Fake Stacks sBTC '5% rewards' page on buttholewinn.pages.dev asks for wallet seed phrase, MalwareTips warns
MalwareTips reports in a post published October 21, 2026 that a fake Stacks sBTC rewards scam promoted a supposed Bitcoin reward program advertising returns up to 5%. The reported impersonation used buttholewinn.pages…
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips reports in a post published October 21, 2026 that a fake Stacks sBTC rewards scam promoted a supposed Bitcoin reward program advertising returns up to 5%. The reported impersonation used buttholewinn.pages[.]dev rather than an established Stacks destination. According to MalwareTips, the fake site's instructions lead to a request for the wallet's secret recovery phrase, which could let another person take control of the wallet. MalwareTips notes Stacks and sBTC are real and not involved, that no recovery phrase was entered or transaction performed for its article, and that the page could not be captured during its availability check (its image is an illustration). It advises never entering recovery words to join a reward program, verifying project links independently, and treating a wallet as compromised if its phrase was typed into the form.
How the scam works
MalwareTips says the lure offers an attractive yield on Bitcoin held through sBTC, a real asset on the Stacks network, so the promise can sound plausible to people who follow the project. The page is hosted on a free pages.dev subdomain that has nothing to do with Stacks.
Instead of asking for a signature, the instructions lead to a request for the wallet's secret recovery phrase. MalwareTips stresses that the phrase is the master key to a wallet: anyone who has it can recreate the wallet on another device and move everything in it, without the owner approving anything. No real reward programme needs it. Its article image is an illustration because the page could not be captured.
Source
MalwareTips, "Fake Stacks SBTC Rewards Scam: Why The 5% Offer Asks For A Seed Phrase" (published 21 October 2026).
Red flags
- A rewards page on a free hosting subdomain such as buttholewinn.pages.dev.
- A promise of up to 5% Bitcoin rewards for joining a programme.
- Instructions that end in a request for your recovery phrase.
- No link from the project's official website to the page.
If you were targeted
- 1Don't connect your wallet, sign, or approve anything on the page.
- 2Never type a recovery (seed) phrase or private key into a website or give it to 'support'.
- 3Check announcements only through the project's official website or accounts that you open yourself.
- 4If you connected and approved something, revoke the token approval with your wallet's or the network's approval tool and move remaining assets to a new wallet if you're unsure what you signed.
- 5If you disclosed a recovery phrase, treat the wallet as compromised and move assets to a new wallet created with a new phrase.
- 6Report the site to your wallet provider and, in the U.S., to the FBI's IC3 at ic3.gov.