Recent Reports
Fake trading apps, crypto, Ponzi schemes and 'recovery' offers.
Security firm ExVul says a malicious EIP-7702 delegation let an attacker drain 9.1231 ETH (about $22,770) and TAPEETH tokens from an Ethereum wallet; the delegation stayed active afterwards.
MalwareTips warns that a "Red Kitten Crew" (RKC) airdrop page at tokendisbursement.xyz is a wallet-draining lure, not a real token distribution.
Pony.ai says fraudulent websites (some using "aiponyhk" domains) and Telegram accounts are misusing its name to pitch fake crypto investments. The company offers no investment products.
Thai police say ETO TH, an app and website (eto-th.com) presented as a stock trading platform, was fake; 39 people were arrested and assets worth more than 500 million baht seized or frozen.
Germany's financial regulator BaFin warned that fidus-capital.com may be offering banking, financial and crypto services without authorisation, and that it falsely uses FIDUS Finanz AG's identity.
The FTC alleges Ohio-based Digital Forensics Corporation took at least $60 million from panicked sextortion victims for help it didn't provide; a court has temporarily halted the business.
Foil described a wallet-drainer farm at airdrop-memecoins.netlify.app promoted by newly created X accounts posting fake airdrops with made-up contract addresses.
Foil warned that two "Accred ($CRED) Giveaway" clones at robinhood-main-dex-vtp.netlify.app and robinhood-main-dex-eqi.netlify.app drain wallets on approval.
Foil warned that claims-memecoin.netlify.app pushes a fake "Credible Finance airdrop" for $CRED with a fake contract, and told users not to connect wallets or sign.
Crypto tool NettoLens warned that @NettoLensRH and nettolens.fun copied its site and logo, and that a circulating token contract (0x629D…0D8C) is fake: it has not launched a token.
Infoblox Threat Intel detailed Noir, a crypto wallet-drainer kit that looks up its current infrastructure through DNS TXT records at _r.noir.black and steals through wallet approvals rather than seed phrases.
MalwareTips says Canowex.com poses as a crypto casino offering huge sign-up bonuses, then demands "verification" deposits before anyone can withdraw.
Scam Sniffer added airdrop-checker-l2.io to its blocklist as a wallet drainer on October 13, 2026. Airdrop "eligibility checkers" hide malicious approvals inside a normal-looking claim flow.
Scam Sniffer listed app-uniswap-fi.net, a lookalike of the Uniswap app, as a wallet drainer on October 13, 2026. The real Uniswap web app is at app.uniswap.org.
Crypto security service Scam Sniffer added claim-rewards-eigen.xyz to its blocklist on October 13, 2026 and classified it as a wallet drainer that uses Eigen-style reward branding.
Elastic Security Labs found a fake Web3 accelerator called Apex that lured crypto founders with free AI credits and audits, then spread Windows and macOS malware through two malicious npm packages.