Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #9[disputed][awaiting moderator]in the timeline

   “Crypto.com posts a public warning on X (Twitter) alerting users to 'an increase in targeted industry-wide phishing attacks' and listing protective measures including the Anti-Phishing Code and the Crypto.com Verify tool.”

   reviewerCrypto.com posted a public warning on X on July 30, 2026 about industry-wide phishing attacksThe page's own prose (summary, section 4 heading) hedges with 'July 30–31,' but the timeline entry asserts a specific July 30 date. A secondary source used elsewhere on the page (GridinSoft) puts the warning on July 31. The primary source (the X post) could not be independently fetched to settle this, so treat the correction with moderate confidence.
   Proposed correction (not yet applied)

   2026-07-31
   citedx.com/cryptocom/status/2082878997621538848
2. #14[disputed][awaiting moderator]in section: Broader Industry Context — AI-Powered Impersonation Surge

   “with the average payment into scam clusters rising more than 600% (from approximately $782 to $2,764)”

   reviewerThe average payment into scam clusters rose more than 600%, from approximately $782 to $2,764($2,764 - $782) / $782 = 253%, not 600%+. The dollar amounts are right but the stated percentage change contradicts the report's own numbers.
   Proposed correction (not yet applied)

   with the average payment into scam clusters rising approximately 253% (from approximately $782 to $2,764)
   citedwww.chainalysis.com/blog/crypto-scams-2026/
3. #19[disputed][awaiting moderator]in section: Precedent — SendGrid Abuse in Crypto Email Infrastructure

   “In November 2024, CoinTracking (a separate portfolio-tracking service) disclosed that an unauthorized actor had accessed its SendGrid marketing account, uploaded an external contact list of approximately 128,000 addresses, and sent phishing emails impersonating the platform using CoinTracking's verified sender domain.”

   reviewerIn November 2024, CoinTracking disclosed an unauthorized SendGrid account access incident affecting approximately 128,000 addressesThe year is wrong by one; the cited source dates this incident to November 2025. The address count (~128,000) and 'no systems/user data compromised' framing are both accurate.
   Proposed correction (not yet applied)

   In November 2025, CoinTracking (a separate portfolio-tracking service) disclosed that an unauthorized actor had accessed its SendGrid marketing account, uploaded an external contact list of approximately 128,000 addresses, and sent phishing emails impersonating the platform using CoinTracking's verified sender domain.
   citedcointracking.info/blog/unauthorized-send…d-email-activity
4. #20[disputed][awaiting moderator]in the timeline

   “CoinTracking discloses a structurally identical attack: an unauthorized actor accessed its SendGrid marketing account and sent phishing emails from the company's own verified domain to approximately 128,000 external addresses.”

   reviewerCoinTracking's SendGrid incident occurred on 2024-11-04Same underlying date error as in sections[6]; the stored date field needs correcting, not the event prose, which doesn't itself name a year.
   Proposed correction (not yet applied)

   2025-11-04
   citedcointracking.info/blog/unauthorized-send…d-email-activity

No source the reviewer could reach confirms or contradicts the claim.

1. #10[unverifiable][awaiting moderator]in section: Crypto.com Pre-Warning and Response

   “One commenter on the announcement noted the warning appeared to come 'twelve hours too late,' suggesting some users had already received fraudulent messages before the public notice.”

   reviewerA commenter on Crypto.com's warning said it arrived 'twelve hours too late' / twelve hours after some fraudulent emails were receivedCould not independently verify this specific social-media comment existed; the only accessible secondary source does not corroborate it.
   citedx.com/cryptocom/status/2082878997621538848
2. #11[unverifiable][awaiting moderator]in the timeline

   “One user comments the warning appears to have arrived twelve hours after some fraudulent emails were already received.”

   reviewerSame 'twelve hours too late' comment, restated in the timelineDuplicate of the sections[3] finding; grouped under the same defect_group.
   citedx.com/cryptocom/status/2082878997621538848
3. #18[unverifiable][awaiting moderator]in section: Broader Industry Context — AI-Powered Impersonation Surge

   “CryptoDailyUK separately reported in August 2026 that phishing-as-a-service kits enabling these campaigns were priced at approximately $20–$50 per feature tier, lowering the barrier to entry for campaign operators.”

