Audit log

Every state-changing event for Google Coin / Fake Gemini AI Chatbot Presale Operation: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-02 23:06:41Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,905,811

   sig

   3LA4HDHme4KD…L7XDjGDVcopyexplorer ↗

   hash

   4kKqnPsiG5ta…k7Z4uPmHcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (17167 B) ▸

   {"actor":"system:backfill","investigation_id":"418cc740-0804-4065-8676-c6a509b4b88e","kind":"publish","page_slug":"google-coin-fake-gemini-ai-chatbot-presale-operation","published_at":"2026-06-02T23:06:41.797Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Google Coin / Fake Gemini AI Chatbot Presale Operation","sections":[{"content":"On February 18, 2026, cybersecurity firm Malwarebytes published a report documenting a live cryptocurrency presale fraud operation centered on a website advertising 'Google Coin.' The operation was discovered and analyzed by Malwarebytes researchers who found the site fully operational, accepting cryptocurrency payments around the clock through an AI-powered chatbot. The scam site was designed to impersonate Alphabet Inc.'s Google brand and its Gemini AI assistant product, exploiting name recognition from one of the world's most trusted technology companies. Google has never issued a cryptocurrency of any kind, and Gemini AI is not deployed on third-party investment or presale websites.","heading":"Operation Overview and Discovery","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Fake Gemini AI Chatbot Promotes Google Coin in New Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-fake-google-coin-scam-ai-chatbot-gemini/"}]},{"content":"The scam site employed systematic impersonation of multiple real organizations. The website reproduced Google's visual identity including the 'G' logo, navigation menu styling, and an overall design consistent with Google's aesthetic. The embedded chatbot introduced itself as 'Gemini — your AI assistant for the Google Coin platform,' using Gemini's sparkle icon and a green 'Online' status indicator to reinforce the illusion of authenticity. A 'Trusted By Industry' banner displayed the logos of OpenAI, Binance, Coinbase, Squarespace, and SpaceX. Malwarebytes confirmed that none of those companies have any connection to the operation. The site also referenced a fictitious 'Google-Chain' blockchain network. Google has not issued any cryptocurrency, and Gemini AI is an official Google product that is not deployed on third-party investment platforms.","heading":"Brand Impersonation and Identity Fraud","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Scam Abuses Gemini Chatbots to Convince People to Buy Fake Crypto — Dark Reading","type":"news_article","url":"https://www.darkreading.com/endpoint-security/scam-abuses-gemini-chatbots-convince-people-buy-fake-crypto"},{"credibility":2,"name":"Malwarebytes uncovers fake Google Coin crypto scam using AI chatbot — Fox News","type":"news_article","url":"https://www.foxnews.com/tech/fake-google-gemini-ai-pushes-google-coin-crypto-scam"}]},{"content":"A defining feature of this operation is its use of a purpose-built AI chatbot to conduct the entire sales process without human operators. The chatbot maintained a scripted persona as 'Gemini,' refused to break character under questioning, and declined to provide any verifiable company details — including a registered legal entity, regulatory license, audit firm, or official contact email. The bot answered investment questions in real time, delivered fabricated return projections, and guided visitors toward completing cryptocurrency payments. Because a single chatbot can engage hundreds of simultaneous visitors 24 hours a day, the operation could scale beyond what any human-staffed fraud operation could achieve. According to Chainalysis's 2026 Crypto Crime Report, AI-enabled scam operations are 4.5 times more profitable than traditional scams, generating an average of $3.2 million per operation versus $719,000 for non-AI operations.","heading":"AI-Automated Fraud Engine","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Chainalysis: Impersonation and AI scams are becoming crypto's biggest threat — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks"},{"credibility":2,"name":"2026 Crypto Crime Report: Scams — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/crypto-scams-2026/"}]},{"content":"The chatbot delivered specific, fabricated return projections to potential investors. When asked whether a user would profit from buying 100 tokens, the bot responded that purchasing 100 tokens at the presale price of $3.95 each (totaling $395) would be worth approximately $2,755 at the projected listing price of $27.55 per token — approximately 7x growth. The site presented a tiered bonus structure: 5% for 100 tokens, scaling to 30% for 100,000 tokens. Manufactured urgency was a central tactic: the site displayed a 'Stage 5 of 5' presale counter, claimed over 9.9 million tokens had already