Crypto Scams in Sri Lanka: 7 Warning Signs

TL;DR

Crypto scams in Sri Lanka usually start with a message from a stranger on Telegram, WhatsApp or Facebook. They promise fast, steady profit. Watch for seven signs. They are promised returns, a stranger who contacts you, pay-to-earn tasks and pressure to recruit. The others are fees to withdraw, a fake trading app, and a "recovery" offer after a loss. Check any scheme against the Central Bank of Sri Lanka (CBSL) list of prohibited pyramid schemes, which had 26 entries on 5 August 2026. If you suspect a scam, CBSL says to report it to the nearest police station.

How common are crypto scams in Sri Lanka?

No one has published a clean count of crypto scams in Sri Lanka. Police and the national cyber agency count all online fraud together.

Here is what we do know. Police said on 13 January 2026 that online scam complaints doubled to 3,100 in 2025, from 1,528 in 2024. Crypto and forex investment fraud was among the named types, and Telegram, WhatsApp and Facebook were the named channels (Daily Mirror↗).

Sri Lanka CERT, the national cyber emergency team, had received 360 complaints of cyber-related financial fraud in 2026 by early June (Daily FT↗). That report gives no crypto breakdown.

So treat these as signs of a wider problem, not as crypto-only numbers.

The cost of the worst cases is large. Police said in October 2022 that the "Sports Chain" crypto scheme took more than Rs 14 billion from at least 8,000 Sri Lankans (Ada Derana↗). In April 2025, the CID arrested two people over a social media crypto scheme that collected about Rs 230 million in Bitcoin and Ethereum (Newswire↗).

Scam networks also operate from inside Sri Lanka. Police arrested 261 foreigners at suspected scam centres near Colombo in early May 2026. AFP's report says such groups often defraud victims through crypto fraud and fake romantic relationships (The Star, 7 May 2026↗).

What are the seven warning signs?

1. The message promises a return

"Earn 5 percent a day." "Double your money in a week." No honest investment promises this. Real markets go up and down.

CBSL's public pyramid-scheme page says such schemes "may involve cryptocurrency, plantation opportunities, ad-click activities or online investments" (CBSL↗). If a return is fixed and high, assume it is a scam until you prove otherwise.

2. A stranger contacts you first

The first contact often comes by text, Telegram, WhatsApp or a social media message. The person may be friendly. They may pose as a recruiter, a new friend or a romantic partner.

The FBI's 2025 report says crypto investment fraud was the largest source of US losses, at $7.2 billion. It says these scams were largely run by organised criminal groups in Southeast Asia using trafficked workers (FBI IC3 2025 report↗). Scammers build trust over days or weeks before they ask for money. This is often called "pig butchering".

Rule: if a stranger starts teaching you to trade, stop talking to them.

3. You must pay first to earn

Task scams work like this. You get a message about easy online work, like liking videos or boosting posts. You earn a few small payments. Then you are asked to "top up" your account to reach bigger tasks. The money you put in never comes back.

Real employers do not ask you to pay in order to work.

4. You are pushed to recruit others

If your profit depends on bringing in friends and family, it is a pyramid scheme. CBSL says Section 83C of the Banking Act No. 30 of 1988 makes running a pyramid scheme illegal. It adds that the law also covers people who promote, advertise or finance a scheme (CBSL↗).

That means sharing a scheme with friends can put you at risk too.

5. You cannot withdraw without paying more

The app shows a balance that grows. Then you try to withdraw. It says you must pay a "tax", "fee" or "verification deposit" first. After you pay, there is another fee.

The balance is a number on a screen. It is not real money. Stop paying.

6. The trading app or website looks real but is not

Scammers copy the look of real exchanges. They build apps that show fake charts and fake profits. Some are not found in official app stores and need you to download a file from a link.

Before you deposit anything:

• Search the name together with "scam" and "CBSL".
• Check whether the platform is on CBSL's prohibited list.
• Type the exchange's web address yourself instead of tapping a link.
• Be careful with any app that arrives through a link in a chat.

CBSL has not authorised any crypto exchange. In its 29 March 2023 notice it said it "has not authorized" crypto exchanges, custody services, mining or token offerings (CBSL↗). So no platform can truthfully claim CBSL approval for crypto trading. If one does, that claim is false.

7. Someone offers to recover your lost money

After a loss, a new person may contact you. They say they can get your money back, for a fee. They may pretend to be a government officer or a recovery firm.

This is a second scam. The FBI's report counted 10,516 complaints about recovery scams in the US in 2025, with $1.4 billion in reported losses. It notes that this total may include money lost in the first scam. It also saw more scammers pretending to be officials and recovery firms (FBI IC3 2025 report↗).

CBSL gives the same warning. Its 2024 advisory says fraudsters "may reappear with different schemes or offers to reimburse losses for a fee" (CBSL advisory↗). Do not pay anyone for recovery.

What is the CBSL prohibited list?

CBSL keeps a public list of schemes it has found to be prohibited pyramid schemes. On 5 August 2026 it added "TM App". Its notice that day listed 26 companies and apps in total (CBSL notice, 5 August 2026↗).

Two points to know.

