Restaking & Liquid-Staking (LST/LRT) Scams

A restaking or liquid-staking scam is any con that rides the hype around liquid-staking tokens (LSTs) and liquid-restaking tokens (LRTs) — the idea that a staked asset can be represented by a tradable token and then "restaked" again to earn additional layered yield. The legitimate version of this is a real, complex corner of crypto; the scams imitate it. They take a few recurring shapes. Some are entirely fake platforms and tokens advertising restaked returns far above anything the real protocols pay. Some are look-alike clones of genuine restaking protocols, sitting on domains one character or one lookalike-letter away from the real one. And a large branch are "points" or airdrop-farming sites that promise early-user rewards for staking or restaking through them. Across all of them, the payload is the same: the site asks you to connect your wallet and approve a transaction, and that approval — not a deposit — is what hands your funds to the attacker. The distinction that matters most is that here you are almost never scammed out of a payment you send; you are scammed out of a permission you grant.

The lure arrives where crypto users already are: search ads on a protocol's name, promoted social posts, replies under real project announcements, airdrop-tracker listings, and messages hyping a "points campaign" that is ending soon. The link leads to a site that looks like a real staking or restaking dashboard — often a near-pixel-perfect clone of a genuine protocol, on a domain built from a swapped letter, an extra word, or a different top-level domain. It shows a connect-wallet button and inflated APYs or a points balance you can "claim". When you connect and click stake, restake, or claim, the transaction presented is not a stake at all: it is a token-approval or permit signature granting the site's contract permission to move your tokens, or a signature that hands over an entire asset. A wallet-drainer contract executes the moment you sign, sweeping the approved tokens — and often everything else it was pre-authorised to touch — in one or more transactions. Some drainers wait, so the loss appears minutes or days later. Points and airdrop-farming variants add urgency ("snapshot tonight") to push signing without reading, and clone sites lean on the real brand's reputation so nothing feels off until the wallet is empty.

Real restaking is genuinely confusing, which is the scam's cover: layered yields, wrapped tokens, points systems, and multi-step approvals are all normal here, so a request to sign an unusual-looking transaction does not stand out the way it would elsewhere. The audience is primed for high returns and for racing to be early, and points and airdrop framing turns that into fear of missing a snapshot. Clone domains defeat the one check most people rely on — recognising the brand — because the brand is exactly what has been copied. And the mechanism itself is quiet: connecting a wallet and approving a token feel harmless, cost almost nothing, and produce no immediate warning, so the victim often has no sense of danger until funds are already gone. The habit of clicking through wallet pop-ups makes the fatal signature routine.

Restaking campaign live: earn layered rewards + 3x points. Snapshot closes tonight — connect and restake before it ends.

You have unclaimed LRT points from the early-access program. Claim now: app-restake-rewards[.]xyz

Official migration required: connect your wallet to re-stake your LSTs on our new contract before the old one is deprecated.

DM: saw you're staking — our new restaking vault is paying way above the main protocols, early users get the biggest airdrop allocation.

Verify the destination before you ever connect, because after you sign it is usually too late. Reach real protocols only through links you already trust — a bookmark, the project's verified social profile, or a well-known aggregator — never through an ad, a DM, or a reply, and read the domain character by character. Confirm the contract address against the protocol's official documentation before interacting, and be sceptical of any yield or points offer that beats the real protocols by a wide margin. Most importantly, read what your wallet is actually asking you to sign: an unlimited token approval, a "permit", or a signature that transfers an asset is not the same as staking, and a hardware wallet plus a transaction-simulation or approval-checking tool will show you the difference. Test unfamiliar sites with a fresh wallet holding almost nothing first. When in doubt, stop — a genuine campaign will still be there after you check.