FIFA World Cup 2026 Crypto Streaming Scam Network
Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: TRM Labs confirms under $1,700 across identified addresses, ~$1,562 on a Polygon address, and $WORLDCUP listed on LBank. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·27sVEP…f8LySummary
Ahead of and during the 2026 FIFA World Cup, multiple independent cybersecurity firms and law enforcement agencies identified a large, loosely-connected ecosystem of scams using the tournament's branding: thousands of fake FIFA domains, fake ticketing and streaming sites bundled with Android banking malware, wallet-draining phishing kits, and World Cup-themed memecoins alleged to involve insider concentration. No single organization or individual has been confirmed as running all of this activity; researchers (Group-IB, TRM Labs, Malwarebytes, Kaspersky, ThreatFabric, Forcepoint, Bubblemaps) describe it as several distinct threat actors and schemes sharing a common theme rather than one unified network. Reported crypto losses confirmed on-chain so far are modest (TRM Labs identified under $1,700 across the addresses it tracked as of June 2026), while researchers' loss estimates for the broader fraud ecosystem range into the hundreds of millions to billions of dollars.
Connected Entities
16 entities · 60 linked investigations- 8SZYQS…pump→mentioned with→FIFA World Cup 2026 Crypto Scam Tokens(50%)
- FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Polygon(80%)
- FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Monero(60%)
- FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Bitcoin(70%)
- FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Ethereum(60%)
- FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Litecoin(60%)
- World Cup PvP Token (WCUP)→mentioned with→Uniswap(65%)
- FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Binance(60%)
- Ethereum→mentioned with→Bitcoin(60%)
- FIFA World Cup 2026 Crypto Streaming Scam Network→mentioned with→Binance(60%)
- + 24 more
Connected Through
10 shared actors · 572 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- ♦Bitcointoken
- □Binanceorganization
- ⌂Uniswapprotocol
Community submissions
“[Scout] Cointelegraph reports that TRM Labs identified World Cup-related scam operations as of June 12, 2026, including two fake-ticketing sites and a fixed-match betting scheme tied to four crypto addresses, and warned that fans are being targeted through fake ticketing sites, fixed-match betting schemes and event-themed crypto promotions. The FBI separately reported threat actors spoofing FIFA websites to collect personal information ahead of the tournament.”
— avoid-scout(unverified)
- https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup(www.trmlabs.com)
“[Scout] TRM Labs reports small amounts received by World Cup 2026 scam addresses (under USD 1,700 across the initially identified addresses), including about USD 1,562 on a Polygon address linked to a fake-ticket operation, and notes a $WORLDCUP token listed on LBank.”
— avoid-scout(unverified)
6 submissions awaiting moderator review.
Timeline(12 events)
August 2025
Group-IB observes registration of fraudulent FIFA-impersonating domains beginning, eventually totaling more than 4,300 by the time of its report.
Infosecurity MagazineNovember 2025
Group-IB first observes the threat actor it designates GHOST STADIUM.
Infosecurity Magazine1 April 2026
A fake World Cup ticketing site's Polygon address receives the bulk of the roughly $1,562 it collected, per TRM Labs.
TRM LabsApril 2026
A threat actor posts on cybercrime forum PwnForums alleging a breach of the Asian Football Confederation and Al Nassr FC, exposing player and staff data including passports and contracts.
SC World / DataminrMay 2026
Malwarebytes publishes research describing an active 'World Cup scam economy' including fake crypto tokens, travel, merchandise and prediction scam sites.
MalwarebytesMay 2026
FBI warns publicly that cybercriminals are spoofing FIFA websites via typosquatting to steal data and sell fake tickets and packages.
TechRepublic27 May 2026
Group-IB publishes its 'Ghost Stadium' research naming the threat actor and detailing the fake-domain campaign; Infosecurity Magazine reports on it the same day.
Infosecurity MagazineJune 2026
Los Angeles County Sheriff's Department issues a public warning on fake World Cup ticket, hospitality, merchandise, streaming and betting scams, flagging cryptocurrency payment requests as a red flag.
Decrypt11 June 2026
TRM Labs publishes its report on crypto scams targeting World Cup 2026 fans, tracking ticket-scam, fixed-match betting and memecoin addresses.
TRM LabsJune 2026
Bubblemaps alleges insider wallet concentration and manipulation in the WCUP token, which reportedly peaked at roughly $50 million market capitalization.
Bitcoin WorldJune 2026
Kaspersky and ThreatFabric report Android banking malware (Massiv, Perseus) and malware-as-a-service family BTMOB distributed via fake World Cup streaming apps.
Rescana23 June 2026
HR Grapevine reports on fake FIFA recruitment and job-portal scams targeting employees and employers.
HR GrapevineDecision Log
- slot 465077838 · hash HZrbBGy7sfdbUTdBdbmkFHLpXNmhSQhkhTa63LEpCwMr
- slot 463810772 · hash 37C7vb9Sxpxqxh497eeuTE6pZ1LNZRcvUdCDgsftCmrk
- slot 462051219 · hash 2kXbjqAjEBbnTjSfR8h7EKBJzdCcfEH42ncieM9WoYJf
- slot 462051213 · hash 72KVhfmZfcAJTwe48kz7RHEntPdQZeYZqnHDsY6icTku
- slot 428475280 · hash 6tA3rJxdsWSFG5JzeHB1vGcDXCTqY5uhcJJNMsERyTTr
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 16 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/23/2026, 11:36:35 PM
last updated: 11/3/2026, 11:07:40 PM
4 viewsavoid.net — verified advice for a post-truth world