been sold, and posted February 18 as a hard listing deadline. Visitors who clicked 'Buy' were taken to a fake wallet dashboard purporting to show Bitcoin, Ethereum, and Google Coin balances, then directed to provide payment via cryptocurrency transfer. All payments would be irreversible with no mechanism for token delivery.","heading":"Financial Projections and Pressure Tactics","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":3,"name":"Fake Gemini bot pushes Google Coin in AI scams surge — The Bit Gazette","type":"news_article","url":"https://thebitgazette.com/fake-gemini-bot-lured-crypto-investors-with-fabricated-google-coin-presale-promising-7x-returns/"},{"credibility":2,"name":"If a bot tries to sell you a new Google Coin, it's a scam — Consumer Affairs","type":"news_article","url":"https://www.consumeraffairs.com/news/if-a-bot-tries-to-sell-you-a-new-google-coin-its-a-scam-021926.html"}]},{"content":"Malwarebytes identified six cryptocurrency wallet addresses to which the scam operation directed payments. The following addresses were documented in the February 2026 research: Ethereum address 0xEc7a42609D5CC9aF7a3dBa66823C5f9E5764d6DA and Solana address 98388xymWKS6EgYSC9baFuQkCpE8rYsnScV4L5Vu8jt. Bitcoin and additional chain addresses were also identified. All payments directed to these addresses are irreversible by design. The actual operator identities behind these wallet addresses had not been publicly attributed as of the research publication date.","heading":"Known Cryptocurrency Wallet Addresses","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"}]},{"content":"The operators of this fraud operation remain unidentified. The scam site provided no verifiable company details, registered legal entity, regulatory license, or official contact information. The chatbot was scripted to refuse any questions that might reveal the true nature of the operation, including acknowledging the possibility of fraud or providing auditable credentials. No law enforcement action against specific operators had been publicly announced as of the Malwarebytes discovery on February 18, 2026. The anonymous and automated nature of the operation is consistent with Chainalysis's findings that AI-enabled fraud operations can be run with minimal human footprint.","heading":"Operator Identity and Attribution","severity":"high","sources":[{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Fake Gemini AI Chatbot Promotes Google Coin in New Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-fake-google-coin-scam-ai-chatbot-gemini/"}]},{"content":"The Google Coin operation exemplifies a documented surge in AI-automated impersonation fraud in the cryptocurrency sector. Chainalysis's 2026 Crypto Crime Report found that impersonation scams grew 1,400% year over year in 2025, with the average payment per victim rising more than 600%. Roughly 60% of all funds flowing into crypto scam wallets in 2025 were tied to scammers using AI tools. The FBI's 2025 Internet Crime Complaint Center (IC3) report documented $11 billion in reported cryptocurrency fraud losses from 181,565 complaints, with investment fraud accounting for nearly 49% of all scam-related losses. The FBI noted that AI tools enable criminals to manufacture convincing fake support agents, government notices, and trusted company personas at scale. The Google Coin operation demonstrates the specific technique of impersonating a widely trusted AI assistant (Gemini) to confer legitimacy on a non-existent investment product.","heading":"Broader Context: AI-Enabled Impersonation Fraud Surge","severity":"high","sources":[{"credibility":2,"name":"2026 Crypto Crime Report: Scams — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/crypto-scams-2026/"},{"credibility":2,"name":"Chainalysis: Impersonation and AI scams are becoming crypto's biggest threat — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks"},{"credibility":1,"name":"FBI 2025 IC3 Annual Report — FBI","type":"regulatory","url":"https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"},{"credibility":1,"name":"Cryptocurrency and AI Scams Bilk Americans of Billions — FBI","type":"regulatory","url":"https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions"}]},{"content":"Several indicators conclusively identify this operation as fraudulent. First, Google (Alphabet Inc.) has never issued a cryptocurrency of any kind; the 'Google Coin' token does not exist on any legitimate blockchain. Second, the real Gemini AI product from Google is not deployed on third-party investment or presale websites. Third, no legitimate investment product can guarantee specific future token prices or percentage returns. Fourth, the fabricated 'Trusted By Industry' endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX were confirmed by Malwarebytes to have no basis in reality. Fifth, the chatbot's refusal to provide any verifiable legal or regulatory credentials is a hallmark of fraudulent operations. Any site using AI chatbot