Skip to main content
Category: Hacks → Phishing & TyposquattingHacksPhishing & TyposquattingQR Code PhishingReading time: 9 minutes
Risk level: High
Target audience: DeFi users, social media users

​
Meet Ngozi

Ngozi is an active Curve Finance user. She sees a post in a Curve Discord channel:
“Curve Protocol Emergency Update – Please scan the QR code below to migrate to the new contract. You must do this within 24 hours or your liquidity will be at risk!”
Below is a QR code. The post looks official (similar formatting to real Curve announcements). Ngozi scans the QR code with her phone. It takes her to a URL that looks like Curve’s site but is actually a fake. When she connects her wallet, the attacker gains approval access and drains her liquidity provider tokens. Loss: ₦600,000 in LP tokens.

​
Where the Scammer Won

  • QR code hides the real URL: People scan without seeing the actual destination.
  • Official-looking post: The formatting matched real Curve announcements.
  • Urgency pressure: “Within 24 hours or your liquidity will be at risk” created FOMO.
  • Trust in community: The post was in an official Discord channel, making it seem legitimate.

​
Red Flags Ngozi Missed

  • Official protocols post updates on official channels, not QR codes in Discord.
  • QR codes hide the real URL. Never scan QR codes for financial transactions.
  • “Act within 24 hours or lose funds” is urgency-based pressure.
  • The post may have been from a compromised account or fake admin.

​
How QR Code Phishing Works

What happens: Scammer posts fake announcement in Discord/Telegram with QR code, claiming urgent protocol update needed.
What happens: QR code links to fake website that looks like the official protocol site.
What happens: Victim scans QR code without seeing the actual URL, trusting the community post.
What happens: Fake site asks to connect wallet, then requests token approval.
What happens: Once approval granted, malicious contract drains all tokens from victim’s wallet.

​
Prevention

Never scan QR codes for wallet connections or transactions.
Always manually type URLs for critical actions.
Verify announcements on official websites, not via QR codes.
Check if the post is from a verified admin: Look for verification badges or check admin list.
Official protocols don’t use QR codes for updates: Real updates are posted on official websites and GitHub.

​
If You Already Scanned and Connected

1

Revoke Approvals Immediately

Use Revoke.cash or EtherScan’s token approval tool.
2

Move Remaining Funds

Create a new wallet and move all remaining funds immediately.
3

Report the Post

Report the fake post to Discord/Telegram moderators.
4

Report the Site

Report the fake site to ChainAbuse.
5

Warn the Community

Post a warning in the channel to protect others.

Grant Phishing + Wallet Drainer

See how phishing leads to wallet drains

Hacks Category

Explore all types of phishing and technical exploits

Check Your Wallet

Verify if addresses are reported as malicious

Report a Scam

Report fraudulent posts and addresses

​
References

  1. Curve Finance - Official Website and Announcements
  2. Discord - How to Report Scam Posts
  3. ChainAbuse - Report Scam Addresses