Cómo opera la estafa.
etherwallet.shop se presenta como una interfaz legítima de wallet de Ethereum, aprovechando un nombre de dominio muy parecido al de un servicio de wallet de criptomonedas ampliamente reconocido. El sitio atrae a usuarios que buscan ese servicio legítimo mediante URLs mal escritas, resultados de búsqueda engañosos o enlaces compartidos. El dominio de nivel superior .shop es una incongruencia evidente para un servicio de wallet genuino, pero las víctimas que llegan bajo presión de tiempo pueden no advertir la discrepancia.
El patrón operativo coherente con los sitios de esta categoría es el robo de credenciales. A los visitantes normalmente se les presenta una interfaz de wallet que solicita una frase semilla, una clave privada o credenciales de inicio de sesión bajo el pretexto de recuperar la cuenta o importar la wallet. Una vez introducidos, esos datos se transmiten al operador. Dado que las claves privadas y las frases semilla de Ethereum otorgan un control irreversible e incondicional sobre los fondos asociados, una sola captura exitosa basta para vaciar una wallet por completo.
El punto de fallo suele ser inmediato pero invisible. Las víctimas pueden no darse cuenta de que algo va mal hasta que descubren que faltan fondos en su wallet genuina. Para entonces, las transacciones en la blockchain son irreversibles y el operador por lo general ya ha abandonado el dominio. La inclusión en la lista negra de CryptoScamDB confirma que el sitio fue identificado por la comunidad de inteligencia de amenazas, aunque el momento en relación con cualquier exposición individual no puede determinarse a partir de los registros disponibles.
Banderas rojas que documentamos.
- 01Domain impersonation pattern targeting Ethereum usersThe domain closely mimics the name of a legitimate, widely used Ethereum wallet service. This is a textbook typosquat: close enough to attract misdirected traffic, different enough to be technically distinct. Legitimate wallet services do not register near-identical domains under commercial TLDs such as .shop.
- 02Commercial TLD inconsistent with wallet infrastructureThe .shop suffix has no functional relevance to a self-custody wallet service. Established Ethereum wallet providers use purpose-appropriate or branded domains. The choice of .shop suggests a registration optimised for disposability rather than operational credibility.
- 03CryptoScamDB blacklist entry confirms community-level flaggingThe domain appears in the CryptoScamDB blacklist, a community-maintained dataset used by browser extensions and security tools to warn users before they reach fraudulent sites. Inclusion requires identification by researchers or affected parties, indicating documented harmful activity.
- 04Seed phrase solicitation is an irreversible risk signalSites of this pattern typically request seed phrases or private keys under the guise of wallet import or recovery. No legitimate non-custodial wallet service requires a seed phrase to be entered on a web interface. Any platform making this request should be treated as hostile regardless of its visual presentation.
- 05No documented organisational presence or accountabilityThere are no aliases, registered entities, regulatory filings, or contact structures associated with this domain in available records. Operations lacking any verifiable organisational footprint are structurally designed to avoid accountability after funds are taken.
Lo que puedes hacer ahora.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.