branding from Google, OpenAI, or other major technology companies on a cryptocurrency presale page should be treated as a high-probability fraud.","heading":"Consumer Protection Indicators","severity":"high","sources":[{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Fake Google Gemini AI pushes Google Coin crypto scam — Fox News","type":"news_article","url":"https://www.foxnews.com/tech/fake-google-gemini-ai-pushes-google-coin-crypto-scam"},{"credibility":3,"name":"Warning: AI fake! The Google Coin scam — CoinPro.ch","type":"news_article","url":"https://www.coinpro.ch/en/news-en/warning-fake-ai-the-google-coin-scam-and-how-to-protect-yourself/"}]}],"sources_used":[{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Fake Gemini AI Chatbot Promotes Google Coin in New Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-fake-google-coin-scam-ai-chatbot-gemini/"},{"credibility":2,"name":"Malwarebytes uncovers fake Google Coin crypto scam using AI chatbot — Fox News","type":"news_article","url":"https://www.foxnews.com/tech/fake-google-gemini-ai-pushes-google-coin-crypto-scam"},{"credibility":2,"name":"Scam Abuses Gemini Chatbots to Convince People to Buy Fake Crypto — Dark Reading","type":"news_article","url":"https://www.darkreading.com/endpoint-security/scam-abuses-gemini-chatbots-convince-people-buy-fake-crypto"},{"credibility":2,"name":"If a bot tries to sell you a new Google Coin, it's a scam — Consumer Affairs","type":"news_article","url":"https://www.consumeraffairs.com/news/if-a-bot-tries-to-sell-you-a-new-google-coin-its-a-scam-021926.html"},{"credibility":2,"name":"Fake Gemini AI Chatbot Used in Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-scammers-use-fake-gemini-ai-chatbot-crypto-scam/"},{"credibility":2,"name":"2026 Crypto Crime Report: Scams — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/crypto-scams-2026/"},{"credibility":2,"name":"Chainalysis: Impersonation and AI scams are becoming crypto's biggest threat — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks"},{"credibility":1,"name":"FBI 2025 IC3 Annual Report","type":"regulatory","url":"https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"},{"credibility":1,"name":"Cryptocurrency and AI Scams Bilk Americans of Billions — FBI","type":"regulatory","url":"https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions"},{"credibility":3,"name":"Fake Gemini bot pushes Google Coin in AI scams surge — The Bit Gazette","type":"news_article","url":"https://thebitgazette.com/fake-gemini-bot-lured-crypto-investors-with-fabricated-google-coin-presale-promising-7x-returns/"},{"credibility":3,"name":"Warning: AI fake! The Google Coin scam — CoinPro.ch","type":"news_article","url":"https://www.coinpro.ch/en/news-en/warning-fake-ai-the-google-coin-scam-and-how-to-protect-yourself/"},{"credibility":2,"name":"Scammers use fake Gemini AI chatbot to sell fake Google Coin — Security Boulevard","type":"news_article","url":"https://securityboulevard.com/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin/"}],"summary":"A fraudulent cryptocurrency presale operation, discovered by Malwarebytes on February 18, 2026, that deployed a custom AI chatbot impersonating Google's Gemini assistant to sell a non-existent token called 'Google Coin.' The site mimicked Google's visual identity, displayed fabricated endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX, and promised investors 7x returns through irreversible cryptocurrency payments. Google (Alphabet Inc.) has never issued a cryptocurrency; this operation was entirely fabricated and constitutes an AI-automated impersonation fraud with no legitimate entity behind it.","timeline":[{"date":"2026-01-14","event":"Chainalysis published its 2026 Crypto Crime Report documenting 1,400% year-over-year growth in impersonation scams and $17 billion in total crypto scam losses for 2025, providing the broader industry context into which the Google Coin operation fits.","source":"CoinDesk / Chainalysis","source_url":"https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks"},{"date":"2026-02-18","event":"Malwarebytes researchers discovered and documented the live Google Coin presale site operating a fake Gemini AI chatbot. The site itself claimed this date as its token listing deadline, manufacturing urgency. Six cryptocurrency wallet addresses (Ethereum, Solana, Bitcoin, and others) were identified as payment destinations.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"date":"2026-02-19","event":"Fox News, TechRepublic, Dark Reading, Consumer Affairs, and Security Boulevard published coverage of the Malwarebytes discovery, amplifying the consumer warning. The story received broad mainstream and security-industry coverage.","source":"Fox News / TechRepublic / Dark Reading","source_url":"https://www.foxnews.com/tech/fake-google-gemini-ai-pushes-google-coin-crypto-scam"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d9dd4aab-a196-4318-8fa1-863722798b0acopy
2. #2reviewby reviewerreviewer

