PhishPin / Brands Live Phishing Data / Crypto exchanges & wallets
Crypto exchanges & wallets phishing: which brands are copied the most
32 crypto exchanges & wallets brands are tracked in PhishPin's index. Together they have 7,364 hostnames in phishing feeds and 248 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated crypto exchanges & wallets
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | Coinbase | 22% | 77 · Critical | 1,598 | 30 |
| 2 | MetaMask | 20% | 69 · High | 1,460 | 6 |
| 3 | Trezor | 16% | 69 · High | 1,190 | 10 |
| 4 | Binance | 8% | 71 · High | 558 | 41 |
| 5 | Ledger | 6% | 69 · High | 477 | 38 |
| 6 | PancakeSwap | 6% | 52 · Elevated | 449 | 1 |
| 7 | OpenSea | 6% | 52 · Elevated | 440 | 1 |
| 8 | Trust Wallet | 5% | 62 · High | 372 | 14 |
| 9 | KuCoin | 3% | 51 · Elevated | 236 | 3 |
| 10 | Uniswap | 3% | 52 · Elevated | 219 | 4 |
| 11 | Paxful | 2% | 44 · Elevated | 157 | 1 |
| 12 | Kraken | 1% | 46 · Elevated | 50 | 15 |
| 13 | Bitvavo | 0% | 29 · Moderate | 36 | 0 |
| 14 | Aave | 0% | 32 · Moderate | 25 | 2 |
| 15 | Exodus Wallet | 0% | 28 · Moderate | 20 | 1 |
| 16 | MEXC | 0% | 40 · Elevated | 15 | 26 |
| 17 | Crypto.com | 0% | 33 · Moderate | 15 | 6 |
| 18 | Phantom Wallet | 0% | 28 · Moderate | 15 | 2 |
| 19 | OKX | 0% | 35 · Elevated | 9 | 18 |
| 20 | SafePal | 0% | 26 · Moderate | 8 | 4 |
| 21 | Bybit | 0% | 23 · Moderate | 7 | 2 |
| 22 | Bitpanda | 0% | 22 · Moderate | 4 | 4 |
| 23 | Bitget | 0% | 20 · Moderate | 2 | 7 |
| 24 | Bitfinex | 0% | 15 · Moderate | 2 | 2 |
| 25 | HTX (Huobi) | 0% | 8 · Low | 0 | 3 |
| 26 | CoinDCX | 0% | 6 · Low | 0 | 2 |
| 27 | Bithumb | 0% | 4 · Low | 0 | 1 |
| 28 | Gate.io | 0% | 4 · Low | 0 | 1 |
| 29 | Luno | 0% | 4 · Low | 0 | 1 |
| 30 | Upbit | 0% | 4 · Low | 0 | 1 |
| 31 | WazirX | 0% | 4 · Low | 0 | 1 |
| 32 | Bitstamp | 0% | 0 · Low | 0 | 0 |
Common lures against crypto exchanges & wallets
- A "withdrawal request" or "unusual login" alert pushing you to a fake exchange login.
- A "wallet validation" or "sync your wallet" page that asks for your seed phrase.
- A fake airdrop, mint or support-desk message sent through Discord, X or Telegram.
- A spoofed firmware or app update that replaces your wallet software.
Red flags
- Any site that asks for your recovery or seed phrase is stealing it, with no exceptions.
- Support staff who message you first on social media or chat are impersonators.
- The wallet or exchange link arrived through an ad, DM or email rather than a bookmark you made yourself.
If you already clicked or entered details
Move any remaining funds to a new wallet created on a clean device, revoke token approvals, change exchange passwords and 2FA, and contact the platform through its official site. Transfers on a blockchain cannot be reversed, so speed matters.
Is your crypto platform being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which crypto exchanges & wallets brands are impersonated the most?
Coinbase leads with 1,598 hostnames in phishing feeds, followed by MetaMask (1,460) as of 1 Nov 2026.
How can I spot phishing that targets crypto exchanges & wallets?
Any site that asks for your recovery or seed phrase is stealing it, with no exceptions. Support staff who message you first on social media or chat are impersonators. The wallet or exchange link arrived through an ad, DM or email rather than a bookmark you made yourself.
What should I do if I fall for a fake crypto platform page?
Move any remaining funds to a new wallet created on a clean device, revoke token approvals, change exchange passwords and 2FA, and contact the platform through its official site. Transfers on a blockchain cannot be reversed, so speed matters.