• A name not on the list is not safe. The list covers only schemes CBSL has already investigated. New ones appear all the time.
• Not every name on the list is a crypto scheme. In a January 2024 advisory, CBSL named three prohibited schemes it found promoting crypto. They were Sport Chain, OnmaxDT and MTFE (CBSL advisory↗). For the other names, CBSL does not state a crypto link.

Always read the current list on the CBSL website. This article's count is a snapshot of 5 August 2026.

What are other scams I should know?

Address poisoning

This is a trick aimed at people who already use crypto. A scammer sends a tiny transfer from an address that looks like one you use. If you later copy it from your history, your money goes to them. Cointelegraph reported on 9 February 2026 that two victims lost over $62 million this way (Cointelegraph↗). Read more in my guide on sending USDT on the right network.

Couriers for cash

The FBI warned in June 2026 that crypto investment scammers now send couriers to collect cash from victims in person (FBI PSA, 15 June 2026↗). If anyone sends a person to collect money for an "investment", refuse.

Fake buyers in P2P trades

In peer-to-peer trades, scammers can send fake payment proof or pay from someone else's account. That can lead to frozen bank accounts. I cover this in P2P crypto in Sri Lanka and how to avoid a frozen account.

What should I do before I put money into any crypto offer?

Here is a short checklist.

1. Did a stranger contact me first? If yes, stop.
2. Is a return promised? If yes, stop.
3. Do I need to recruit people? If yes, stop.
4. Is the name on the CBSL prohibited list? Check the live list.
5. Can I find the company's real name, address and owners? If not, stop.
6. Can I withdraw a small amount, with no extra fee? Test this early.
7. Would I be fine losing all of it? If not, put in less.

Never share your wallet recovery phrase, one-time codes or passwords. No real company needs them.

What should I do if I think I was scammed?

Act quickly. Here are steps.

1. Stop sending money. Do not pay more fees to release your funds.
2. Save the evidence. Screenshot chats, the app, the wallet address and every transaction ID. Do not delete the chat.
3. Report to the police. CBSL's advisory says: "If you suspect a scam, report it to the nearest police station." (CBSL advisory↗).
4. You can also tell Sri Lanka CERT. It had received 360 complaints of cyber-related financial fraud in 2026 by early June. Use only contact details from its official government website, not from a chat or an advert.
5. Tell your bank if you paid from a bank account, card or app. Ask what they can do.
6. Warn the people close to you. Scammers often work through contacts.
7. Ignore recovery offers. They are a second scam.

Do not hide a loss out of shame. Scammers are professionals, and many victims are smart people.

Does Sri Lankan law protect me?

Not fully, and I want to be honest about that. CBSL has said crypto is unregulated and not recognised as an asset class in Sri Lanka. That means no regulator oversees a crypto platform. Even in big cases, justice is slow.

Police action does happen, as the CID arrest in April 2025 and the raids in May 2026 show. But getting money back is hard. Prevention is far more reliable than cure.

For the wider legal picture, read crypto regulation in Sri Lanka. To store your own coins safely, read how to store Bitcoin safely.

Quick answers

How do I know if a crypto app is a scam?

Check for the seven signs above. Search the app's name with the word "scam". Check it against the CBSL prohibited list. If a stranger sent you the link, assume the worst.

Is every crypto investment in Sri Lanka a scam?

No. But no one in Sri Lanka is authorised by CBSL to run a crypto exchange. So you must judge the risk yourself. Real platforms do not promise fixed profits or ask you to recruit.

Can I get my money back from a crypto scam?

Sometimes, but rarely. Transfers cannot be reversed. Report to the police fast and tell your bank. Do not pay anyone who promises recovery.

Where do I report a crypto scam in Sri Lanka?

CBSL says to report a suspected crypto scam to the nearest police station. Sri Lanka CERT also receives complaints of cyber-related financial fraud. Keep screenshots and transaction IDs.

Why do scammers use Telegram and WhatsApp?

Police named Telegram, WhatsApp and Facebook as channels used in online scams. CBSL's 2024 advisory also says scammers use WhatsApp and Telegram to talk to victims. These apps are free and private, so a stranger can reach you easily.

What I could not verify

• A crypto-only count of scams or losses in Sri Lanka. None has been published.
• A phone number or web form for Sri Lanka CERT. I did not confirm one, so check its official site.
• Whether every name on the CBSL list involves crypto. CBSL confirms a crypto link only for Sport Chain, OnmaxDT and MTFE.

Key Takeaways

• Crypto scams in Sri Lanka usually start with a stranger's message on Telegram, WhatsApp or Facebook.
• The seven signs: promised returns, stranger contact, pay-to-earn tasks, recruiting pressure, withdrawal fees, fake apps and recovery offers.
• CBSL's prohibited list had 26 entries on 5 August 2026. A name missing from it is not proof of safety.
• CBSL has authorised no crypto exchange, so no platform can claim its approval.
• Report to the nearest police station, as CBSL advises. You can also tell Sri Lanka CERT and your bank. Keep all evidence.
• Never pay for "recovery" and never share your recovery phrase.

About the Author

I'm Uvin Vindula — a Web3 and AI engineer based between Sri Lanka and the UK, founder of uvin.lk↗, Sri Lanka's Bitcoin education platform, and author of The Rise of Bitcoin. I write plain-English guides so Sri Lankans can use crypto without getting burned. This is education, not financial advice. See my work at iamuvin.com or reach me at [email protected]↗.