and URL against police and regulator alert lists first
Fake exchange apps and websites	Download links from groups or private messages, search ads	Impressive paper profits; you must pay tax or a deposit before withdrawing	You have to pay more to take out your own money	Download apps only from the official website or official app stores; check URLs with the exchange’s verification tool
Fake customer support	Private messages after you ask in a public group, text messages, phone calls	Your account has a problem; we’ll help with your deposit	They contact you first and ask for your password, verification code or seed phrase, or tell you to send coins	Open support only from inside the exchange app or website; check accounts with the verification tool
Telegram groups posing as exchanges	You are suddenly added to a group	“ETH earn”, mining, airdrops	You are told to send coins to a certain chain or address, or to connect your wallet and approve a permission	Check group links and admin accounts with Binance Verify or OKX’s verification tool
Fake recovery firms	Searching online after being scammed, social media ads, unsolicited contact	They know prosecutors and police, have hacking skills, do crypto tracing	Fees, deposits or legal costs up front	Go straight to the police; check a lawyer’s credentials against the official register

How to spot investment groups, fake exchange apps and fake support

Investment groups and “teachers” leading trades

How it finds you: usually through social media ads or dating apps, after which you are pulled into an investment group on LINE or Telegram, where plenty of “students” echo the teacher.

The pitch: the teacher shares market commentary and group members post screenshots of their gains every day. Once you believe it, you are given an “internal platform” or app and asked to deposit.

A public case: Taiwan’s Public Television Service reported on 8 September 2026 that the Criminal Investigation Bureau broke up a fake investment scam ring and traced a platform selling LINE accounts. It held 168,281 accounts in total, 2,279 of them with a clear record of scam activity; each account sold for 6 to 40 Tether (USDT), and victims were led to download a fake stock investment app. In other words, the busy accounts in a group may have been bought in bulk (this is my inference from the case).

The warning sign: however lively the group, it always ends with you putting money into a platform they choose. A legitimate exchange doesn’t need a “teacher” to sign you up and doesn’t circulate download links only inside groups.

How to check: look up the platform name and URL. In Hong Kong, you can check the SFC’s list of suspicious virtual asset trading platforms (checked 2026-10-12; the latest entry was posted on 28 September 2026). Not being on the list doesn’t mean a platform is safe, and the SFC states that the list is not exhaustive.

Fake exchange apps and fake websites

How it finds you: download links sent through groups or private messages, search ads, and URLs that look very much like an official site.

The pitch: the app looks almost the same as a real exchange. After you deposit, the paper profits look great, and your first small withdrawal may even go through. Once you add more and try to withdraw a large amount, you hear “pay the tax first”, “pay a deposit first” or “your account has a problem and needs an unfreezing fee”.

Public cases:

Central News Agency reported on 12 February 2026 (republished by Newtalk) that police in Nantou, Taiwan, caught a scam ring that impersonated a foreign virtual currency exchange and sold fake top-up cards. Victims were told to download software the ring had built and log in with preset accounts, so they believed they had bought and held virtual currency. In fact every trading screen was fake. More than 20 people were defrauded of over NT$60 million, and the suspects have been charged under fraud, banking and anti-money-laundering laws.
United Daily News reported on 31 January 2026 that a pharmacist lost NT$800,000 to a fake investment app called “capitalgroup” between July and September 2025, and then ran into a fake recovery scheme (see below).
The Hong Kong SFC’s warning statement of 13 September 2023 said that no entity in the JPEX group held or had applied for an SFC licence, and that its claimed overseas licences were “not true”. The SFC had received complaints from investors unable to withdraw their assets, and JPEX’s earn products had advertised annual yields of 21% on ETH and 19% on USDT.

The warning sign: if you have to pay more to take out your own money, it’s a scam. OKX’s page on common scam tactics (updated 2026-09-07, checked 2026-10-12) lists “withdrawals blocked, more deposits demanded” as a sign of a scam platform.

How to check: see “How to confirm an exchange app and URL are real” below.

Fake customer support

How it finds you: you ask in a public group or on social media “my deposit hasn’t arrived, what should I do?” and a “support agent” messages you straight away; or a text message or call says your account has a problem.

The pitch: they offer to fix a stuck deposit, lift a risk-control block or process a refund, and ask for your password, verification code or seed phrase, or tell you to move your assets to a “safe account”.

