How the scam operates.
myetherwallet.info presents itself as a functional Ethereum wallet interface, targeting users who are searching for wallet access or who mistype a familiar address in their browser. The domain closely mirrors that of a recognised cryptocurrency wallet provider, relying on the visual similarity between its .info suffix and the established .com counterpart to create an impression of legitimacy. The intended audience is Ethereum holders who already trust the brand being impersonated and are unlikely to scrutinise the domain extension.
Operations of this type typically reproduce the visual design of the genuine service with a high degree of accuracy, prompting visitors to enter wallet credentials such as private keys, seed phrases, or keystore files in order to gain access to their holdings. Because the interface resembles the authentic product, users frequently provide their most sensitive cryptographic material without suspicion. The operator captures this data server-side and uses it to drain the associated wallets, often within minutes of submission.
The failure point arrives when a victim attempts to complete a transaction or retrieve a balance and finds the interface unresponsive, or discovers their genuine wallet has been emptied from an external address they do not recognise. By that stage the operator has already exfiltrated the credentials. Recovery of assets transferred out of a compromised self-custody wallet is technically arduous, since the movement is authenticated by the victim's own private key and is therefore indistinguishable on-chain from a voluntary transfer.
Red flags we documented.
- 01Domain Mimics a Recognised Wallet BrandThe .info domain closely replicates a well-established .com wallet address, a pattern consistent with typosquatting designed to intercept users who mistype or follow a malicious link. No affiliation with the original service exists, and the choice of extension appears deliberate.
- 02Listed on CryptoScamDB Community BlacklistThe domain appears in the CryptoScamDB blacklist, a community-maintained registry of confirmed malicious cryptocurrency sites. Inclusion reflects prior community-verified harm and is treated by security tooling as grounds for automatic blocking.
- 03Credential Entry Pattern Signals Harvesting OperationWallet impersonation platforms of this type solicit private keys, seed phrases, or keystore files. Legitimate non-custodial wallet interfaces do not require these credentials to be entered on a website under any circumstances. Any platform that does should be treated as hostile.
- 04No Verifiable Operator or Regulatory StandingThe domain carries no documented organisational identity, regulatory authorisation, or verifiable legal presence. Legitimate custodial or financial services are required to disclose these details in most jurisdictions; their absence is a material signal of illegitimacy.
- 05Asset Exposure is Immediate and IrreversibleOnce credentials are submitted to a harvesting operation, the operator can drain associated wallets within minutes. Blockchain transactions are irreversible and carry no chargeback mechanism. The window for any meaningful intervention is extremely narrow.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.