How can you recognize Fake xStocks, Pendle and other crypto sites lure voters into wallet draining scams?

TLDR

Scammers have set up roughly 70 lookalike websites that impersonate real crypto projects such as xStocks (Kraken), Zama, Kinetiq, Pendle, Firelight, Yield Basis, Keeta, NetNet and Umia. Each page asks visitors to "vote" on the date of an...

How it works

Red flags

: Random looking domains on .xyz following the pattern "sitemu" plus a string of characters, never the project's real domain A "vote to earn a boost" pitch arriving without prior announcement from the project's official channels A wallet connect window that looks generic and is identical across multiple unrelated brands

What to do

1: Never connect your wallet from a link found in DMs, ads, replies, or unsolicited posts
2always navigate to the project domain yourself Read every signature and appr

Source

malwarebytes

Source reviewed by Mythos Forensic Team

https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes

FAQ

Is Fake xStocks, Pendle and other crypto sites lure voters into wallet draining scams a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

: Random looking domains on .xyz following the pattern "sitemu" plus a string of characters, never the project's real domain A "vote to earn a boost" pitch arriving without prior announcement from the project's official channels A wallet connect window that looks generic and is identical across multiple unrelated brands

What should I do first?

: Never connect your wallet from a link found in DMs, ads, replies, or unsolicited posts; always navigate to the project domain yourself Read every signature and appr

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.