Crypto

Scams that copy your crypto platform.

Fake bonus sites, wallet drainers, fake support accounts and giveaway streams all use your name. We find them and get them taken down before your users lose funds they can't get back.

Book a demo Request a takedown

Impersonation watchExample feed

TimeThreatWhereStatus

08:31Fake VIP bonus claimsolsticex-vip-claim.comWebsiteRemoved
09:02Wallet drainer pagesolsticex-airdrop.xyzWebsiteRemoved
09:44Fake support account@SolsticeX_SupportXRemoved
10:15Fake giveaway stream“Send 0.1 BTC, get 0.2 back”YouTubeReported
10:52Copied trading appSolsticeX 3.8 APKAPK siteRemoved
11:27API keys in public codePublic repositoryGitHubChecking

98%taken down

Of the crypto deposit scams we pursued, January to June 2026.

The user journey

Where scammers meet your users.

Scammers wait at every step of the user journey. Here's where they show up and what we take down.

Live streamSolsticeX CEO LIVE: 5,000 BTC giveawayyoutube.com/@SolsticeX-Official-LiveSend 0.1 BTC to the address on screen and get 0.2 BTC back. Ends in 15 minutes.

Discover

Fake giveaways, streams and influencer posts.

Scammers hijack channels and copy your brand and leaders to run fake giveaways and “double your crypto” streams. Anything sent is gone for good.

Live streams using your logo or your CEO
“Send to receive double” offers
Paid posts from fake influencer accounts

Social media →Executive impersonation →

EmailSolsticeX: Your account is restricted. Complete verification within 24 hours to avoid losing access: solsticex-verify.com/kyc

Fake exchanges and verification pages.

Lookalike sign-up and “verify your account” pages collect logins, ID documents and selfies, which are then used to take over real accounts or open new ones.

Lookalike domains with verify or KYC in the name
Requests for ID and selfies by email
Copies of your sign-up flow

Phishing →Brand abuse →

WebsiteSolsticeX VIP: claim your 200% bonusDeposit 500 USDT to unlock your VIP cashback. Offer ends today. solsticex-vip-claim.com

Deposit and bonuses

Fake bonus, VIP and cashback sites.

The most common crypto scam we see: lookalike sites promise a bonus, VIP reward or cashback, then ask users to deposit crypto to “unlock” it. The deposit goes straight to the scammer.

53%of the crypto deposit scams we pursued promised a bonus, VIP reward or cashback.

Scams →Phishing →

Claim your SolsticeX airdropsolsticex-airdrop.xyzConnect your wallet and approve to receive 2,500 SXT tokens.

Wallets

Wallet drainers and seed phrase phishing.

Fake airdrops and “wallet sync” pages ask users to connect a wallet, approve a transaction or type in their seed phrase. One click can empty the wallet.

Airdrops and token claims using your name
Requests to approve or sign transactions
Pages asking for a seed phrase

Phishing →Fake apps →

Alex@SolsticeX my withdrawal has been pending for two days??

SolsticeX Support@SolsticeX_SupportSorry Alex! Our team can release it now. Message us on Telegram and we’ll verify your wallet.

Getting help

Fake support and recovery scams.

Fake support accounts reply to frustrated users on X and Telegram, then ask for wallet access or a “release fee”. Fake recovery services target people who have already been scammed.

Support accounts that move chats to Telegram
Fees to release withdrawals
“We can recover your crypto” offers

Social media →Recovery scams →

Public repositorywallet-tools / config.envSOLSTICEX_API_KEY=sk_live_•••••••• · committed 3 days ago

Behind the scenes

Leaked keys, code and user data.

API keys, internal code and user lists end up in public repositories, paste sites and private channels, where they’re used to target your users or your systems.

Keys and secrets in public code
User lists and KYC data for sale
Staff logins in private channels

Dark and deep web →Exposed code →

How it works

Up and running in three steps.

solsticex.com@SolsticeXSolsticeX appSolsticeX WalletLetter of authority ✓

Step 1

Tell us what’s yours

Share your brand names, official domains, social accounts and app listings, plus a letter of authority so we can act on your behalf.

Web and domains
Social media
App stores
Messaging

Step 2

We watch around the clock

We monitor the web, social media, app stores, code sites and messaging channels for fakes. Tell us about token launches, listings or promotions and we’ll watch more closely.

solsticex-vip-claim.comFake bonus claim site

Successfully suspendedEvidence and outcome in your portal

Step 3

We take them down

Every find is checked, then reported to the platform, host or registrar with evidence. You see each case and its outcome in the Unphish portal.

Our data

What we see for crypto platforms.

What the crypto deposit scams we pursued for crypto platform clients looked like, January to June 2026.

