Researcher flags BNB Chain wallet-drainer campaign on fake "asset verification" sites such as binanceverify.live
@Malwarehunterr reported on 2 November 2026 that 17 sites imitating BNB Chain “asset verification” portals, such as binanceverify.live, carry JavaScript meant to drain USDT, and show a fake fund-lock warning demanding a 65% deposit.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Security researcher @Malwarehunterr posted on X on 2 November 2026 about a wallet-drainer campaign. The post says the researcher found 17 suspicious URLs that impersonate BNB Chain through fake crypto-asset verification portals. According to the post, analysis of binanceverify.live confirmed malicious JavaScript that tries to drain a user's entire USDT balance and can even send BNB to cover gas fees. The post also lists related domains such as binancecheck.online, bnbvf.org, bepxt.com and bscactive.net, a USDT drainer wallet address, the targeted USDT contract on the BNB Smart Chain and two hashes for the script. None of the sites belongs to BNB Chain or Binance.
How the scam works
The screenshot shows a page headed “Verify Crypto Assets”, which claims to be powered by BNB Chain's official verification and offers a single yellow “Verify Asset” button. A VirusTotal capture for one of the listed hosting addresses shows a single vendor flag.
The post adds that victims are also shown a fake fund-lock warning demanding a 65% deposit to unlock their assets. The page tries to get the visitor to connect a crypto wallet and approve a request. According to the post, the script behind the button asks the wallet to move USDT to the attacker's address and, when the wallet lacks the network fee, can top it up with a small amount of BNB so the transfer goes through. After that, the lock warning pushes the victim to pay more.
This kind of drainer relies on trust in a familiar name and on the way wallet pop-ups are worded. Connecting a wallet only shows an address, but signing or approving a token transaction can hand over real control of funds. No genuine blockchain project has a “verification” portal that must be visited to protect assets, and no real service charges a percentage deposit to release them.
Source
@Malwarehunterr on X, post of 2 November 2026 (indicator list, screenshot and VirusTotal capture). Not independently verified by scammers.com.
Red flags
- A “verify your crypto assets” portal presented as the official BNB Chain service.
- A page whose main action is to connect a wallet and approve a transaction.
- A fake fund-lock warning demanding a 65% deposit to unlock assets.
- Many near-identical lookalike domains, such as binancecheck.online and bnbvf.org.
- Malicious JavaScript reported to move a whole USDT balance and add BNB for gas fees.
If you were targeted
- 1Do not connect a wallet to binanceverify.live or any similar verification portal.
- 2Never approve a token transfer or spending permission you did not start.
- 3If you connected or approved, move remaining funds to a new wallet and revoke token approvals with a trusted tool.
- 4Never pay a deposit to release funds that a site says are locked.
- 5Report the sites to your exchange, the hosting providers and local police if you lost funds.