Skip to content
Scammers.com
Crypto, investment & PonziReviewed

Tower Exchange warns of fake founder 'Jeff Maxwell', Telegram channel and towerexchange.live wallet drainer

Stablecoin DEX aggregator Tower Exchange (@TowerExchange) posted a security alert on X on 12 November 2026 saying a coordinated scam is running under its name. According to the company, an account using the name "Jeff…

First reported
Reports
1

Source: x.com · published

Illustration: Investing and crypto scams

What happened

Stablecoin DEX aggregator Tower Exchange (@TowerExchange) posted a security alert on X on 12 November 2026 saying a coordinated scam is running under its name. According to the company, an account using the name "Jeff Maxwell" (Telegram @jeffmaxw, X @Jeffmxw) falsely claims to be a Tower Exchange founder and pitches fake "pre-seed rounds" and "investor deals" in direct messages. Tower also listed a fake Telegram channel, t[.]me/TowerExchangeSupport (about 17,900 members), a wallet-drainer website towerexchange[.]live offering fake "$TOWER claims", and four fraudulent pump.fun token contracts: 0x7dc11552294cf7b020141aDa8Ee853fDc69D7326 and 0x11Bd07d760e3415Cb6b91C6642E96F3773097777 (chain 4663) and 0x05DfD210cc485A59654f62C0102d7Da082e68c66 and 0xba881606D9c25FF264A0EDa23b252a5Ae84759E3 (chain 5042). Tower says it has not launched any token. towerexchange[.]live is also on Scam Sniffer's public scam-domain blocklist. Do not join, buy, claim or connect a wallet to any of these, and ignore DMs offering allocations.

How the scam works

Crypto phishing and draining sites ask you to connect a wallet, sign a transaction, 'claim' a token, or paste a recovery phrase. Once you approve the request, the operator can empty the wallet. Address-poisoning works differently: the operator sends dust or zero-value transfers from a look-alike address so that, later, a hurried copy-paste from the transaction history goes to them instead of to the address you meant. Always check every character of an address, and never connect a wallet or enter a seed phrase on a site you reached from a message, a pop-up or a look-alike URL. Official wallet and exchange brands named in a lure are not involved.

Source

Source: https://x.com/TowerExchange/status/2120813556622877085 (@TowerExchange, Nov 12, 2026, 4:38 AM ET)

Red flags

  • A site or bot that asks you to connect a wallet, sign a transaction, claim a token or paste a recovery phrase.
  • A deposit or payment address that only matches the start and end of the address you used before.
  • A 'support' or 'founder' account that writes first on Telegram, X or email and pushes a live link or a contract address.
  • A promise of a guaranteed return, a free mint or a sudden airdrop from a look-alike brand.

If you were targeted

  1. 1Never paste a seed phrase or approve a wallet connection on a site you reached from a message or a look-alike URL.
  2. 2Check every character of an address, not just the first and last digits, and confirm it in a saved official entry.
  3. 3If funds have left the wallet, stop further approvals, move what remains to a new wallet you control, and document the transaction hashes.
  4. 4Report the site, contract or account to the real project's official channels and to a blockchain-abuse desk if one exists.

Wallet-drainer page multi-xchange.firebaseapp.com poses as WalletLink connection service

ScanMalware posted on X on 12 November 2026 that multi-xchange[.]firebaseapp[.]com is a confirmed scam. Its scan report describes a wallet-drainer phishing page posing as WalletLink, a wallet-connection brand, on a fr…

  • multi-xchange.firebaseapp.com
  • Firebase subdomain; Telegram bot token in page script
  • Crypto wallet phishing, drainers and address-poisoning cluster (12 Nov 2026)
Reported Nov 12, 20261 report

Fake Zerion crypto-wallet site zerion-inc.webflow.io flagged as phishing

Anti-phishing project PhishDestroy posted on Mastodon on 12 November 2026 that zerion-inc[.]webflow[.]io is a suspected phishing site. Its domain record shows a page copying Zerion's wallet homepage ("Crypto Wallet fo…

  • zerion-inc.webflow.io
  • Webflow subdomain; VirusTotal 17/92; URLScan brand: Zerion
  • Crypto wallet phishing, drainers and address-poisoning cluster (12 Nov 2026)
Reported Nov 12, 20261 report

Address-poisoning wallet 0x7f8226aa…3319 took $11.7K in USDC on Ethereum, ScamSniffer says

Web3 anti-scam service Scam Sniffer (@realScamSniffer) reported on X on 12 November 2026 that a user lost about $11.7K in USDC on Ethereum to an address-poisoning attack. The funds went to 0x7f8226aa9f47ec9e0db0b55253…

  • Wallet 0x7f8226aa9f47ec9e0db0b552537e3236fd773319 (Ethereum; lookalike of 0x7f8215e3…9073319)
  • Crypto wallet phishing, drainers and address-poisoning cluster (12 Nov 2026)
Reported Nov 12, 20261 report

Phishing alert: icp0.io page impersonates ICPesa Bitcoin payment gateway

The phishing-alert account @TheThreatWire posted on X on 12 November 2026 (Phishing Alert #141) that hxxps://2q7ci-niaaa-aaaad-qg66q-cai.icp0.io/index.html is a phishing page impersonating ICPesa, a Bitcoin and ckBTC…

  • 2q7ci-niaaa-aaaad-qg66q-cai.icp0.io
  • Path /index.html; hosted on shared icp0.io gateway domain
  • Crypto wallet phishing, drainers and address-poisoning cluster (12 Nov 2026)
Reported Nov 12, 20261 report