Tether-branded 'voting rewards' page on register-tether.xyz flagged as a wallet-drainer lure
MalwareTips warns in a post dated October 23, 2026 about a Tether-branded 'wallet voting rewards' promotion, with a reported example operating at register-tether[.]xyz. The page describes a rewards allocation for acti…
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips warns in a post dated October 23, 2026 about a Tether-branded 'wallet voting rewards' promotion, with a reported example operating at register-tether[.]xyz. The page describes a rewards allocation for active users and invites visitors to vote on future distributions, leading into a wallet-connection process. MalwareTips says the site has been identified as a crypto drainer lure and that it is not Tether's website (Tether's corporate site is tether.io). It notes it could not obtain a current capture and did not test a wallet, so the exact post-connection request is unconfirmed. It advises not to continue, never to share private keys or recovery words, to read each wallet prompt separately, and to review and revoke token allowances through a trusted wallet or block explorer if already connected.
How the scam works
Wallet-drainer lures borrow a well-known crypto brand and offer something that sounds like participation, such as a reward, an airdrop or, in this case, a vote on future distributions. The visitor is led to a 'connect wallet' step. After that, the page may ask for a signature, a token allowance or a transfer, and these can be presented as part of the vote. MalwareTips stresses that connecting, signing a message, granting an allowance and sending tokens are different actions, and that calling any of them a vote doesn't change its effect. An approval or signature can let the operator move tokens later without asking again.
Because MalwareTips could not obtain a current capture and didn't test a wallet, it doesn't say exactly what the page asks for after connection. Its advice is to respond based on what was actually approved: someone who only viewed the page needs to do less than someone who signed a transaction or exposed a recovery phrase. Tether is impersonated and is not involved.
Source
MalwareTips, "Tether Wallet Voting Rewards Scam: The Fake Vote Now Crypto Trap Exposed" (published 23 October 2026).
Red flags
- A 'rewards vote' or allocation for active users on a domain that isn't tether.io.
- A 'connect wallet' button as the first step to claim or vote.
- Wallet prompts asking for signatures, approvals or allowances that don't match the action described.
- Requests for a recovery phrase or private key to 'qualify'.
If you were targeted
- 1Don't connect your wallet to register-tether.xyz or approve anything there.
- 2Never type a recovery (seed) phrase or private key into a website or give it to 'support'.
- 3Check announcements only through the project's official website or accounts that you open yourself.
- 4If you connected and approved something, revoke the token approval with your wallet's or the network's approval tool and move remaining assets to a new wallet if you're unsure what you signed.
- 5If you disclosed a recovery phrase, treat the wallet as compromised and move assets to a new wallet created with a new phrase.
- 6Report the site to your wallet provider and, in the U.S., to the FBI's IC3 at ic3.gov.