98%

of the crypto deposit scams we pursued were taken down

90%

used the platform’s name in the web address

53%

promised a bonus, VIP reward or cashback

45%

weren’t on .com, spread across 14 other endings

What they were

Phishing and deposit sitesBonus, VIP and claim pages80%
Brand misuse sitesFake casinos and mirrors13%
Payment and campaign pagesFake payment and presale pages8%

Crypto scams move fast and copy the real platform closely. Most of the sites we found looked like the real thing and asked users to deposit crypto to unlock a reward.

Words in the fake web addresses

bonus35%
vip18%
claim10%
daily8%
promo5%

Share of the crypto deposit scam sites we pursued with each word in the address. Many used more than one.

The bigger picture

$14bn

received by crypto scams worldwide in 2025, a record

1,400%

rise in crypto impersonation scams in 2025

$837.7m

lost to investment scams by Australians in 2025

Sources: Chainalysis 2026 Crypto Crime Report (January 2026); ACCC, Targeting Scams report on 2025 (March 2026).

Unphish figures: crypto deposit scams we pursued for a crypto platform client, January to June 2026. Figures are rounded.

Anatomy of a bonus scam

How a fake crypto bonus site works.

Most of the crypto scams we pursued followed the same pattern. Tap a number to see each part.

The addressYour name plus a reward word, often on a cheap ending like .win or .vip. 90% used the platform’s name.
The offerA bonus, VIP tier or cashback that only applies today.
The countdownA timer to stop people checking before they pay.
The depositSend crypto to “unlock” the reward. The wallet belongs to the scammer.
The loginSome also ask for exchange logins or a seed phrase, so they can take everything.

83%of these sites arrived in one wave, in January and February 2026.

1solsticex-vip-claim.win

SolsticeX VIP

Claim your 200% VIP bonus 2

Exclusive for selected members

3Offer ends in00:14:52

4Deposit to unlock500 USDTTQx7…9fKp

5Connect wallet or log in

Example

Your Unphish portal

Every fake, and where it’s up to.

Fake sites, accounts and apps land in one threat feed. Approve a takedown in a click, then follow each case until it’s gone.

Threat FeedSolsticeX · last 30 days

Example data

Pipeline health

With you
In enforcement
Verifying
Resolved

P1
solsticex-vip-claim.winFake bonus claim site · Web
Awaiting review
P1
solsticex-airdrop.xyzWallet drainer · Web
In enforcement
P2
x.com/SolsticeX_SupportFake support account · X
Suspended
P3
apk-mirror-store.net/solsticexCopied trading app · APK site
Verifying

Confidence

Illustration with example data. SolsticeX is a fictional brand.

Case study

How we shut down a wave of fake bonus sites.

Case study

A crypto platform

Industry: Crypto and online gaming
Period: January to June 2026
Covered: Lookalike domains, websites and hosting

Client name withheld to protect confidentiality.

01 · Before

The challenge

A wave of lookalike sites copied the platform’s name and design, promising bonuses, VIP rewards and cashback to users who deposited crypto to “unlock” them. New sites kept appearing on new endings.

02 · After

What we did

We picked up new sites as they went live, checked each one, and reported them to registrars and hosts with evidence, grouping mirror sites so they could be taken down together.

98%of the sites we pursued were taken down

90%used the platform’s name in the address

83%arrived in one wave, January to February

Our results across all clients, threat by threat

Phishing sites99%

of the phishing sites we pursued were taken down.

Fake bonus, claim and airdrop pages
Cloned exchange logins

Phishing → Impersonation accounts99%

of the impersonation accounts we pursued on Facebook, X and Instagram were removed.

Fake support accounts
Fake giveaway and promo accounts

Social media → Scam websites98%

of the scam websites we pursued went offline.

Fake presales and investment pages
Deposit-to-unlock reward sites

Scams → Fake apps92%

of the fake apps and app download sites we pursued were taken down.

Copied trading and wallet apps
Fake download pages

Mobile applications → Executive impersonation100%

of the executive impersonations we pursued were taken down.

Fake founder and CEO profiles
Fake giveaway endorsements

Executive impersonation → Compromised websites100%

of the compromised website cases we pursued were disrupted.

Drainer pages hidden on hacked sites
Removed with the owner and host

Compromised websites →

Results across all Unphish clients, January to June 2026. Figures are rounded.

Who it’s for

Built for the teams who keep your users safe.

Every team sees different fakes. We find and remove them all.

Security and fraud

Drainers, phishing kits and leaked keys put user funds at risk.

We remove

Wallet drainer pages
Fake exchange logins
Keys in public code

Support and community

Fake support accounts reach users on X and Telegram first.

We remove

Fake support accounts
Fake Telegram groups
Recovery scam offers

Product and app

Copies of your app and wallet catch users trying to trade.

