Author: Biteye
I’ve bought fake coins, fake NFTs, and invested in fake projects, but today I’m experiencing a fake chain for the first time.
The appearance of the fake mainnet for GIWA last night should have made many people realize for the first time that even blockchains in the crypto space can be fake.
To some extent, this statement highlights the most terrifying aspect of current crypto scams: scammers can always find new ways to deceive you that you’ve never seen before.
So this article begins with the GIWA fake mainnet, systematically organizing the most common and最容易让人中招的几类骗局 in the crypto space in 2026.
I. X Scam
1️⃣ Fake Project Website | KOLs Share Links to Phishing Sites
At the time, Circle’s Arc mainnet had not yet officially launched its cross-chain functionality, but scammers had already set up a fake bridge called onbridge and promoted it on X: “Arc mainnet is live—now you can directly bridge USDC in.”
Scammers also specifically purchase KOL comments and shares on third-party platforms.
Some KOLs focused on airdrops and freebies directly reply to and retweet scam posts; when followers see “people they know” engaging, their vigilance naturally decreases, leading them to believe this is an officially verified entry point.
Finally, the user clicks the "cross-chain bridge" in the post, connects their wallet, and authorizes assets, but is actually redirected to a phishing website.
💡 How to protect yourself: Always return to the project’s official account to verify all entry points, and ask AI whether any link is official.
2️⃣ Fake Recruitment / Fake Investment Institutions | Business Collaboration Phishing
These scams all have the same core mechanism: they first approach you under a seemingly legitimate identity, then try to get you to run malicious files on your computer.
Scammers may impersonate VCs, investment firms, or project teams to discuss funding or partnerships, then schedule legitimate meetings via Calendly or Google Meet—only to suddenly claim there’s an issue with the meeting software and ask you to download a new Zoom, Teams, or Meet plugin.
They may also impersonate crypto, AI companies, or recruiters, using job recruitment as a pretext to ask developers to complete coding tests by downloading and running code from GitHub or Bitbucket.
The earlier steps usually appear normal, but the real attack is hidden in the final step: the meeting plugin, updater, coding test, or project code may contain malware.
Once executed, it may steal sensitive information such as browser cookies, Telegram sessions, API keys, wallet private keys, and seed phrases.
Some scammers take a long time to set the stage, while others are more impatient and immediately send a fake meeting link or GitHub project upon first contact.
💡 How to protect yourself: Never download or run any meeting links or software sent by strangers. For business communication, stick exclusively to official platforms you’re familiar with, such as Zoom or Google Meet. If the other party insists that you switch platforms or install plugins, terminate the conversation immediately.
3️⃣ Hack KOL accounts to promote or dump coins
This type of scam specifically targets influential KOLs, founders, and institutional executives in the crypto space.
Scammers typically start by sending phishing links under pretenses such as DMCA complaints, account anomalies, or security verification, tricking victims into handing over their X accounts. Once they gain access, they immediately leverage the account’s existing influence to post memes and promote projects, misleading followers into believing these are endorsed by the real account holder.
Sometimes scammers will even continue hosting Spaces and replying to comments to make their impersonation seem more authentic.
The X accounts of 0xSun, Professor Hash Wesley, and Nano Labs founder Kong Jianping were also hacked in succession, using nearly identical tactics: immediately after gaining control, the attackers posted coin promotions and trading signals, leveraging the KOLs’ existing follower bases to rapidly generate trading volume, after which the coin prices plummeted to zero.
💡 How to protect yourself: If a familiar KOL suddenly launches a coin, verify it’s really them through other channels first.
Two: Telegram Scams
1️⃣ Impersonating Telegram contacts | Fake accounts requesting loans or phishing
Scammers will create a new Telegram account, copying your friend’s profile picture, nickname, and username style to appear almost identical to them.
Then they will privately message you, start with some casual small talk, and then say they have an emergency, need to borrow USDT, want to change the receiving address, or ask you to help process a transfer.
