Warning over fake Bitcoin Foundation sites scamming cryptocurrency users
The latest ruse to scam Bitcoin owners out of their holdings is websites posing as The Bitcoin Foundation and capitalising on concerns over the cryptocurrency's falling price.
The Bitcoin Foundation said on Monday that it has seen a spike in complaints to its helpdesk over a fraud campaign where scammers direct Bitcoin users to spoofed versions of the foundation's site.
The two scam domains the foundation is aware of are: bitcompensation.com and bitsecuretransfer.com. According to whois.is, both were registered in mid-November by what appears to be the same person.
"The Bitcoin Foundation's website is being cloned and spoofed at web addresses and domains that have absolutely nothing to do with the Bitcoin Foundation," it said.
"If you are contacted and directed to a page that looks like the screenshot below, please close your browser as you are about to be scammed out of your Bitcoins."
Both sites present a 'compensating the users' campaign, purportedly run by the foundation and another fictitious organisation, and urge users to supply their bitcoin address in a field in order to redeem their 'gift'.
The campaign attempts to trick less knowledgeable users who feel they've "lost too much" as a result of Bitcoin's falling price over recent months. This time last year, it was trading at over $1,100; today it's worth $380.
"Since the price of the bitcoin went down a lot, members of the bitcoin community have lost too much," the scam sites read. "To decrease these loss and to sustain our coin, we, The Bitcoin Foundation together with Blockchain, are going to offer to each of our members a random amount of coins."
Exactly how the scammers extract Bitcoin from victims isn't clear, given that the scam page only asks for a Bitcoin address, which users can safely provide publicly.
A spokesperson from The Bitcoin Foundation told ZDNet that after victims provide their Bitcoin address, they are forwarded to a fake bitcoin wallet where they may give up enough information to be compromised later.
"From what we can tell, once a bitcoin address is entered, the user is forwarded to a fake bitcoin wallet phishing site for them to "claim" their bitcoins. If the user logs into that fake bitcoin wallet phishing site using their login information, then the site will be enabled to steal their wallet username or login, password and bitcoins," the spokesperson said.
"A receiving or public bitcoin address alone is not enough to steal bitcoins. You must have the wallet username or login, private key or password to do so."
The foundation said it's monitoring for other scam sites and has asked users to submit any domains found to webmaster@bitcoinfoundation.org with the subject line 'SCAM SITE'.