We remove

Copied trading apps
Fake wallet apps
Fake download pages

Marketing and growth

Your promotions, listings and leaders copied to sell fakes.

We remove

Fake bonus and VIP sites
Fake giveaways
Fake airdrops

Legal and compliance

Brand misuse found, actioned and recorded with evidence.

We remove

Lookalike domains
Fake executive profiles
Unauthorised brand use

Threats

Every threat crypto platforms face, explained.

PhishingFake exchange logins and wallet drainers ScamsFake bonuses, presales and recovery offers Social mediaFake support, giveaway and promo accounts Smishing and vishingFake security alerts and support calls Brand abuseYour name on fake casinos and mirror sites Mobile applicationsCopied trading and wallet apps VIP and executive impersonationFake founders and giveaway streams Dark and deep webUser data, KYC files and keys for sale PiracyExposed code and copied apps

See all threats →

For your users

Help users spot a fake exchange.

Two short notes you can adapt for your website, app, emails or community channels. One shows users how to tell you apart from the fakes. The other tells them what to do if they’ve been caught.

The copied version leaves blanks for your platform name and official details.

SolsticeXSecurity notice

How to spot a fake SolsticeX

We’ll never ask for your seed phrase or private keys, ever.
No real bonus asks you to deposit crypto to unlock it.
Our support team won’t message you first or move chats to Telegram or WhatsApp.
We don’t run giveaways where you send crypto to get more back.
Only log in at solsticex.com or in the official SolsticeX app.

Seen something suspicious? Report it at solsticex.com/report

Example

SolsticeXSupport

Think you’ve been scammed?

Stop sending funds and don’t reply to the scammer.
Revoke wallet approvals and move what’s left to a new wallet.
Change your password and reset two-step login.
Contact us through the app with the transaction details.
Report it to ReportCyber and beware of “recovery” offers.

Crypto sent to a scammer is hard to get back, so act quickly.

Example

FAQ

Crypto questions, answered.

Why are crypto platforms targeted so often?

Crypto moves fast and is hard to get back once it's sent. Scammers copy trusted platforms because users already know the name, and a fake bonus or support account can take funds in minutes.

What are the most common scams using a crypto platform's name?

Fake bonus, VIP and cashback sites that ask users to deposit to unlock a reward, wallet drainers posing as airdrops, fake support accounts on X and Telegram, fake giveaway streams, and copied apps. Of the crypto deposit scams we pursued, 53% promised a bonus, VIP reward or cashback.

What is a wallet drainer?

A fake site, often posing as an airdrop or claim page, that tricks users into connecting their wallet and approving a transaction. Once approved, it moves their funds to the scammer. Others simply ask for a seed phrase. We find these sites and get them taken down.

Can you remove fake support and giveaway accounts?

Yes. We report fake support, promo and giveaway accounts to the platforms they're on, including X, Facebook, Instagram, YouTube and Telegram, with evidence that they're impersonating you.

How long does a takedown take?

It depends on the platform, host or registrar involved and how they respond. We follow every case through until it's resolved, and you can see where each one is up to in the Unphish portal.

Do you find exposed keys or code?

Yes. We watch public code sites and the dark and deep web for exposed API keys, leaked code and user data linked to your platform, so your team can act before they're misused.

What do you need from us to get started?

Your brand names, official domains, social accounts and app listings, plus a letter of authority so we can act on your behalf. Then we start monitoring.

Other industries

See how scams hit other sectors.

Every industry gets targeted in its own way. Explore the threats we find and take down in each.

Airline and Transport

Fake booking sites, points scams and support accounts.

Banking and Financial Services

Fake bank sites, support lines and investment scams.

Retail and E-Commerce

Fake shops, sales and delivery texts.

Public Sector and Government

Fake government services and payment demands.

Lottery and Gambling

Fake betting sites, bonuses and VIP managers.

Fintech

Copied apps and fake payment requests.

Non-Profit Organisations

Fake appeals and donation pages.

Film and Entertainment

Fake tickets, streams and giveaways.

Solutions for crypto platforms

SolutionPhishing ProtectionFake bonus, login and drainer sites → SolutionSocial Media ProtectionFake support and giveaway accounts → SolutionDomain ProtectionLookalike exchange domains → SolutionMobile App ProtectionCopied trading and wallet apps →

See all solutions →

Try it

Real or fake?

Five messages a SolsticeX user might see. The exchange only uses solsticex.com, its official app and its verified social accounts. Which would you trust?

The quickest check: a real exchange will never ask for your seed phrase, a deposit to unlock a bonus, or crypto to “double”. If in doubt, open the official app.

Report a fake →

See what's using your platform's name.

Book a demo and we'll show you the fake sites, accounts and apps copying your platform right now.

Book a demo Request a takedown