   reviewerPhishing-as-a-service kits enabling these campaigns were priced at approximately $20-$50 per feature tier, per CryptoDailyUKCould not confirm this specific figure either in the retrieved portion of the cited article or in other current PaaS pricing coverage; not found elsewhere, so treated as unverifiable rather than confirmed.
   citedcryptodaily.co.uk/2026/08/ai-powered-cry…ishing-economics
4. #23[unverifiable][awaiting moderator]in section: Technical Attack Mechanism — SendGrid Tracking Domain Abuse

   “https://www.quora.com/Is-url1137-crypto-com-likely-from-a-scammer”

   reviewerA Quora thread exists discussing whether url1137.crypto.com is likely from a scammerCould not access or corroborate this source; not proof it's fabricated, but it could not be checked. Separately, rating a Quora community post at the same credibility tier (3) as the Dark Marc and CoinSpectator sources is questionable scoring, noted in coverage gaps.
   citedwww.quora.com/Is-url1137-crypto-com-likely-from-a-scammer

The cited evidence supports part of the claim but not all of it.

1. #8[partially supported][awaiting moderator]in section: Documented Financial Impact

   “The victim had two-factor authentication enabled but entered their one-time code on the attacker's phishing page, which relayed it to Crypto.com's real login endpoint in a real-time credential-relay attack.”

   reviewerThe one-time code entered on the phishing page was relayed in real time to Crypto.com's real login endpointThe page presents a specific, confirmed attack mechanism (real-time OTP relay to Crypto.com's real login endpoint) that the cited source explicitly says it could not establish. This overstates the certainty of the source.
   citeddarkmarc.substack.com/p/cryptocom-users-…eted-by-phishing

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Campaign Overview and Threat Actor

   “On August 10, 2026, security researchers and the aggregator site CoinSpectator reported an active phishing campaign targeting Crypto.com customers.”

   reviewerAn active phishing campaign targeting Crypto.com customers was confirmed/reported on August 10, 2026Both sources exist and are dated as the page states. CoinSpectator is a low-authority aggregator and Dark Marc a single-author Substack, so the campaign's existence rests on thin, non-independent sourcing, but the date and basic framing check out.
   citedcoinspectator.com/mainstream/2026/08/10/…ys-email-domain/darkmarc.substack.com/p/cryptocom-users-…eted-by-phishing
2. #2[confirmed][no action needed]in section: Campaign Overview and Threat Actor

   “enabling them to send emails that passed all standard email-authentication checks (SPF: pass, DKIM: pass, DMARC: pass)”

   reviewerThe phishing emails passed SPF, DKIM, and DMARC authentication checksDirectly supported by the cited source's own wording.
   citeddarkmarc.substack.com/p/cryptocom-users-…eted-by-phishing
3. #3[confirmed][no action needed]in section: Campaign Overview and Threat Actor

   “identified the threat actor as an unknown party that allegedly gained access to Crypto.com's SendGrid marketing account — or a vendor with equivalent access”

   reviewerThe threat actor allegedly gained access to Crypto.com's SendGrid account or a vendor with equivalent access; this has not been publicly confirmed or attributedPage accurately preserves the source's own uncertainty rather than overstating it.
   citeddarkmarc.substack.com/p/cryptocom-users-…eted-by-phishing
4. #4[confirmed][no action needed]in section: Technical Attack Mechanism — SendGrid Tracking Domain Abuse

   “that tracking URL silently forwarded clicking recipients to an attacker-controlled page hosted on Google Sites”

   reviewerThe attack chain involved SendGrid rewriting a malicious link to url1137.crypto.com/ls/click, which redirected to an attacker page hosted on Google SitesConfirmed against the primary technical source.
   citeddarkmarc.substack.com/p/cryptocom-users-…eted-by-phishing
5. #5[confirmed][no action needed]in section: Technical Attack Mechanism — SendGrid Tracking Domain Abuse

   “Analysts at IronScales and Netcraft have documented the same SendGrid tracking-domain abuse pattern in prior unrelated campaigns, confirming it is a known and reproducible technique.”

   reviewerIronScales and Netcraft have documented the same SendGrid tracking-domain abuse pattern in prior, unrelated campaignsBoth cited vendor reports exist and describe the same mechanism in campaigns unconnected to Crypto.com, as the page states.
   citedwww.netcraft.com/blog/popular-email-plat…personate-itselfironscales.com/threat-intelligence/compr…edential-harvest
6. #6[confirmed][no action needed]in section: Technical Attack Mechanism — SendGrid Tracking Domain Abuse

