Brand Protection for Crypto Exchanges: Threats and Takedowns

Brand protection for crypto exchanges: the fake sites, drainer pages, apps and support accounts to watch, and the channels that get them removed.

Quick answer: Brand protection for crypto exchanges means finding and removing the fake exchange sites, wallet-draining "airdrop" pages, copycat apps and fake support accounts that use an exchange's name, and doing it fast, because crypto transfers usually cannot be reversed. On top of the usual blocklist, hosting and registrar reports, exchanges should use crypto-specific channels: wallet blocklists, scam address databases and app store intellectual property forms.

The scale is significant. The FBI's Internet Crime Complaint Center received 181,565 complaints involving cryptocurrency in 2025, with reported losses of $11.366 billion (FBI IC3 2025 Internet Crime Report). In the sector data the APWG published for the second quarter of 2026, cryptocurrency platforms accounted for 7.2% of phishing attacks (APWG). If you run a bank rather than an exchange, start with brand protection for banks; this guide focuses on what is different in crypto.

Why crypto exchange impersonation is different

• Transfers are hard to undo. A card payment can often be disputed; a blockchain transfer to an attacker's wallet usually cannot. Speed of detection matters more here than almost anywhere else.
• The target is often a signature, not a password. Many scams want the user to connect a wallet and sign an approval, or to type a seed phrase. Once that happens, the attacker can move funds without ever logging in to the exchange.
• Login pages are relayed in real time. Fake exchange sign-in pages often pass credentials and two-factor codes to the real site as the victim types, a technique known as adversary-in-the-middle phishing.
• Communities live on messaging apps. Users expect to find help in Telegram groups, Discord servers and on X, which is exactly where fake support agents wait.
• The market never closes. Campaigns launch at weekends and around token listings, outages and price swings, so monitoring and reporting need to run around the clock.

The impersonation formats to watch

Cloned exchange login pages

Copies of your sign-in page on lookalike domains, promoted through search ads, emails about "suspicious withdrawals" and text messages. They aim to capture credentials, two-factor codes and sometimes identity documents.

Fake airdrops, rewards and token claims

Pages that announce a reward programme in your name, then ask the visitor to connect a wallet. The signature request that follows can grant the attacker permission to move the visitor's tokens, which is how wallet drainer kits empty accounts.

Copycat apps and browser extensions

Apps and extensions that use your name and logo to collect logins or seed phrases, sometimes listed in official stores and sometimes offered as direct downloads.

Fake support and fake staff

Accounts that reply to users who complain in public, then move the conversation to a private chat and ask for a seed phrase, a remote-access session or a "verification" transfer. Our guide to fake customer-support accounts covers platform reporting in detail.

Fake listing and partnership offers

Messages to token projects offering a listing on your exchange in return for a fee. Besides the direct fraud, they damage your reputation with the projects you most want to work with.

Crypto-specific takedown channels

Start with the same tracks as any phishing site: browser blocklists such as Google Safe Browsing, Microsoft SmartScreen and Netcraft, and removal requests to the host, the registrar and any CDN. Many crypto phishing sites sit behind a CDN or reverse proxy, and our guide to taking down a phishing site behind Cloudflare explains that route. Then add the channels that matter specifically to crypto users:

• Wallet blocklists. Some wallets check sites against phishing lists and warn users before they connect. MetaMask maintains its list publicly as the eth-phishing-detect project on GitHub, whose policy targets sites that impersonate established services or collect users' keys.
• Scam address databases. Chainabuse, run by TRM Labs, accepts reports of scam domains and wallet addresses and makes them searchable, which helps other platforms and investigators connect a campaign.
• App stores. Apple's App Store dispute form handles claims that an app infringes your intellectual property. It requires a statement that you own the rights or are authorised to act for the owner, and one dispute can list up to 50 apps. For Google Play, use Google's Report content on Google legal help form.
• Social and messaging platforms. Report impersonating accounts through each platform's impersonation process, and link to your verified official account for comparison.

Prevention: make the real exchange easy to recognise

• Publish one official channels page listing your domains, app store listings, social handles and community groups, and state that staff will never message users first or ask for a seed phrase.
• Build anti-phishing features into the product. A user-chosen anti-phishing code shown in genuine emails, withdrawal address allowlists and phishing-resistant multi-factor authentication all reduce what a stolen password is worth.
• Enforce DMARC on every domain you send mail from, and on domains you own but do not use for email.
• Warn inside the product. When a campaign is active, a banner in the app and on the login page reaches users faster than a blog post.
• Prepare for incidents. Decide in advance who confirms that a site is fake, who reports it and who posts a warning, so the first hour is not spent finding owners.

Running it around the clock

Measure the same things a bank would, but on a shorter clock: time from first sighting to verification, time to blocklisting in browsers and wallets, time to removal, and how often the same kit returns on a new domain. Keep evidence for every case, including the wallet addresses the scammers used, because it helps your compliance team, law enforcement and the platforms you report to. The steps for the first day of a new case are set out in found a site impersonating your brand? The first 24 hours.

Phishvoid runs this as a managed service for exchanges and other brands: every site is verified by a person, then reported to blocklists, hosts, registrars, CDNs, app stores and social platforms, with unlimited takedowns on one subscription and pricing set after a demo.

FAQ

What is brand protection for crypto exchanges?

It is the continuous detection and removal of fake sites, apps, ads and accounts that impersonate an exchange, combined with product and communication measures that make the real exchange easy to recognise.

Can stolen crypto be recovered after a phishing attack?

Recovery is uncommon, because blockchain transfers cannot simply be reversed. Funds can sometimes be frozen if they reach a service that cooperates with investigators, so victims should report quickly to the exchange and to the police.

Do wallet blocklists really protect users?

They help users whose wallets check those lists, by showing a warning before they connect or sign. They do not remove the site, so report it to hosts and registrars as well.

What should an exchange tell users about fake support?

That staff will never message first, never ask for a seed phrase or remote access, and only provide support through the channels listed on the official website.