Skip to main content
Category: Hacks → Phishing & TyposquattingHacksPhishing & TyposquattingEmail SpoofingReading time: 9 minutes
Risk level: High
Target audience: Exchange users, retail

​
Meet Marcus

Marcus uses Binance and stakes some ETH. One day, he receives an email: Subject: “Your Staking Reward Unlock Notification – Action Required” The email looks like it’s from Binance:
  • Uses Binance’s logo
  • References his actual staking
  • Says his staking rewards are locked and require “account verification”
  • Includes a link to verify: https://binance-verify-account.com/unlock-staking
Marcus clicks and enters his credentials on the fake site. The attacker now has his email and password (or exchange credentials if he used the same password).

​
What Happened

The attacker logs into Marcus’s real Binance account (if he reused the password) or uses the email to reset his password. They withdraw his funds to another wallet or exchange. Loss: ₦2.5M in holdings.

​
Where the Scammer Won

  • Email spoofing: The email looked like it came from Binance, using their branding and referencing real account activity.
  • Fake domain: binance-verify-account.com looked legitimate but was not an official Binance domain.
  • Plausible scenario: Using real features (staking) made the email seem legitimate.
  • Credential harvesting: The fake site captured login credentials.

​
Red Flags Marcus Missed

  • Email sender domain: Check if it’s actually @binance.com, not @binance-verify.com or similar.
  • The link domain: binance-verify-account.com is not a Binance domain.
  • Requested verification: Binance doesn’t ask for login verification via email links.
  • Urgency language: “Action Required” is a common phishing tactic.

​
How Email Domain Spoofing Works

What happens: Scammer sends email that appears to be from legitimate exchange, using spoofed sender address or similar domain.
What happens: Scammer creates fake website with domain similar to official exchange, cloning the login page design.
What happens: Fake site captures login credentials when victim enters them.
What happens: Attacker uses captured credentials to log into real exchange account.
What happens: Attacker withdraws all funds from exchange to their own wallet.

​
Prevention

Check email headers: Look at the actual sender email, not just the display name.
Use SPF/DMARC checking: Some email providers show warnings if the email’s domain authentication fails.
Never click account verification links in emails. Go directly to the site.
Enable 2FA on exchanges with a non-SMS method (authenticator app or hardware key).
Verify domain carefully: Official Binance domains are binance.com, binance.us, etc. Check the exact domain.

​
If You Already Entered Credentials

1

Change Password Immediately

Log into the real exchange and change your password immediately.
2

Enable 2FA

Enable two-factor authentication if not already enabled.
3

Check Account Activity

Review recent transactions and withdrawals. Report any unauthorized activity.
4

Revoke API Keys

If you had API keys, revoke them immediately.
5

Report the Phishing Email

Report to your email provider and the official exchange.

Grant Phishing + Wallet Drainer

See how phishing leads to wallet drains

Fake Wallet Login

How fake login pages steal credentials

Hacks Category

Explore all types of phishing and technical exploits

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. Binance - Official Website and Security
  2. Binance - How to Identify Phishing Emails
  3. Email Security - SPF and DMARC