Cómo opera la estafa.
La operación se presenta como un servicio legítimo de wallet de Ethereum con nivel bancario. Al combinar un nombre estrechamente asociado a un proveedor de wallets muy conocido con el dominio de nivel superior .bank, que suele estar restringido a instituciones financieras reguladas, el sitio proyecta una doble señal de familiaridad y credibilidad institucional. El objetivo probable es cualquier usuario de Ethereum que busque acceso a una wallet, en particular quienes no examinan las URL con cuidado o quienes asumen que el sufijo .bank indica una supervisión regulatoria formal.
Las operaciones basadas en este modelo suelen funcionar como infraestructura de phishing para la recolección de credenciales. Los visitantes encuentran una interfaz diseñada para replicar de cerca un servicio de wallet de confianza, que les solicita enviar frases semilla, claves privadas o aprobaciones de conexión de la wallet. Cualquier credencial introducida queda capturada por el operador. En algunas variantes el sitio inicia transferencias de tokens no autorizadas de inmediato al conectarse; en otras, las credenciales recolectadas se almacenan y se utilizan más tarde, lo que permite al operador vaciar las wallets en el momento que elija y dificulta la atribución.
El momento del descubrimiento suele llegar después de que el usuario ha enviado una frase semilla o una clave privada, o después de que advierte transacciones salientes no autorizadas desde una wallet vinculada. Para entonces, el operador ya posee todo lo necesario para acceder a la cuenta. Las transacciones en la blockchain son irreversibles, y los operadores que gestionan infraestructura de suplantación de este tipo tienden a consolidar y mover los fondos con rapidez. La ventana para cualquier intervención significativa es estrecha, y la recuperación de los activos transferidos por medios exclusivamente técnicos rara vez es posible.
Banderas rojas que documentamos.
- 01Brand impersonation via domain nameThe domain reproduces the name of a widely recognised Ethereum wallet service almost exactly, combined with a different top-level domain. This is a textbook typosquatting and brand-impersonation technique, intended to intercept users who trust the original brand and may not examine the full URL before proceeding.
- 02Misuse of the .bank TLD as a trust signalThe .bank top-level domain is subject to strict eligibility requirements and is conventionally associated with regulated banking institutions. Its use here appears designed to imply formal financial oversight that this operation does not hold, exploiting user assumptions about domain-name gatekeeping to lower vigilance.
- 03Presence on an independent fraud intelligence databaseThe domain is listed on the CryptoScamDB blacklist, an independently maintained registry of confirmed malicious cryptocurrency-related domains and addresses. Inclusion indicates the site has been identified through community reporting or automated detection as actively harmful to users.
- 04No verifiable operator identity or regulatory footingPhishing operations built around brand impersonation characteristically provide no verifiable information about the entity behind the service: no company registration, no licence numbers, no physical address. This absence is structurally consistent with an operation designed to be abandoned and replaced once detected by fraud databases or wallet providers.
- 05Private-key entry through a web interface is a critical warning patternAny platform prompting users to enter seed phrases or private keys into a browser-based form should be treated as high-risk by default. Reputable, non-custodial wallet providers do not require users to submit these credentials through web interfaces, making any such prompt a strong indicator of credential-harvesting intent.
Lo que puedes hacer ahora.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.