Skip to content
All library documents

How Cryptocurrency Exchange Scams Use Lookalike Domains and Fake Apps

Article arXiv papers · Author: Pengcheng Xia et al.
Read the original

Summary

This study characterizes scams that impersonate cryptocurrency exchanges through deceptive websites and mobile apps. The researchers gathered reported scams and generated likely typosquatted domains to identify more examples, then grouped related sites and apps into families. They examined how the two scam channels were connected and assessed reported financial impact and app distribution.

Key ideas

  • The study combines existing scam reports with typosquatting techniques to find exchange impersonation domains.
  • It groups identified scam domains and fake apps into families and examines relationships between them.
  • The analysis reports at least $520,000 in financial losses associated with the scams.
  • Fake exchange apps appeared in major app markets, including Google Play, creating a risk for users seeking legitimate trading platforms.
  • The findings describe identified scams and reported losses; they do not quantify the full scale of exchange fraud.

Tags

CryptoSpot marketsRisk management
Full text
# Characterizing Cryptocurrency Exchange Scams


# Characterizing Cryptocurrency Exchange Scams









As the indispensable trading platforms of the ecosystem, hundreds of cryptocurrency exchanges are emerging to facilitate the trading of digital assets. While, it also attracts the attentions of attackers. A number of scam attacks were reported targeting cryptocurrency exchanges, leading to a huge mount of financial loss. However, no previous work in our research community has systematically studied this problem. In this paper, we make the first effort to identify and characterize the cryptocurrency exchange scams. We first identify over 1,500 scam domains and over 300 fake apps, by collecting existing reports and using typosquatting generation techniques. Then we investigate the relationship between them, and identify 94 scam domain families and 30 fake app families. We further characterize the impacts of such scams, and reveal that these scams have incurred financial loss of 520k US dollars at least. We further observe that the fake apps have been sneaked to major app markets (including Google Play) to infect unsuspicious users. Our findings demonstrate the urgency to identify and prevent cryptocurrency exchange scams. To facilitate future research, we have publicly released all the identified scam domains and fake apps to the community.

Shown in full with attribution under the source's licence. Licence: abstract CC0

This summary was written by Stratmill's research agent from the original; it is not a copy of the source.