Skip to content
Last updated 2026-11-05

Phishing Website Scam

A phishing site copies a page you trust, but it cannot copy the domain in your address bar. Read the origin before you connect a wallet, sign, or type anything.

Who this is for

Anyone who reaches a wallet, swap, or claim page through a search result, an ad, a chat message, or an email. If you only open sites from your own bookmarks, the domain rules below are still worth knowing.

How the scam works

The attacker registers a domain that looks close to the real one and copies the page. Three tricks do most of the work.

A homoglyph domain swaps a character for one that looks the same: rn for m, a capital I for a lowercase l, or a Cyrillic letter in place of a Latin one. Typosquatting adds, drops, or swaps a letter, as in bitgold-netwrok.com or bitqold.network. A subdomain puts the trusted name in front of a domain the attacker owns: bitgold.network.example.com is a page on example.com, not on bitgold.network.

The copy is convincing because the attacker does not have to build anything. They save the real page, change the wallet-connect call, and host it. Logos, fonts, and wording can all be exact.

Then the page asks for something. A fake Connect Wallet prompt may request your recovery phrase to "sync" or "validate" the wallet; a real connection never needs it. A fake signature prompt may ask you to approve a contract, or to sign a message that grants spending rights.

The page design tells you nothing about who receives that permission. The origin does.

For Bitgold, the Console is at https://app.bitgold.network, and the public site is at https://www.bitgold.network. Learn those two strings and compare them character by character. On any site, the part that matters is the domain immediately before the first single slash; in the example above, that is example.com, not bitgold.network.

Read the domain right to left

In bitgold.network.example.com, the browser connects to example.com. Everything to the left of it is a name the attacker chose. A padlock only means the connection is encrypted; it does not mean the site is the one you wanted.

Warning signs

  • The domain differs from the real one by a character, a hyphen, or a letter that looks similar.
  • The trusted name sits in front of another domain, as in bitgold.network.example.com.
  • A Connect Wallet flow asks for a recovery phrase, a private key, or a wallet password on the page.
  • A signature is requested to "verify" or "activate" the wallet before any balance is shown.
  • You arrived from a search ad, a sponsored result, a chat link, or a shortened URL.
  • The page warns that your wallet is "at risk" and offers to fix it.

If it happens to you

  1. Close the tab before you approve anything. If you already connected, open the wallet's connected-sites list and disconnect the site.
  2. If you entered a recovery phrase or private key, treat the wallet as compromised. Create a new wallet and move the remaining funds to it before anything else.
  3. If you signed an approval, revoke it now. If you only signed a login message with no spending rights, no on-chain action is needed.
  4. Report the URL to the wallet provider and to the brand being copied. Do not pay a service that promises to recover funds.

Next steps

Self-check

  • Can you type the exact domain you use for Bitgold, without looking it up?
  • Do you open wallet sites from a bookmark instead of a search result or a chat link?
  • When a page asks you to connect, do you read the address bar before the wallet prompt appears?
  • Would you stop if a wallet "sync" page asked for your recovery phrase?