Some scammers also research your relationship with the other person in advance, mimic the chat tone, and even know your mutual friends to make the conversation seem more authentic.
💡 How to prevent: Call directly or confirm through another commonly used channel.
2️⃣ Telegram Fake Verification | Scamming Verification Codes to Steal Accounts
Scammers may impersonate Telegram official accounts, group administrators, or the Safeguard verification bot, telling you that your account is "abnormal," your login has "expired," or that you need to "verify to join the group," then tricking you into entering a verification code, scanning a QR code, or inputting your two-factor authentication password.
Once you provide the verification code, the other party can log in to your Telegram on their device and further log out other devices and change two-factor authentication.
After gaining access to your account, they won’t just steal it—they’ll immediately browse your contacts and customer groups, using your identity to ask others for USDT and send payment addresses.
💡 How to stay safe: Never share your CAPTCHA, login QR code, or 2FA code with anyone.
Three: Phishing Entry Scams
1️⃣ Google Fake Official Site | The Top Search Result Might Also Be Fake
Many people go directly to Google to search for Hyperliquid, MetaMask, or a project’s official website.
Scammers create phishing websites that are nearly identical to the official site and use search ads, SEO, and other methods to push the fake site to the top of search results.
Users are typically less cautious when they see results they actively searched for and that appear prominently in the search results.
In August this year, users searching for Hyperliquid clicked on a fake official website that appeared at the top of search results and signed a malicious authorization, resulting in the theft of approximately 550,000 USDC.
💡 How to protect yourself: Always access the official website through the project’s official X homepage; if you’re unsure about an account’s authenticity, use XHunt to verify the official account before checking the domain.
2️⃣ Discord Fake Verification | Malicious Authorization to Steal Coins
Scammers disguise phishing entry points as legitimate Discord authentication.
After joining the group, users are prompted to click "Verify," which redirects them to a third-party website to connect their wallet. The page appears to be a routine "identity verification," but it is actually connected to a wallet drainer.
Once the user connects and signs, the scammer exploits previous approvals left by the wallet on protocols such as Morpho and Uniswap to directly transfer assets.
💡 How to protect yourself: If joining a group requires connecting your wallet or signing a message, first verify the domain and the content of the signature—don’t blindly click confirm.
3️⃣ Email Scam Airdrop | "You Have an Airdrop Waiting to Be Claimed"
Scammers send bulk emails that appear legitimate, claiming you “qualify for an airdrop,” “have tokens ready to claim,” or that “claiming is about to close.” These emails mimic official logos, layouts, and even sender names.
After clicking "Claim / Check Eligibility," you will be redirected to a fake project website prompting you to connect your wallet to check for an airdrop.
The website may trick you into signing or authorizing actions, but in the background, it connects to a Wallet Drainer; some are even more direct, asking you to enter your seed phrase or private key.
💡 How to stay safe: Avoid clicking directly on Claim links in emails. Always verify information through the official project X account.
Four: Wallet and On-Chain Scams
1️⃣ Address Poisoning | Scammed by Copying a Historical Address
Scammers will generate a wallet address that closely resembles your usual address, with the first and last few characters nearly identical.
Then, he will send a very small amount to your wallet, or even exactly 0 U, in order to make this fake address appear in your on-chain transaction history.
When you make your next transfer, if you're used to copying the address directly from your history and only checking the first and last few characters, you might easily mistake this fake address for your usual one.
In the end, you’ll find that even though you “copied a familiar address,” your funds were sent to a scammer’s wallet.
💡 How to protect yourself: Before making a large transfer via QR code, start with a small test transaction; never copy addresses directly from history—always verify the first and last several characters of the full address each time.
2️⃣ Fake Mainnet / Fake Cross-Chain Bridge | Chain IDs Are Real
GIWA officially announced the Chain ID 9134 long ago, but the mainnet has not yet been officially launched, and there is no official RPC or official cross-chain bridge.