What the exchanges say (checked 2026-10-12):

OKX: it will not contact you privately or tell you to buy, withdraw or transfer out crypto; signs of a fake admin include messaging you first, a username containing numbers, and asking you for any fee.
Bybit: it will not ask you to send assets to an unknown deposit address or ask for your wallet’s seed phrase. It also warns that email and SMS senders can be spoofed, so a verification tool showing “official” doesn’t mean that particular message really came from Bybit.
Binance: its verification page states that Binance will not ask you for funds or tokens through private messages.

The warning sign: real support never needs your password, verification code or seed phrase, and never tells you to send coins. As I noted in What to Do When a USDT Deposit Is Delayed, give transaction IDs and addresses only in an official support ticket, never in a public group.

How to check: always open support from inside the exchange app or from the official website you typed in yourself. If someone claims to be support, check their account with the exchange’s verification tool. When you get an email from an exchange, check for the anti-phishing code you set; how to set it up is in Exchange Account Security Settings Compared.

Telegram groups posing as exchanges: the fake Binance and OKX groups I was added to

This one happens to me a lot. On Telegram, I’m suddenly added to groups posing as Binance or OKX, full of accounts that seem to be run by AI or scam rings chatting away, with themes like “Binance & OKX ETH earn”. And they really do tell you to send ETH to some chain.

This is a textbook scam pattern, for three reasons:

Being added to an “official group” by a stranger is itself the opening move. I couldn’t find an exchange statement saying outright that it “never adds people to groups”, so this point is my own judgment. But Binance’s security article of 28 June 2024 described an almost identical case: a user was spammed heavily and added to a Telegram group using the Binance logo, where fake support staff promoted fake mining and asked the user to pay ETH for fake BNB. Once paid, the assets were mostly unrecoverable.
An “earn product” that asks you to send ETH to an address or contract is trying to take your coins. An exchange’s own earn products are subscribed from inside your account and never require you to send coins to an address someone gives you. If they ask you to send to an address, the coins go straight to them; if they ask you to connect your wallet and tap “approve”, what they get is permission to move the assets in your wallet.
Approval scams can empty your wallet without you noticing. The FBI’s liquidity mining scam warning of 21 July 2022 said scammers target people holding USDT or ETH, promise returns of 1% to 3% a day, and get victims to connect their wallet and accept the permissions in a pop-up, after which they can move an unlimited amount of assets out of the wallet. Losses since January 2019 exceeded US$70 million. OKX’s help page also warns that scammers use mining, airdrops or high returns as bait to get you to approve a contract, and that approval is what actually puts your assets at risk.

How to handle these groups:

Don’t click any link in the group, don’t connect your wallet, and don’t send coins.
To check whether a group or admin is official, look up the group link and username with Binance Verify or OKX’s official channel verification tool. OKX’s help page notes that you should read an admin’s username from the username field; what’s written in the bio doesn’t count. Binance also warns that even if a check shows “verified”, you still need to make sure any screenshot they send shows the same username.
You can report impersonating accounts inside Telegram. Telegram’s FAQ says that if someone is impersonating you, you can contact @NoToScam; OKX also suggests reporting fake admins to @notoscam.
Telegram’s privacy settings include one that controls who can invite you to groups. Limiting it to your contacts cuts down on strangers adding you to groups.
If you have already approved something, OKX advises revoking suspicious approvals, moving your remaining assets to a clean wallet, and no longer using any seed phrase or private key that may have leaked.

Why “recovery services” are almost always scams

Scam victims are desperate to get their money back, and the rings know it. On 23 February 2026, World Journal quoted Taiwan’s Criminal Investigation Bureau describing how this second-round scam works: they run ads on Facebook, Instagram and Threads or contact victims directly, claim to be lawyers, prosecutors or police, hackers, accountants or crypto tracing analysts, say they have a way to recover the money, and then collect payments labeled “fees”, “processing charges”, “deposits” or “legal costs”, often asking for 10% of the loss.

A public case: the pharmacist mentioned above, after losing NT$800,000 to the fake investment app, searched online for ways to recover it and found a person claiming to hold an international law license and a “crypto tracing analyst”. They told her the money had flowed into an online gambling platform and that they could manipulate its back end to “win it back”. She handed over NT$1.15 million in cash, converted into USDT, borrowed NT$500,000 from an insurance company and nearly mortgaged her home. It came to light only when staff at a land office noticed something was wrong and alerted the police (United Daily News, 2026-01-31). In the report, the Criminal Investigation Bureau warned: do not trust any lawyer or crypto tracing analyst who claims they can “privately recover scam losses”; recovery must go through the courts.