   2026-06-03 03:24:06Z
   Score: 0 → 0 (no score change)
   The page is substantially accurate: its core claims about the Google Coin fraud operation are directly supported by the primary Malwarebytes source, and the Chainalysis and FBI statistical context is verified. The main deficiencies are a minor omission (Google's logo in the 'Trusted By Industry' banner list), a date error in the timeline (Fox News article was March 9, not February 19), and a Chainalysis publication date offset of one day. The '60% of funds' AI figure is plausible from secondary reporting but could not be confirmed verbatim in the fetched source text.
   anchoranchored

   chain

   ●mainnet-betaslot 423,944,611

   sig

   C81cVw3gVxyh…huQSrafmcopyexplorer ↗

   hash

   5sW9mjtp4s5w…XNPFGsYtcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (959 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-03T03:24:06.656Z","decision":"review","investigation_id":"418cc740-0804-4065-8676-c6a509b4b88e","new_score":0,"page_slug":"google-coin-fake-gemini-ai-chatbot-presale-operation","prev_score":0,"reason":"The page is substantially accurate: its core claims about the Google Coin fraud operation are directly supported by the primary Malwarebytes source, and the Chainalysis and FBI statistical context is verified. The main deficiencies are a minor omission (Google's logo in the 'Trusted By Industry' banner list), a date error in the timeline (Fox News article was March 9, not February 19), and a Chainalysis publication date offset of one day. The '60% of funds' AI figure is plausible from secondary reporting but could not be confirmed verbatim in the fetched source text.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 85653338-d903-493b-b6f9-1b7b47c3c7eacopy
3. #3review approveby judgejudge

   2026-06-03 03:24:06Z
   Score: 0 → 0 (no score change)
   The reviewer found zero disputed claims across 21 checked, with a reported disputed_pct of 5% (which reflects the four partially_supported findings, not any outright contradictions). The core fraud allegations — the fake Gemini chatbot, 7x return projections, fabricated endorsements, and wallet addresses — are all confirmed by the primary Malwarebytes Tier 2 source and corroborated by multiple independent outlets. The partially_supported findings (claim_findings[2] and [8] omit Google from the banner list; claim_findings[20] attributes the Chainalysis report to January 14 when the source post is dated January 13; claim_findings[21] dates the Fox News article to February 19 when it was actually published March 9) are enumeration gaps and minor date errors in contextual material, none of which affect the fraud determination. The single unverifiable finding (claim_findings[13], bonus tier percentages) is a peripheral presale detail. The high-priority coverage gap on on-chain wallet fund flows is noted for future expansion but does not impugn existing claims.
   anchoranchored

   chain

   ●mainnet-betaslot 423,944,613

   sig

   3gNmWu6GVLaC…fSg4Qo6Bcopyexplorer ↗

   hash

   YyqCtQxhdV1Y…1tNtR6GMcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1462 B) ▸

   {"actor":"judge","decided_at":"2026-06-03T03:24:06.656Z","decision":"review_approve","investigation_id":"418cc740-0804-4065-8676-c6a509b4b88e","new_score":0,"page_slug":"google-coin-fake-gemini-ai-chatbot-presale-operation","prev_score":0,"reason":"The reviewer found zero disputed claims across 21 checked, with a reported disputed_pct of 5% (which reflects the four partially_supported findings, not any outright contradictions). The core fraud allegations — the fake Gemini chatbot, 7x return projections, fabricated endorsements, and wallet addresses — are all confirmed by the primary Malwarebytes Tier 2 source and corroborated by multiple independent outlets. The partially_supported findings (claim_findings[2] and [8] omit Google from the banner list; claim_findings[20] attributes the Chainalysis report to January 14 when the source post is dated January 13; claim_findings[21] dates the Fox News article to February 19 when it was actually published March 9) are enumeration gaps and minor date errors in contextual material, none of which affect the fraud determination. The single unverifiable finding (claim_findings[13], bonus tier percentages) is a peripheral presale detail. The high-priority coverage gap on on-chain wallet fund flows is noted for future expansion but does not impugn existing claims.","score_delta":0,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d482a128-8769-443d-aa0a-da4e2dea246ccopy