Scammers exploit this information gap by creating a fake "GIWA Mainnet": using the real Chain ID 9134, along with a fake RPC and a fake cross-chain bridge.
After users add the network to their wallet, they notice that the Chain ID matches perfectly, leading them to mistakenly believe it is the official mainnet. This fake chain quickly spreads through the community, and some DEXs even integrate with it, further enhancing its credibility.
Many users, driven by a "race to get ahead" mentality, transferred ETH to the so-called GIWA Mainnet. In total, 1,335 addresses sent approximately 767.65 ETH to the fake mainnet, of which about 766.25 ETH was stolen by scammers, resulting in losses nearing $2 million.
💡 How to protect yourself: Before a new chain launches, only trust the RPC, Bridge, and contract addresses listed in official announcements. Even if the Chain ID matches, it doesn’t guarantee authenticity.
Five: Device or Account Compromised
1️⃣ Malicious App | Legitimately Listed, Then Poisoned via Update
FomoPeek is an ordinary on-chain monitoring tool externally; it does not require connecting a wallet or entering a seed phrase.
Scammers first list a legitimate version on the App Store, then distribute invitation codes en masse through KOLs and reward groups, luring large numbers of real users to install the app with the offer of “5 USDT just for downloading and trying it out.”
After gaining a significant user base, FomoPeek quietly added malicious code in subsequent updates, exploiting iOS vulnerabilities to access sensitive information such as wallets, private keys, and notes on the device.
💡 How to protect yourself: Don’t install unfamiliar apps just for small U rewards; keep your important wallet separate from your daily-use phone, and never store large amounts of assets on devices that have had suspicious apps installed. iOS is not completely secure—always update your system and apps to the latest versions.
2️⃣ Exchange Account Compromise | Fraudulent Identity Documents Used in Appeal
Attackers pre-collect users’ personal information, such as names, identification documents, phone numbers, and transaction records, then use forged videos, AI-generated facial images, or other social engineering techniques to impersonate the user and request security resets from the exchange, such as “lost email” or “Google Authenticator unavailable.”
Once the review is approved, scammers may change the email and 2FA to their own and pre-create APIs, withdrawal addresses, or other long-term permissions. Even if the user later regains access to the account and resets the password and authenticator, assets can still be stolen if these hidden permissions are not fully removed.
As AI face-swapping, voice cloning, and forged materials become increasingly common, multiple similar cases have occurred this year.
💡 How to prevent: Regularly check your exchange’s API keys, withdrawal whitelist, login devices, and security settings. If you notice anything unusual, don’t just change your password—also revoke all related permissions.
🌟 Final Thoughts
After reviewing these cases, you'll notice that the real strength of many scams isn't necessarily their technical sophistication, but their effective use of social engineering.
Scammers exploit familiar scenarios—such as relationships with acquaintances, KOLs, official websites, events, job postings, and verification processes—to lower your guard and then trick you into completing transfers, signing messages, entering verification codes, downloading files, or running code.
So instead of demanding perfection, it's better to isolate risks in advance and minimize the cost of any single mistake.
First, assume everyone could potentially be a scammer. Even with acquaintances, partners, or KOLs, when it comes to transfers or money, always verify through an alternative channel—never skip verification just because “you know this person.”
Second, device and asset isolation. Keep large assets and the main wallet on a dedicated device, and do not use it for everyday activities such as chatting, attending meetings, downloading software, or running code.
Third, don't click on unfamiliar links directly. Whether they come from a friend, a KOL, or a Google search, always check the domain, look up the project’s official announcement, or let AI verify it for you first.
Fourth, keep your system and commonly used software up to date. Upgrade iOS, macOS, browsers, wallets, and other applications as soon as security updates are released, as many attacks exploit vulnerabilities that are already public but have not yet been patched by users.