   “zero-width Unicode characters embedded in the brand name to defeat pattern-matching filters, a footer copyright date of 2022 (a template artifact left from an older email), a generic 'Dear User' salutation rather than the recipient's name, and a login-event detail citing RFC 5737 IP address 203.0.113.42 — a documentation-only address that no real login would generate”

   reviewerThe August 2026 emails contained zero-width Unicode characters, a 2022 footer copyright date, a 'Dear User' salutation, and an RFC 5737 IP (203.0.113.42) as evasion/template artifactsVerbatim match to the cited source's findings.
   citeddarkmarc.substack.com/p/cryptocom-users-…eted-by-phishing
7. #7[confirmed][no action needed]in section: Documented Financial Impact

   “The Dark Marc analysis documented one confirmed victim who reported a loss of approximately $50,000 in Bitcoin.”

   reviewerA confirmed victim reported losing approximately $50,000 in Bitcoin in this campaignMatches the source, though it remains a single, unverified first-person account with no independent wallet/transaction confirmation (see coverage gaps).
   citeddarkmarc.substack.com/p/cryptocom-users-…eted-by-phishing
8. #12[confirmed][no action needed]in section: Social Engineering Lures

   “The phishing emails reported in this campaign employed urgency-based lures, specifically: false notifications that a new bank account had been added to the victim's Crypto.com profile; claims of an unrecognized login from an unfamiliar location; and demands for immediate identity verification.”

   reviewerPhishing lures included fake bank-account additions, unrecognized-login alerts, and identity-verification demands, sometimes combined with follow-up voice callsMatches the cited source closely.
   citedblog.gridinsoft.com/crypto-com-phishing-…k-account-alert/
9. #13[confirmed][no action needed]in section: Broader Industry Context — AI-Powered Impersonation Surge

   “Chainalysis, in its 2026 Crypto Crime Report, found that impersonation scams grew approximately 1,400% year-over-year in 2025”

   reviewerChainalysis's 2026 Crypto Crime Report found impersonation scams grew approximately 1,400% year-over-year in 2025Confirmed directly against the primary report.
   citedwww.chainalysis.com/blog/crypto-scams-2026/
10. #15[confirmed][no action needed]in section: Broader Industry Context — AI-Powered Impersonation Surge

    “Operations with observable connections to AI tooling vendors extracted an average of $3.2 million compared with $719,000 for non-AI operations, operating at roughly 4.5 times greater revenue.”

    reviewerAI-tooling-connected scam operations extracted an average of $3.2 million vs. $719,000 for non-AI operations, roughly 4.5x more revenueConfirmed.
    citedwww.chainalysis.com/blog/crypto-scams-2026/
11. #16[confirmed][no action needed]in section: Broader Industry Context — AI-Powered Impersonation Surge

    “Total on-chain scam losses reached at least $14 billion in 2025 and may exceed $17 billion as additional wallets are identified.”

    reviewerTotal on-chain scam losses reached at least $14 billion in 2025 and may exceed $17 billionConfirmed.
    citedwww.chainalysis.com/blog/crypto-scams-2026/
12. #17[confirmed][no action needed]in section: Broader Industry Context — AI-Powered Impersonation Surge

    “The FBI's Internet Crime Complaint Center recorded 181,565 cryptocurrency-related complaints with $11.366 billion in attributed losses for 2025, and logged more than 22,000 AI-related complaints for the first time.”

    reviewerThe FBI's IC3 recorded 181,565 crypto-related complaints with $11.366 billion in attributed losses for 2025, and over 22,000 AI-related complaintsBoth figures independently corroborated.
    citedthenextweb.com/news/crypto-impersonation…i-deepfake-fraud
13. #21[confirmed][no action needed]in section: Precedent — SendGrid Abuse in Crypto Email Infrastructure

    “CoinTracking confirmed its core user database and financial data were not compromised.”

    reviewerCoinTracking confirmed its core user database and financial data were not compromised in the SendGrid incidentSubstantively confirmed, aside from the date error handled separately.
    citedcointracking.info/blog/unauthorized-send…d-email-activity
14. #22[confirmed][no action needed]in section: User Detection and Defense Guidance

    “a login-event IP address that falls within the RFC 5737 documentation range (192.0.2.0/24, 198.51.100.0/24, or 203.0.113.0/24)”

    reviewerThe RFC 5737 documentation IP ranges are 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24These are the well-established, standard RFC 5737 TEST-NET-1/2/3 ranges; this is a verifiable technical fact independent of any cited source.