The US is no different. The FBI’s warning of 24 June 2024 said that from February 2023 to February 2024, victims scammed a second time by fake law firms reported losses of more than US$9.9 million. Its update of 13 August 2025 listed warning signs including: asking for payment in crypto or gift cards, claiming an official partnership with a government agency (the FBI states that no law firm is an official partner of a US government agency), saying you are on a government list of victims, and pulling you into a WhatsApp group to talk with “foreign bank processing staff” who ask you to pay a verification fee. Law enforcement does not charge victims to investigate a crime.

Here is what a genuine recovery looks like: United Daily News reported on 13 October 2025 that Taiwan’s Criminal Investigation Bureau worked with the virtual currency exchange XREX to freeze about NT$6.97 million in scam proceeds and return all of it to 20 victims. The report said that under the new rules of the Fraud Crime Hazard Prevention Act, a refund can be completed in about one to two months. Freezing and returning funds is a process between the police and the exchange, and you don’t need to pay any third party.

How to confirm an exchange app and URL are real

Use the exchange’s official verification tool

Most large exchanges have an official verification tool for checking whether a URL, email address, phone number or Telegram account is genuinely theirs. I compiled the table below on 12 October 2026 by opening each exchange’s page. Type the official website into your browser yourself and reach these tools from the footer or help center; don’t click links other people send you:

Exchange	Tool name	What you can check (per the official page)	Other warnings on the official page
Binance	Binance Verify	URLs, email, phone, Telegram, social media accounts	Will not ask you for funds or tokens through private messages; verification only helps confirm identity and does not authorize any action
OKX	Official channel verification	Telegram, phone, email, websites, Facebook, X, Discord, LINE, WeChat, QQ and more	Messaging you first and asking you for fees are signs of a fake admin
Bybit	Authenticity Check (help page)	Choose a channel type, then enter a phone number, email or URL	Senders can be spoofed, so an official result doesn’t guarantee a message really came from Bybit; use it together with the anti-phishing code
Bitget	Official channel verification	Email, URLs, social media accounts	—
KuCoin	Official verification center	Official wallet addresses, email, Telegram ID, X accounts, websites	Wallet address checks cover only KuCoin’s own business addresses
Gate	Official verification	Domains, email, phone	—
MEXC	MEXC Verify	URLs, email, phone, X, Telegram and other social media accounts	—
BingX	BingX Verify	Websites, email, Telegram, X, LINE, WhatsApp and other social media accounts	Official staff will not ask you for funds or tokens through private messages
WEEX	Contact Verifier	Websites, email, phone, Telegram ID, social media accounts	Official group admins will not contact you privately or ask you to send assets to them or a third party

Two things stand out in this table:

Every official page that mentions private messages or sending coins (Binance, OKX, Bybit, BingX, WEEX) says “we will not do this”. So if anyone messages you in an exchange’s name and asks you to send coins, there’s nothing left to guess.
A verification tool can only prove that “this account or URL is official”. It can’t prove that an email or a screenshot is genuine. Bybit warns that senders can be spoofed; Binance warns that when someone sends you a “verified” screenshot, you should check it shows the same username. Even after you’ve confirmed an official account, go back into the app to do anything.

Three checks when downloading an app

Download only from the official website or official app stores. Binance’s article on spotting fake apps says to download only from the official website, Google Play or the App Store, and notes that fake listings occasionally appear in official stores too. OKX’s Android download guide (updated 2026-09-02) warns against installing from chat groups, search ads, cloud drives, third-party APK sites or links sent by strangers.
Check the developer name. OKX’s iOS download guide (updated 2026-08-25) says the developer of the official iOS app is “OKX Inc.” and that any other developer is an imitation. Binance also recommends checking the developer information to see whether it traces back to the real company.
Check the URL before you log in. Phishing sites often use domains that differ by only a character or two. On 14 August 2026, the Hong Kong SFC added two sets of URLs to its list of suspicious virtual asset trading platforms, several dozen domains in all, every one containing “hashkey” or a similar spelling, such as hashkey-hk.vip and hash-key.us. HashKey Exchange is one of the SFC’s licensed virtual asset trading platforms. The SFC did not say for each URL whether it impersonated HashKey, so “imitation” is my inference, but it shows one thing: there can be dozens of URLs that look like the official site. It’s best to type the official site once yourself, bookmark it, and always go in through the bookmark.

