Crypto phishing sites that mimic explorers, bridges and DEXs

A cloned front-end costs almost nothing to build and nothing to host. The attacker copies a real interface, buys a lookalike domain, buys search ads against the real project's name, and waits for a wallet connection. The defence is not vigilance — it is a fixed habit: reach every interface through a bookmark you created from a source you verified, and never through search.

Why the front-end is the soft target

Blockchains are difficult to attack and web pages are not. The contracts underneath a major DEX have been audited and are running the same code for everyone; the domain that renders them is a DNS record someone can approximate for a few dollars a year.

Three properties make this the highest-yield attack in crypto. Approvals and signatures are irreversible and settle in seconds. Interfaces are visually generic, so a competent clone is indistinguishable from the original to anyone who is not checking the URL character by character. And the moments when people are most likely to reach for search rather than a bookmark — a new chain launching, a bridge they use once a quarter, an explorer they need right now to check a stuck transaction — are exactly the moments an attacker can predict and buy ads against.

The result is that the same handful of formats keep working.

Format one: the fake governance or rewards page

governance-arc[.]com is a confirmed wallet drainer. Documented by PCrisk as the "Arc Community Rewards" scam, it clones Arc's visual design, presents a fabricated governance proposal, and offers a "Vote Now" button. The button opens a wallet connector supporting 27 or more wallets. Connecting drains the wallet. It has been spread through compromised social accounts and through ads.

The mechanics of this format are worth understanding because it does not look like a theft while it is happening. You are not being asked to send funds. You are being asked to vote, claim, verify, or check eligibility — actions that feel free. What you actually sign is a token approval, a permit signature, or a setApprovalForAll, and the transfer happens afterwards from an address you have authorised. On some drainers the transfer is deferred by hours or days specifically so the victim does not connect the loss to the site.

Circle has not published a phishing advisory or an official domain-verification page for Arc, which is part of why this works. Our maintained list of confirmed Circle-operated Arc domains against the known impersonations is at official Arc domains versus known fakes; broader Arc chain coverage sits on Radian.

Format two: the explorer that isn't

Explorers are trusted by default, because their job is to be the place you go to check whether something is true. That trust is transferable to an attacker.

arc-scan.io is the case to study. It is registered through Njalla, an anonymity-shield registrar. It currently has no A record, so it does not resolve — but Google's index still holds pages from it, and those indexed pages describe an Arc mainnet API with a mainnet chain ID. Circle has never published an Arc mainnet chain ID. As of 31 August 2026, the only chain ID Circle has published is the testnet's, 5042002, and Circle's documentation states explicitly that mainnet endpoints and parameters are published separately when available. Arc mainnet is scheduled for 16 September 2026.

So the profile is: anonymous registration, dormant DNS, and indexed content asserting network parameters for a network that is not live and whose parameters have not been published. That combination has no legitimate explanation, and a dormant domain can be pointed at a live server the moment traffic is worth capturing. Do not visit it, and treat any search result carrying that hostname as hostile.

A separate site, arc-scan.org, is a different case that is arguably more dangerous because it is more honest. It states openly that it is not affiliated with, endorsed by or operated by Circle, and it resolves and serves. But it asserts that a mainnet chain is live, publishes an unpublished chain ID as fact, and prompts visitors to add its own RPC endpoint to their wallet. That last part is covered in its own section below, because it is the single most under-appreciated risk on this page.

Note also that a genuine explorer and a genuine-looking hostname are not the same thing. Arc's real testnet explorer is a Blockscout deployment reachable at the testnet. subdomain of arcscan.app; the apex domain arcscan.app had no A record as of 31 August 2026, so sending readers to the bare domain would itself be unsafe advice. On Robinhood Chain, robinhoodchain.blockscout.com is the official Blockscout instance for chain ID 4663, while robinscan.io and hoodscan.pro are third-party and unvetted — not accused of anything, but not a place to resolve a question about whether a contract is real.

Format three: the squatted launchpad domain

You do not need to clone a chain to run this. You need the name of whatever people are currently typing into search.

The live example on Robinhood Chain is Pons. ponsdotfamily.com and ponslaunchpad.com both rank in search results, along with a "Pons Launchpad Robinhood" site — one of them advertising a figure in the hundreds of thousands of tokens launched. Only ponsfamily.com is confirmed by the project's official documentation. A squatted launchpad domain is an efficient vehicle for two attacks at once: it can drain a wallet on connect, and it can publish a contract address that looks completely authoritative for a token that is not the one you meant to buy. Checking you have the right contract address covers the second half of that.

Format four: the bridge front-end

Bridges are the highest-value target per victim, because bridge users arrive intending to move a large balance in a single transaction.

Bitcoin World reported on 31 July 2026 that users were losing USDC to fake versions of Arc's OnBridge interface, spread through search ads and phishing. This is a single-source report and we could not independently confirm it. No specific domains were named and no loss totals were disclosed. The article stated that Circle had not issued a statement addressing the reports, and we have found no Circle statement since.

Treat that as the shape of the risk rather than a specific list to avoid. The generalisable point is that "spread via search ads" is the delivery mechanism in a large share of documented cases, including the confirmed Arc drainer above. Paid search placement sits above organic results, renders the real project's name as the ad headline, and displays a display URL that need not match the destination. Searching for a bridge is the risky act; the malicious result is what search is for.

The custom RPC trap

This is the part most guides skip, and it deserves the strongest warning on this page.

