Cómo opera la estafa.
El sitio se presenta como una plataforma de gestión de wallets de Ethereum, una categoría de servicio que cuenta con actores legítimos y bien establecidos. Al adoptar la expresión 'ethereum wallet' como nombre de dominio y operar bajo un dominio de nivel superior genérico, el operador posiciona la plataforma para interceptar a los usuarios que buscan herramientas de acceso a wallets, utilidades de recuperación o interfaces de gestión de portafolios. El público objetivo son los tenedores de Ether y tokens ERC-20 que tal vez no sepan cómo distinguir la infraestructura autorizada de wallets de una imitación.
Las plataformas de este tipo suelen reproducir el lenguaje visual y la funcionalidad de interfaces de wallets reconocidas: pantallas de importación, campos para ingresar la frase semilla, opciones de importación de clave privada o flujos de wallet-connect. El propósito operativo de estas reproducciones no es prestar servicios de custodia o de transacciones, sino capturar las credenciales enviadas durante el supuesto proceso de autenticación. Una vez que una frase semilla o una clave privada se ingresa en la infraestructura del operador, el tenedor ha cedido de hecho el control irrevocable de todos los activos protegidos por esa clave.
El punto de falla suele ser silencioso e inmediato. Las víctimas por lo general descubren la vulneración solo cuando intentan acceder a sus tenencias a través de un canal legítimo y encuentran el saldo en cero, o cuando los datos de un explorador on-chain revelan una transacción de barrido saliente hacia una dirección fuera de su control. En esa etapa, los activos están casi con certeza fuera del alcance de una recuperación directa: el operador habrá movido los fondos a través de wallets intermediarias o pasos de conversión diseñados para romper el rastro on-chain. Los canales de soporte, si es que existen, dejan de responder poco después de las primeras quejas.
Banderas rojas que documentamos.
- 01Non-authoritative TLD for a financial custody serviceLegitimate Ethereum wallet providers operate under established, verifiable domains. The use of a .info top-level domain for a service claiming to manage or access cryptocurrency wallets is inconsistent with the practices of any recognised infrastructure provider in this category and is a common characteristic of short-lived phishing operations.
- 02Domain name engineered to evoke established wallet brandsThe construction 'ethereum-wallet' followed by a generic TLD is a deliberate proximity play, designed to appear in search results or browser autofill alongside the names of genuine wallet services. This naming pattern is a recognised hallmark of credential-harvesting operations targeting holders who are navigating to a familiar service and may not scrutinise the exact domain.
- 03CryptoScamDB blacklist classificationThe domain appears on the CryptoScamDB community blacklist, a maintained registry of addresses associated with fraudulent activity in the cryptocurrency ecosystem. Inclusion on this list reflects reported harm or structural indicators consistent with a malicious operation, and is the basis for the confirmed-scam classification applied here.
- 04No verifiable operator or regulatory standingLegitimate wallet platforms, particularly those soliciting seed phrases or private keys, are expected to publish verifiable company information, terms of service, and in most jurisdictions are subject to registration or licensing requirements. No such information has been documented for this domain, and the operational anonymity it affords is itself a structural signal.
- 05Seed-phrase solicitation patternAny platform that requests a seed phrase, mnemonic, or raw private key through a web interface, regardless of the justification offered, represents an unacceptable custody risk. This pattern is the single most reliable predictor of wallet-draining operations, and no legitimate wallet service requires it to be entered via a third-party site.
Lo que puedes hacer ahora.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.