Agent Lane robot mascotAgent Lane
Menu

Guide

How to check if a crypto website is real before you connect your wallet

Some links may earn us a commission at no cost to you, which helps keep these guides free and up to date.

Short answer: Get to the site by typing the address or using a bookmark, not from an ad or a message. Read the domain, not the logo or the padlock. Run a quick check on the address, connect only a small separate wallet, and never type your recovery phrase into any website.

By Agent Lane Editorial · Page dated 3 November 2026

Why check a crypto site before connecting?

Because a copy can look exactly like the real thing. Kraken explains that fake sites are built to collect your sign-in details, two-factor codes or recovery phrase, and fake “claim your tokens” pages ask you to connect a wallet and approve a request that empties it. Checking takes a minute; a bad approval can take everything in the wallet. What those approvals look like is covered in crypto wallet drainers.

How do I read a web address?

Find the domain. Kraken’s rule: it is the part just before the first single slash. So in kraken.com.example.net/sign-in, the domain is example.net, not Kraken. Whatever comes in front of the domain doesn’t matter.

Then look at the domain letter by letter. The FBI and Kraken describe the common tricks:

  • An extra, missing or swapped letter.
  • The real name plus a word, like “-support” or “-verify”.
  • A different ending, such as .net or .org instead of the real one.

Does the padlock mean a site is safe?

No. Kraken says a padlock or “https” only means the connection is encrypted, and fake sites have them too. It tells you nobody can read the traffic in between, not who is on the other end.

What is the safest way to get to a crypto site?

  • Type the address or use a bookmark. This is the FBI’s and Kraken’s first tip. Save a bookmark the first time you confirm a site is real.
  • Skip sponsored search results. The FBI says sponsored results are usually paid imitators, and Kraken says scammers buy ads so their copy shows up above the real site.
  • Don’t follow links in messages you didn’t expect, including emails, texts, QR codes and replies on social media. Open the site yourself and look for the alert there.
  • Cross-check new projects. The FBI warns that hacked or look-alike accounts of real projects post links to copies of the real site. Find the same address in two places you trust before you connect.
  • Check links an AI gives you, too. A chatbot or search summary can point to the wrong site. Read the domain the same way.

What free checks can I run in a minute?

  • Google Safe Browsing site status. Paste the address into Google’s site status tool to see if Google currently flags it as dangerous. A clean result is not proof: Google says it finds thousands of new unsafe sites every day.
  • When the domain was registered. ICANN’s lookup tool shows a domain’s public registration details, which usually include the date it was created. A site for a company that claims years of history but whose domain is a few weeks old is a warning sign.
  • Complaints about the name. Search the company or site name in California’s Crypto Scam Tracker. It lists scams reported by consumers; the regulator notes it has not verified the losses.
  • Odd requests. Kraken warns about fake “verify you’re human” pages that tell you to paste a command into your computer. That installs malware. Close the page.

How do I connect more safely if I do go ahead?

  • Use a small separate wallet holding only what you’d be fine losing. See dedicated wallet.
  • Keep savings on a hardware wallet such as Ledger or Trezor, and read each request on the device’s own screen before you approve it.
  • Use passkeys on exchanges. Kraken says a passkey is tied to the real website, so it won’t work on a fake one even if you are fooled.
  • Never type your recovery phrase into a website. Kraken says never to enter it on any website. See never share a seed phrase.

What if I already used a fake site?

It depends on what you did there. If you typed an exchange password or code, follow what to do if your exchange account was hacked. If you approved a wallet request, follow the steps in crypto wallet drainers, and cancel old approvals with the tools ethereum.org lists. If you only looked, close the page. Report the fake site to the company it copies, through that company’s real help center, and to the FBI at ic3.gov.

Sources

Checked 3 November 2026 on each organization’s own site.

Related guides

All guides