Lookalike TokenWorks page vote-tokensworks-net.pages.dev lures wallets with fake voting rewards
MalwareTips warned on 2 November 2026 that vote-tokensworks-net.pages.dev imitates the TokenWorks studio with a fake rewards vote and treasury allocation, and was identified as a wallet-draining scheme. The real site is token.works.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips published a warning on 2 November 2026 about a “TokenWorks Voting Rewards” scam. According to the report, a lookalike page invites holders to vote on an upcoming rewards date and promises an early allocation from a treasury pool it calls TPF, short for Treasury Pool Funds, in return for taking part. The page is at vote-tokensworks-net.pages.dev, which adds an extra “s” to the TokenWorks name. MalwareTips says the real TokenWorks website is token.works, which describes an onchain creative studio, and that the scam page sits outside the project's established domain. The campaign was identified as a wallet-draining scheme. TokenWorks is the brand being impersonated.
How the scam works
The pretext is community governance. A vote on a rewards date sounds like a small decision rather than a financial transaction, and a prominent “Vote” button makes the page look like an ordinary project update. MalwareTips reports that wallet connection is introduced after the voting control. Wallet connection can be legitimate for real apps, and its presence alone does not prove fraud, but a connection request identifies an account, and an approval, transaction or signed authorisation can grant much more. For compatible tokens a spending approval can give another address permission to move an asset, and an off-chain signature can support a financial authorisation as well.
MalwareTips says it captured the public page without connecting a wallet or approving a request, so the exact contract, signature and transfer sequence were not reproduced. It also stresses that its warning does not accuse the genuine studio or the companies whose wallet names appear in a connection dialog.
Its advice is to judge a wallet request by its actual permissions, not the word “Vote”, to stop if the wallet shows an unexpected network or account, and to ask the real project about any offer through its established channels, sending only the suspicious address and a screenshot. A reply demanding your seed phrase should end the conversation, even if the account uses the studio's name and profile image.
Source
MalwareTips, “TokenWorks Voting Rewards Scam: The Fake TPF Allocation And Wallet Trap”, 2 November 2026. MalwareTips did not test the wallet flow.
Red flags
- A page on vote-tokensworks-net.pages.dev instead of the real project's token.works.
- A TokenWorks name with an extra “s” that is easy to miss.
- An “early allocation” from a treasury pool in exchange for a simple vote.
- A Vote button that leads to a wallet connection or approval.
- A reply from a supposed project account that asks for your seed phrase.
If you were targeted
- 1Do not connect a wallet to vote-tokensworks-net.pages.dev or approve anything from it.
- 2Check any rewards or governance announcement on the project's official website, token.works, and its established channels.
- 3Read what a wallet request actually permits; decline spending approvals and signatures you cannot explain.
- 4Never share a seed phrase, even for an authenticity check.
- 5If you connected or approved, move assets to a new wallet and revoke approvals with a trusted tool.