Skip to content
Last updated 2026-11-05

Beware of Custom RPC Node Scams

A custom RPC node is the server your wallet asks about the state of the chain, and if an attacker controls it, your wallet shows what the attacker wants you to see. Treat every node as an untrusted reporter and confirm what matters with a second, independent source.

Who this is for

Anyone who has added a custom RPC URL, or been offered one — usually while adding a network, chasing lower fees, or fixing a connection that seemed slow.

How the scam works

Your wallet does not read the blockchain directly; it asks a node what an address holds, which transactions are pending, and what a transaction would do. The node answers, and the wallet draws the screen from that answer. Nothing in the wallet independently checks the reply.

The offer usually arrives in a DM, a group chat, or a comment thread. Someone shares a "faster node" or a "cheaper RPC" that will fix a stuck transaction or unlock better rates. You paste the URL into your network settings, and from then on every read passes through the attacker.

From there the node can report a balance larger than the real one, hide a pending outgoing transfer so you sign a second time, or return a successful simulation of a transaction whose real effect is different. A malicious node cannot sign for you, but it can shape every fact you use to decide.

That is the core of the attack: it targets your information, not your key. You can make a reasonable decision and still lose, because the screen you reasoned from was false. The same server also learns your address and your IP, which links activity you may have kept apart.

A node never needs your recovery phrase

If a node dashboard, a "sync" page, or a setup wizard asks you to enter a recovery phrase or private key, close it. A node serves chain data; it has no reason to hold your key.

Warning signs

  • The endpoint is promoted in a DM, a comment, or a "support" chat, not in documentation you looked up yourself.
  • The pitch leads with speed or lower fees, and never says who runs the server.
  • The URL is a lookalike of an official hostname, a bare IP address, or a domain you cannot trace to the project.
  • A dashboard asks you to "verify" or "import" a wallet with a recovery phrase.
  • You are told to switch nodes so a stuck transaction will "go through".
  • The balance or history in that wallet disagrees with the block explorer.

If it happens to you

  1. Switch the network back to a known endpoint, such as https://mainnet1.bitgold.network or a documented backup, in your wallet's network settings.
  2. Compare the address and balance with a second source, such as the explorer at www.bitgold.live, before you sign anything else.
  3. If you entered a recovery phrase into any page, treat that wallet as exposed: create a new wallet and move the remaining funds.
  4. If you signed while the bad node was active, review and revoke approvals.
  5. Report the URL to your wallet vendor, and to the channel where it was posted.

Next steps

Self-check

  • Can I name the RPC URL my wallet uses right now, and where that URL came from?
  • Does the balance in my wallet match the same address on the block explorer?
  • Have I refused every node dashboard that asked for a phrase or a private key?
  • Do I confirm an unexpected balance with a second source before acting on it?