Fake Binance refund sites sup-binance.sbs and support-binance.exchange pose as compensation checks
@pwnsydotcom reported on 1 November 2026 that fake Binance refund pages, sup-binance.sbs and support-binance.exchange, were live within a day of what the post calls “the hack”. Neither domain belongs to Binance.
- First reported
- Reports
- 1
Source: x.com · published
What happened
The account pwnsy.com (@pwnsydotcom) posted on X on 1 November 2026 that scammers had a fake Binance refund site live within a day of what the post calls “the hack”. The post names two sites. The first is sup-binance.sbs, titled “Binance Fund Recovery | Get a Refund of Your Lost Funds (SAFU)”. The second is support-binance.exchange, which shows a “Check Wallet Address” compensation page with a 2-hour countdown. Neither domain belongs to Binance. The post does not give further details of the incident it refers to, and the claims here come from that post.
How the scam works
The screenshots in the post show two black-and-gold pages that copy Binance's look. The first page offers “Get a Refund of Your Lost Funds”, calls itself an “official recovery portal” under a SAFU reserve framework and shows large recovery figures, with buttons to apply for a refund and track a case. It asks visitors for contact details, the lost amount and an “AML verification”. The second page shows a “Compensation window closes in” timer, a box asking visitors to paste a wallet address to “verify eligibility” and a list of recent claims.
The pattern is a familiar one after any crypto incident. Scammers set up fake compensation or recovery pages, use countdown timers and fake claim lists to create urgency, and then ask for a wallet address, a seed phrase or a wallet connection, or a fee to release the money. A wallet address is public and harmless on its own, but the next step on such pages is often a request to connect a wallet and sign an approval, which can let attackers move tokens, or to hand over personal details used in follow-up fraud. The post does not say which of these steps these two pages use.
Compensation after an exchange problem is normally announced by the exchange itself, through its official website and app, not through a timed form on a lookalike domain.
Source
pwnsy.com (@pwnsydotcom) on X, post of 1 November 2026 (screenshots of both pages). Not independently verified by scammers.com.
Red flags
- A “refund” or “compensation check” site on a lookalike domain such as sup-binance.sbs or support-binance.exchange.
- A countdown timer, such as a 2-hour window, pushing you to act quickly.
- A request for your wallet address, a wallet connection or an “AML verification” before any refund.
- Claims of very high recovery rates, or a list of recent claims that cannot be verified.
- A page that mentions SAFU or another official-sounding fund but is not on the exchange's own domain.
If you were targeted
- 1Do not visit sup-binance.sbs or support-binance.exchange, and do not connect a wallet or sign anything there.
- 2Check any compensation notice only inside the official Binance app or on the exchange's own website, typed yourself.
- 3Never share a seed phrase or private key, and never pay a fee to “release” compensation.
- 4If you connected a wallet or signed something, revoke approvals and move funds to a new wallet.
- 5Report the sites to the exchange and to the domain registrar.