Promo hunting puts you in exactly the state an attacker wants: looking for an offer, willing to follow a link, ready to act before it expires. These six patterns come from SimpleSwap's own safety programme, picked because each one targets that state directly.
One rule covers most of it: a genuine promo code is text you paste, and nothing else. It never needs a download, a script, a wallet connection, or a signature. The moment an offer asks for more than a paste at checkout, the offer is the attack.
Published by SimpleSwap's Safety hub, which documents twelve in all. These are the ones that reach people through discounts and bonuses.
A script or code circulating as a SimpleSwap bonus. It exists to harvest credentials or push you into signing something.
Gives it away: No bonus requires running a script or connecting a wallet. A real code is text you paste at checkout, nothing more.
Read on the blog
A synthetic video of a recognisable figure promising to return double what you send. Send one, get two back — except nothing comes back.
Gives it away: No legitimate giveaway asks you to send first. That rule has no exceptions, whoever appears to be speaking.
Read on the blog
The old giveaways — broken English, crude layouts — have disappeared. Current phishing mirrors real sites closely enough that spotting the copy is no longer a defence.
Gives it away: Reach the service through a bookmark or a typed address, never through a link in a message promising a discount.
Read on the blog
Impersonated support profiles find people already asking for help in public, then request a seed phrase or a “verification” transfer.
Gives it away: Support never messages first, and never asks for a seed phrase. Neither does any promo desk.
Read on the blog
One signature on a malicious approval hands a contract permission to move your tokens. The wallet empties later, without another prompt.
Gives it away: Read what a signature authorises. A discount never needs one.
Read on the blog
Unexpected tokens appear in a wallet. Claiming them means visiting a site and signing something that empties it.
Gives it away: Tokens you did not expect are bait. Interacting with them is the attack, not the reward.
Read on the blogType the address or use a bookmark. Cloned sites copy the interface onto a near-miss domain: the swap screen works, the rate looks right, and the deposit address belongs to someone else. Read the address bar, not the design — SimpleSwap is the only official one.
Check the code against simpleswap.io/promo. If it is not on that page, it is not a SimpleSwap code, wherever you found it.
Verify the receiving address in full. Compare the middle, not just the first and last characters — that is precisely what address poisoning exploits.
Refuse any request beyond a paste. No seed phrase, no signature, no script, no wallet connection. A promo code needs none of them.
Only SimpleSwap and its official channels issue SimpleSwap codes. Third-party “promo tools”, generators and bonus scripts are not affiliated with the service, whatever branding they carry. This site is an independent reference and issues no codes of its own.
A real code is plain text you paste into the promo field at checkout on simpleswap.io. It never requires downloading anything, running a script, connecting a wallet, or signing a transaction. Codes are published on simpleswap.io/promo; anything asking for more than a paste is not a promo code.
A discount gives an attacker a reason for you to act quickly and to follow a link you did not go looking for. That is the whole mechanism: urgency plus a plausible pretext. The offer itself is the bait, not the payload.
No. Neither support nor any promotion has a use for a seed phrase or private key. A request for either identifies the sender as an impersonator, regardless of how the account looks.
On simpleswap.io/promo. This page mirrors that list and records the date it was checked, but the official page is the one that governs on the day you swap.
Six are on this page because they lead with an offer. The rest are on SimpleSwap's own hub.