Lookalike app.claim-merkle.xyz posed as Merkl rewards claim page in reported wallet-drainer lure, MalwareTips says
In a post published October 21, 2026, MalwareTips warns of a Merkl Rewards scam that impersonates Merkl, a real platform that distributes incentives across decentralized finance applications. The reported counterfeit…
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
In a post published October 21, 2026, MalwareTips warns of a Merkl Rewards scam that impersonates Merkl, a real platform that distributes incentives across decentralized finance applications. The reported counterfeit used app.claim-merkle[.]xyz, while the genuine application identified for comparison is app.merkl.xyz. MalwareTips says the page was described as a cryptocurrency-draining lure whose claim or connect prompt was meant to lead visitors into a dangerous wallet interaction. Merkl itself is not involved. MalwareTips notes its own capture attempt did not produce a usable page, and that it did not connect a wallet, identify a contract or observe a theft; no stolen amount or operator identity is established. It advises not to use the lookalike to claim anything and to verify rewards only through the genuine service.
How the scam works
MalwareTips says the lure works because Merkl really does distribute rewards to liquidity providers and other users of decentralised-finance apps, so a 'claim your rewards' link can look routine to someone who has used those services. A shared link in a social media reply, direct message or chat group is enough to send a visitor to the lookalike, and the extra 'claim' word in the address is easy to miss on a phone.
A claim page can then ask the visitor to connect a wallet and approve one or more requests. MalwareTips explains that a connection on its own reveals a public address, but a later approval, transaction or signature can authorise another party to move tokens, and some signatures don't look like payments at all. Its lead image is an illustration with a non-working example address, not a capture of the site. MalwareTips suggests checking past wallet activity rather than reconnecting to the page to gather evidence.
Source
MalwareTips, "Merkl Rewards Scam: Fake Claim Page And Crypto Wallet Permissions Exposed" (published 21 October 2026).
Red flags
- A rewards claim page on a domain such as app.claim-merkle.xyz instead of app.merkl.xyz.
- A link to claim rewards shared in a reply, message or chat group.
- A 'connect wallet' button followed by approval or signature requests.
- Pressure to claim before a deadline.
If you were targeted
- 1Don't connect your wallet, sign, or approve anything on the page.
- 2Never type a recovery (seed) phrase or private key into a website or give it to 'support'.
- 3Check announcements only through the project's official website or accounts that you open yourself.
- 4If you connected and approved something, revoke the token approval with your wallet's or the network's approval tool and move remaining assets to a new wallet if you're unsure what you signed.
- 5If you disclosed a recovery phrase, treat the wallet as compromised and move assets to a new wallet created with a new phrase.
- 6Report the site to your wallet provider and, in the U.S., to the FBI's IC3 at ic3.gov.