Install Chain Insights
← All stories

Safety Academy · Story 06 · Fake exchange & drainer

Familiar logo. Unfamiliar landlord.

A fake Uniswap migration turns a 50 USDC swap into a request for 600.

Estimated 4 min read

FAKE EXCHANGE & DRAINER6 scenes

A familiar community account shares a swap link.

Vera wants to swap 50 USDC. A familiar community account posts an urgent Uniswap “migration” link. She follows it to uniswap-migrate.example instead of opening her saved exchange bookmark.

Vera
“Everyone knows this account.”
Illustration: A familiar community account shares a swap link.

Familiar accounts can be compromised.

The copycat page asks her to “verify.”

The copied site has familiar colours and a swap form. Before trading, it asks her to “verify wallet”. The scammer hopes the logo will do the thinking for her.

The Scammer
“Same logo. Different landlord.”
Illustration: The copycat page asks her to “verify.”

A logo, sponsored result or community post does not establish who controls the site.

The signature names all 600 of her USDC.

Vera’s wallet opens a signing request covering 600 USDC for spender 0xD8F0…72C1. Signing costs no network fee. The amount still makes her stop: she only intended to swap 50.

Vera
“Why does verification mention my entire balance?”
Illustration: The signature names all 600 of her USDC.

Some signatures authorize spending. No gas fee does not mean no financial effect.

Capitano Ritas reads the permission behind the button.

Capitano Ritas reads the authorization. In this example, a required earlier token approval already exists; this signature would provide the missing spending authority. It is not merely a login.

Capitano Ritas
“Lovely logo. Why does the signature want your entire balance?”
Illustration: Capitano Ritas reads the permission behind the button.

A fee-free signature can authorize a real transfer. Read its effect, not just the button label.

Vera rejects and opens her verified bookmark.

Vera rejects the signature and closes the copycat site. She opens her verified bookmark, checks the domain independently and reviews earlier permissions through a trusted tool.

Vera
“My bookmark does not do urgent migrations.”
Illustration: Vera rejects and opens her verified bookmark.

Verify the destination and read the wallet request before signing.

The copied exchange never receives permission.

No signature reaches the malicious spender. Vera keeps control of the covered USDC. The copied logo has excellent colour accuracy and no permission to spend her money.

Vera
“Very convincing logo. Terrible business model.”
Illustration: The copied exchange never receives permission.

The habit: match the token, amount and spender to the action you actually intended.

The useful bit

A familiar logo and a gas-free signature can hide a spending request.

  1. Reach an exchange through your own bookmark or a verified address. Logos and posts are easy to copy.
  2. Read every signature: which token, how much, and who may spend it. 'No gas fee' can still be a spending permission.
  3. If it does not match what you wanted to do, reject it. Then review your permissions in a tool you reached yourself.

I already did this

If you signed, follow MetaMask’s guide to review and revoke the relevant token allowance immediately. Revocation cannot recover funds already taken. If recovery words were also exposed, follow the compromised-wallet guide instead of relying on revocation.

Sources & further reading