Fake RPC Nodes, Fake Balances¶
Your wallet does not read the blockchain directly. It asks an RPC endpoint, and it displays whatever comes back. A malicious endpoint can show a balance you do not have and a transfer that never happened. It cannot sign for you, but it can talk you into signing.
Who this is for¶
Anyone who has been offered a "faster node", asked to add a custom network, or shown a balance screenshot that a second device cannot reproduce.
How the scam works¶
An RPC endpoint answers questions. What is this address's balance? What is the latest block? Did this transaction succeed? What would happen if this transaction ran? The wallet trusts the answer, because no second opinion is built in.
A malicious endpoint can answer falsely in several ways. It can inflate a balance so an account looks valuable before you buy it. It can simulate a transfer and report success, so you release goods or send a payment against a transaction that was never broadcast. It can hide an incoming payment, or show a token balance the real network does not record.
The lure is usually a favor. Someone offers an endpoint that will "fix" a stuck transaction, "unlock" a wallet, speed up a claim, or support a network your wallet does not list. Sometimes it arrives as a preconfigured wallet backup. Once the endpoint sits in your settings, every number the wallet shows passes through it.
The limit matters. The endpoint cannot move funds, because it never sees your private key. What it can do is shape the decision you make next: pay for an account showing a large fake balance, sign a "verification" transaction to release a fake payout, or type your phrase into a "node dashboard" that asks for it. That last step is where the theft happens.
How to notice¶
Compare two independent sources: your wallet, pointed at an official endpoint from the published list, and the explorer at www.bitgold.live. If the balance or the transaction status differs, stop and check which endpoint the wallet is using.
A transaction hash is a second check. If the explorer has no record of it, or it has no confirmations, it was not confirmed, whatever the wallet said.
A chain ID is a third. Bitgold mainnet is 618. An endpoint that claims to be Bitgold while reporting a different chain ID is not Bitgold.
Warning signs¶
- Someone supplies an RPC URL as part of a deal, a recovery, or an unlock.
- A page or a "node dashboard" asks for your recovery phrase or private key. An endpoint never needs either.
- The balance in your wallet differs from the balance in the explorer.
- A transfer "succeeds" but the hash is unknown to the explorer.
- A custom network appears in your wallet that you did not add.
- An account is offered for sale with a balance that only the seller's endpoint displays.
If it happens to you¶
- Stop signing. Do not approve anything until you know which endpoint the wallet is using.
- Switch the wallet back to an official endpoint, such as
https://mainnet1.bitgold.network, and confirm the balance in the explorer. - If you typed a phrase into a dashboard, treat it as exposed. Create a new wallet and move what remains.
- If you signed a transaction, revoke the approvals it created and move remaining funds.
- Report the endpoint and the page that promoted it to your wallet provider.
Next steps¶
- How to Safely Use Custom Nodes — trust boundaries for a third-party endpoint.
- Common Fraud Cases — where a lying interface sits among the other patterns.
- Theft Prevention — the first response if a signature already went out.
Self-check¶
- Do you know which RPC endpoint your wallet is using right now?
- Have you compared a wallet balance with the explorer this month?
- Would you accept an RPC URL from someone who offered to help?
- Can you say why an endpoint cannot move funds without your key?