Crypto scammers are concentrating their efforts on social media, and data from security firm @ChainPatrol shows how that plays out for a single project. Figures shared for Zebec indicate that
Crypto scammers are concentrating their efforts on social media, and data from security firm @ChainPatrol shows how that plays out for a single project. Figures shared for Zebec indicate that X was the largest source of threats by a wide margin.
@ChainPatrol finds and blocks fake accounts, scam websites and fake crypto wallets that copy crypto brands. Its blocklist feeds into more than 20 wallets, including MetaMask and Phantom. Its clients include Coinbase and Polymarket.
@Zebec_HQ, the team behind $ZBCN (Zebec Network), is one of ChainPatrol's clients. ChainPatrol shared the threats it has blocked for Zebec since August 2025.
X was the biggest problem by far, accounting for 40% of threats. Fake websites came next at 24%. The remainder was spread across crypto addresses, Telegram and LinkedIn.
The split suggests that impersonation on social platforms is the main route scammers use to reach a project's community, with lookalike websites as the second most common vector. Fake accounts often reply to official posts or pose as support staff, then direct users to cloned sites designed to steal credentials or wallet access.
According to ChainPatrol's documentation, once a domain is confirmed as malicious it is added to the company's blocklist. ChainPatrol says these domains are then blocked across 20+ wallets, browsers and security platforms within minutes, including MetaMask and Phantom. Users who visit a flagged link see a warning.
The approach is built around speed and reach. ChainPatrol describes its blocklist as a database of confirmed malicious entities covering phishing websites, scam social media accounts and fraudulent wallet addresses. Even if a scammer sets up many copycat sites, each can be listed once detected.
MetaMask has publicly confirmed the relationship. In a MetaMask post on its phishing protections, the wallet describes ChainPatrol as its phishing detection provider and says the firm monitors social platforms including Twitter, Facebook and LinkedIn for brand impersonation and fake staff accounts. It also reports that ChainPatrol blocked more than 29,000 threats targeting Consensys, MetaMask and Linea between January and October 2024.
For crypto projects, the Zebec figures offer a practical reference point. Monitoring official channels on X and watching for lookalike domains appear to cover the bulk of the risk, though smaller vectors such as fake addresses, Telegram groups and LinkedIn profiles still require attention.
Users can reduce exposure by checking URLs before connecting a wallet, ignoring unsolicited support messages and relying on wallets that surface blocklist warnings.
How ChainPatrol Works (ChainPatrol documentation)
MetaMask and ChainPatrol protect users with phishing warnings (MetaMask)
