Depends on what you call a scam. I am not sure it's the right word, but duplicitous behavior and definite privacy violations (even if by negligence) are absolutely true.

They have sent out direct mailers that basically equated to a customer list leak; also I'd take a peek at the wikipedia entry about their business model, which mentions some stuff that isn't the most savory:

... Brave earns revenue from ads by taking a 15% cut of publisher ads and a 30% cut of user ads. User ads are notification-style pop-ups, while publisher ads are viewed on or in association with publisher content.

On 6 June 2020, a Twitter user pointed out that Brave inserts affiliate referral codes when users navigate to Binance

In regards to the mailers, they messed up and passed blame,

In this process, our EDDM vendor made a significant mistake by not excluding names, but instead including names before addresses, resulting in the distribution of personalized mailers.

With regards to the CEO, he made a donation to an anti-LGBT cause when he was CEO of Mozilla in 2008. He lost his job at Mozilla due to his anti-LGBT stance.

He also spreads COVID misinformation.