Fake Cryptocurrency Websites & Mobile Apps

Fake cryptocurrency websites and mobile apps are fraudulent platforms built to look and feel identical to legitimate exchanges, wallets, or investment platforms. Their sole purpose is to steal your login credentials, intercept your funds, or install malicious software on your device.
These platforms appear in search engine results, social media advertisements, app stores, and through direct links sent by email or messaging apps. Some are exact copies of real platforms. Others are entirely fabricated but designed to appear credible. Once you enter credentials or send funds, recovering them is extremely difficult — and in most cases impossible.
 

Spoofed Exchange Websites — A near-identical copy of a legitimate exchange, with a slightly different URL. Any credentials you enter go directly to the attacker.

Fake Wallet Apps — Fraudulent wallet applications listed in app stores — sometimes with convincing reviews and download numbers — that steal your private keys or recovery phrase on setup.

Fake Investment Platforms — Entirely fabricated trading platforms that accept deposits, show fake profit dashboards, and then disappear with your funds.

Cloned DeFi Platforms — Fraudulent versions of popular DeFi protocols designed to intercept funds intended for the legitimate platform.

Malicious Browser Extensions — Fake crypto wallet or trading extensions that silently steal credentials or redirect transactions to attacker-controlled wallets.

Fake Customer Support Portals — Fraudulent support websites that appear in search results and trick users into submitting credentials under the guise of getting help.

• The URL differs slightly from the official domain — e.g. ndax-login.com or ndax.io.support.com instead of ndax.io
• You found the website through a search engine advertisement rather than a direct bookmark
• The SSL certificate is missing or doesn't match the official organisation
• The app was found through a link rather than directly through an official app store listing
• The platform asks for your recovery phrase or private keys at any point during setup or login
• The website or app has spelling errors, unusual formatting, or inconsistent branding
• App reviews appear generic, uniformly positive, or were all posted within a short window

Example: You search for Ndax on a search engine and click the first result — a sponsored advertisement. The site looks identical to ndax.io, but the URL reads ndax-secure.com. You enter your credentials and receive an error. The attacker uses your credentials to access your real account and withdraw your funds.

• Check the URL carefully. The only official Ndax website is ndax.io. Bookmark it and always use that bookmark.
• Look for the padlock. Ensure the website has a valid SSL certificate in your browser address bar.
• Download apps from official sources only. Use only the App Store or Google Play listing linked directly from ndax.io.
• Never click links in emails or messages. Navigate directly to ndax.io by typing it or using your bookmark.
• Verify before installing extensions. Ndax does not require any browser extensions.

Ndax will never ask for your recovery phrase, seed phrase, or private keys. Ndax will never ask you to download a third-party app or browser extension, direct you to an unfamiliar domain to complete a transaction, send you a social media link to log in, ask you to move funds to another wallet to "protect" your account, or pressure you to act without time to verify.

If something feels off, leave the page and contact Ndax through official channels.
 

• Bookmark ndax.io and never search for it through a search engine
• Enable 2FA so that stolen credentials alone can't access your funds
• Never enter your recovery phrase into any website or app under any circumstances
• Use a dedicated email address for your crypto accounts
• Keep your devices and browsers updated
• Use antivirus software and scan regularly for malicious applications or extensions

Close it immediately without entering any information. Don't click links or download files. Report it and contact Ndax support at ndax.io if you believe it's impersonating Ndax.

Log in to the real Ndax website directly at ndax.io and change your password immediately. Confirm 2FA is active and review recent account activity for transactions or changes you do not recognize.

If you transferred crypto from your Ndax account, contact [email protected] right away. Cryptocurrency transfers are generally irreversible, but the information you provide may help us review the activity and protect other users.

If fiat funds, bank transfers, credit cards, debit cards, or payment services were used, notify the financial institution where the funds originated.

Document everything, including the fake URL, screenshots, app listing, emails, messages, wallet addresses, transaction records, and any communications with the fraudulent platform.
 

• Report to Ndax at [email protected] if your Ndax account was involved or crypto was transferred from your Ndax account
• Report to the CAFC at antifraudcentre.ca
• Report to the RCMP at reportcyberandfraud.canada.ca
• Notify the financial institution where the funds originated, such as your bank, card provider, or payment service provider
• Report fake profiles directly through the relevant social media, messaging, or dating platform