Never add a custom RPC endpoint to your wallet from a site that is not the chain's official documentation. An RPC endpoint is the connection through which your wallet learns what is true. Whoever operates it decides what your wallet is told.

A malicious RPC does not need your private key to hurt you. It can report balances that do not exist, so you believe a transfer arrived. It can report a transaction as confirmed when it was never broadcast, or drop your transaction silently while showing success. It can return a fabricated token price, contract state or allowance, so every verification step you perform afterwards returns the answer the operator chose. It can front-run or censor what you submit. In practice it destroys your ability to check anything, and every "is this safe?" check you run through it is worthless.

The prompt is designed to look routine. "Add RPC to Wallet" is a one-click button on arc-scan.org today, pointed at that site's own endpoint, alongside a claim that a mainnet is live that Circle has not confirmed. The button works. That is the problem.

Get network parameters from the chain's own documentation and nowhere else. For Robinhood Chain, adding the network to MetaMask manually walks through the published parameters — chain ID 4663, the official RPC on robinhood.com, ETH as the currency symbol — and manual entry from a verified source is safer than any one-click add link, wherever the link came from. For Arc, the honest position as of 31 August 2026 is that mainnet parameters do not exist publicly yet, so any site offering them is offering something Circle has not published.

The domain verification habit

Five practices, in rough order of how much they save you.

Bookmark once, from a verified source, then only ever use the bookmark. Build the bookmark from the project's official documentation or a link in its own docs, not from search, not from a Discord message, not from an ad. This single habit defeats every format above.

Treat search results and ads as untrusted for any interface that connects a wallet. Search is fine for reading about a protocol. It is not an acceptable route to the page where you sign.

Read the hostname right to left. The registrable domain is the last two labels before the TLD. arc.io.security-check.example.com is not Arc. Watch for hyphenated variants of a real name, TLD swaps, and the insertion of a word like "app", "swap", "governance" or "scan" — most of the domains named on this page follow exactly that pattern.

Check what the project itself publishes. A project's docs are the authority on its own domains, contract addresses and RPC endpoints. Where a project publishes no domain-verification page — which is the case for Arc as of 31 August 2026 — that absence is itself a risk factor to hold in mind.

Use a separate wallet for anything experimental. A wallet holding one chain's gas and nothing else limits the worst case of a mistake to the balance in it. This is the only control on this list that works after you have already made an error.

What this doesn't tell you

This is a snapshot. Phishing domains rotate constantly, so the specific hostnames named here are examples of a pattern rather than a list you can memorise and rely on. A domain not named here is not thereby safe, and a dormant domain can become active without notice.

Two further limits. Verifying a domain tells you the interface is the real one — it says nothing about the safety of the token or contract you then interact with. And this article deliberately contains no links to any of the suspicious domains it names, which means you cannot verify our characterisations by clicking through; the sources are named in the text so you can check them independently through channels you already trust.

If you have already connected to something you should not have, the first action is not to move funds — it is to revoke what you granted. Revoking the permissions you granted covers the mechanics, and what to do after a rug pull or wallet compromise covers the reporting and evidence steps, including the recovery scams that target people in exactly that position.

Frequently asked questions

How does a fake DEX or bridge actually steal funds?

Usually through a signature rather than a transfer. The site asks you to connect, then to sign something framed as a vote, a claim, a verification or a routine approval. What you sign is a token allowance or a permit, which lets the attacker's address move your tokens afterwards — sometimes days later, so the loss is not connected to the site.

Is it safe to add a custom RPC from a block explorer?

Not unless the explorer is the chain's official one and the parameters match the chain's own documentation. A custom RPC controls what your wallet is told is true: balances, transaction status, contract state. A malicious endpoint can show a confirmed transfer that never happened, and it makes every subsequent check you run meaningless.

What is the safest way to reach a DEX or bridge?

A bookmark you created once from the project's official documentation, used every time afterwards. Do not reach a wallet-connecting interface through search results, paid ads, Discord links, or QR codes. Searching is the moment of exposure, because paid placement sits above organic results and displays the real project's name.

Are unofficial block explorers dangerous?

Not automatically, but they are not a place to resolve a safety question. Third-party explorers exist for most chains — robinscan.io and hoodscan.pro on Robinhood Chain, for instance — and are unvetted. If the reason you are opening an explorer is to verify something, verify it somewhere you have an independent reason to trust.

Why can't I click the domains named in this article?

Because linking them would send traffic and search authority to a confirmed wallet drainer and to domains whose operators are anonymous. They are written as plain text on purpose. The sources — PCrisk for the Arc drainer, registrar and DNS records for the rest — are named so you can verify the claims without visiting the sites.

---

The one thing a launch can prove without a website

Every attack above works by imitating a trusted surface. On-chain commitments are harder to imitate, because they are attached to a contract address rather than a domain. Team Finance liquidity locking — built by TrustSwap, which also builds Meme Central — locks LP tokens for a fixed term on Ethereum, Robinhood Chain, Polygon, Base and BNB, and the lock appears as a verified badge on that token's page in the Meme Central live feed, where the address rather than the branding is the identity. It proves a lock exists. It cannot tell you whether the site that sent you there was real.

---

Nothing here is financial, legal or tax advice. Memecoins are extremely high-risk: most lose most of their value, and the majority of tokens launched never reach a decentralised exchange at all. Never spend money you cannot afford to lose entirely. Meme Central does not recommend any specific token. Data described as Meme Central's own reflects tokens indexed by Meme Central and is not whole-market data.