Clones
The fake is not a bad copy. It is the same page, on a different address, reached through a link you did not choose — an advert, a search result, a pinned message.
A cloned site is not a forgery in the usual sense. Copying a website is a single command, and the result is pixel-identical because it is the same markup. There is no visual tell, no clumsy translation, no wrong logo. The only difference is the address bar and where the form sends what you type.
How people arrive at the fake
Paid search results. Advertising slots above the real result have been bought for the names of major exchanges and wallets repeatedly, in every market. The ad shows the real domain as its display text and links somewhere else.
App stores. Fake wallet apps get through review often enough to be a standing problem, usually as an app with a generic name that changes after approval, or a clone with a handful of purchased reviews.
Links from people. A pinned message in a chat group, a reply from a helpful stranger, a QR code in a video. All the same category: a link you did not look up yourself.
Typos and lookalike domains. A missing letter, a hyphen, a different top-level ending, or a character from another alphabet that renders identically to a Latin one.
What the clone is actually collecting
Three things, depending on what it imitates.
An exchange clone wants your password and the code from your authenticator, in real time, so it can log into the real site while you wait on a loading screen. A wallet clone wants the recovery phrase, presented as an import or a restore step. A "connect wallet" clone wants a signature — no phrase, no password, just an approval that grants a contract permission to move your tokens, covered in wallet drainers and signatures.
A real wallet never asks for the phrase after setup
Not to "verify", not to "sync", not to "restore" an app you are already using, not after an update. The phrase is typed once, on the day you create or genuinely restore a wallet, and never again. Any other moment is theft in progress.
The habits that make the whole category irrelevant
Bookmarks, not searches. Reach money sites from your own bookmark, created once from an address you verified. This one habit removes advertisements, search results and pasted links from the attack surface entirely.
Install from the developer's own site. Find the official domain first, then follow its store link — rather than searching the store and choosing what appears. Same principle, applied to apps.
A hardware key ends the credential version. It refuses to authenticate to a domain that is not the real one, so a perfect visual clone gets nothing. This is the difference described in account takeover.
Look at the address bar before you type, not after. Character by character on the domain itself — the part immediately before the first single slash. Everything after it is decoration and can say anything at all.
The extension problem
Browser extensions with permission to read and change pages can rewrite a genuine site in place: the address is correct, the certificate is valid, and the deposit address displayed has been swapped. The defence is unglamorous — few extensions, each one deliberately chosen, and none installed on the profile you use for money.
The same applies to a phone: an app installed outside the store, granted accessibility permissions "to help", can read every screen and type on your behalf.
How to check a site you are already on
- Read the domain aloudLeft of the first slash, letter by letter. Lookalike characters do not survive being spoken.
- Open your own bookmark in a new tabIf both exist, compare the addresses. Do not compare the pages — they are identical by design.
- Never type the phrase or the code to resolve doubtClose the tab first, verify second. Nothing is lost by closing a real site.
- If you already typed it, act as if it is compromisedBecause it is. This page for a phrase, this one for a login.