What to do if you’ve already sent money: where to report in each region

Do these four things first

Stop paying. No matter how little they say is left before you can withdraw, don’t pay any more. OKX’s first piece of advice is to stop: no more payments, no more following their instructions.
Keep the evidence: screenshots of conversations, their accounts, URLs, app names, the transaction IDs (TxID) of your transfers, receiving addresses, amounts and times.
Report it to the police and notify the exchange you sent the funds from. After you file a report, the police can notify financial institutions to freeze the account and flag it as a watch-listed account (United Daily News, 2026-01-31). In the XREX case above, the freeze was also done by the police working with the exchange.
If you approved something in your wallet, revoke the approval and move your remaining assets to a new wallet, and stop using the old seed phrase.

Phone numbers and websites by region

Region	Start here	What this channel can do	Formal report
Taiwan	165 anti-fraud hotline, 165 anti-fraud website	Scam advice and verification	Report to the police; in an emergency, call 110
Hong Kong	Anti-Scam Helpline 18222	The Police Anti-Deception Coordination Centre’s 24-hour advice hotline	Report to the Hong Kong Police; in an emergency, call 999
Mainland China	96110	The Ministry of Public Security says it has three functions: early warning and dissuasion, anti-fraud advice, and reporting scam leads; it is available in all 31 provinces, autonomous regions and municipalities (rmzxw.com.cn, 2026-06-18)	Report to the local public security bureau; call 110
Singapore	ScamShield 1799 (from overseas, +65 6869 1799)	24 hours; checks whether something is a scam, gives advice, connects you to 7 banks; cannot file a police report for you	File online through the Singapore Police Force’s e-Services; in an emergency, call 999
United States	IC3 (ic3.gov)	The FBI’s Internet Crime Complaint Center; you can attach transaction records and wallet addresses	Report online to IC3 and contact your local FBI field office

None of these channels charge a fee. Anyone who asks you to pay before they can “open a case”, “recover funds” or “unfreeze” anything is not official.

If you’re new to exchanges, the basic account protections (passkeys, withdrawal whitelists, anti-phishing codes) are in Exchange Account Security Settings Compared. How to pick an exchange with public proof of reserves and a record of past incidents is in How to Choose a Crypto Exchange. How to choose a network when withdrawing to your own wallet, and why to test with a small amount first, is in How to Choose a USDT Withdrawal Network.

FAQ

I was added to a Binance or OKX Telegram group. Is it official?

Don't assume it is. OKX's help page lists signs of a fake admin, including messaging you first and asking you for any fee; Binance's verification page states that Binance will not ask you for funds or tokens through private messages. You can check group links and admin accounts with Binance Verify or OKX's official channel verification tool.

A group says I can earn yield by sending ETH to a certain chain or address. Is that real?

This is a common scam pattern. The "liquidity mining" scam the FBI warned about in 2022 lures victims into connecting their wallet and approving a permission, after which the assets in the wallet are drained; in 2024 Binance also described fake groups asking users to pay ETH for fake mining. An exchange's own earn products are subscribed from inside your account and never require you to send coins to an address someone gives you.

A fake exchange app says I must pay tax or a deposit before I can withdraw. Should I pay?

No. Being asked to pay more before you can take out your own money is a sign of a scam platform listed by OKX: withdrawals blocked and demands for further deposits. Stop paying, keep records and report it to the police.

Can I get my money back after a crypto scam?

It is possible, but it has to go through the police and the courts. Taiwan's Criminal Investigation Bureau worked with an exchange to freeze about NT$6.97 million in scam proceeds and return it to 20 victims. The bureau warns not to trust lawyers, hackers or crypto tracing analysts who claim they can recover money privately.

A recovery firm says it can get my stolen coins back. Can I trust it?

Almost never. The FBI has warned that fake law firms target crypto scam victims; from February 2023 to February 2024, victims lost more than US$9.9 million this way. Law enforcement does not charge victims to investigate a crime.

Who should I call if I've been scammed?

In Taiwan, call 165; in Hong Kong, the Anti-Scam Helpline 18222; in mainland China, 96110; in Singapore, ScamShield 1799; in the US, report at ic3.gov. Most of these are advice or reporting channels; to open a case you still need to file a formal report with the local police.