← Google Coin / Fake Gemini AI Chatbot Presale Operationreviewed 2026-09-06 · 25 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Google Coin / Fake Gemini AI Chatbot Presale Operation against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
6 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #2[disputed][awaiting moderator]in the summary
“The site mimicked Google's visual identity, displayed fabricated endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX, and promised investors 7x returns through irreversible cryptocurrency payments.”
reviewerThe Google Coin site's 'Trusted By Industry' banner displayed fabricated endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX.The cited primary source lists six companies in the banner, including Google itself; the page's five-company list drops Google, understating the impersonation.Proposed correction (not yet applied)The site mimicked Google's visual identity, displayed fabricated endorsements from OpenAI, Google, Binance, Coinbase, Squarespace, and SpaceX, and promised investors 7x returns through irreversible cryptocurrency payments. - #6[disputed][awaiting moderator]in section: Brand Impersonation and Identity Fraud
“A 'Trusted By Industry' banner displayed the logos of OpenAI, Binance, Coinbase, Squarespace, and SpaceX.”
reviewerA 'Trusted By Industry' banner displayed the logos of OpenAI, Binance, Coinbase, Squarespace, and SpaceX.Same omission as the summary — the cited source's own list of banner logos includes Google, which the page's enumerated list drops.Proposed correction (not yet applied)A 'Trusted By Industry' banner displayed the logos of OpenAI, Google, Binance, Coinbase, Squarespace, and SpaceX. - #17[disputed][awaiting moderator]in section: Broader Context: AI-Enabled Impersonation Fraud Surge
“Chainalysis's 2026 Crypto Crime Report found that impersonation scams grew 1,400% year over year in 2025, with the average payment per victim rising more than 600%.”
reviewerThe average payment per victim rose more than 600% year over year.The cited Chainalysis report gives a 253% YoY increase in average scam payment, directly contradicting the page's 'more than 600%' figure.Proposed correction (not yet applied)Chainalysis's 2026 Crypto Crime Report found that impersonation scams grew 1,400% year over year in 2025, with the average payment per victim rising 253% year over year, from $782 in 2024 to $2,764 in 2025. - #21[disputed][awaiting moderator]in section: Consumer Protection Indicators
“Fourth, the fabricated 'Trusted By Industry' endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX were confirmed by Malwarebytes to have no basis in reality.”
reviewerThe fabricated 'Trusted By Industry' endorsements were from OpenAI, Binance, Coinbase, Squarespace, and SpaceX.Third occurrence of the same omission of Google from the banner's company list; grouped with the other two instances.Proposed correction (not yet applied)Fourth, the fabricated 'Trusted By Industry' endorsements from OpenAI, Google, Binance, Coinbase, Squarespace, and SpaceX were confirmed by Malwarebytes to have no basis in reality. - #24[disputed][awaiting moderator]in the timeline
“Fox News, TechRepublic, Dark Reading, Consumer Affairs, and Security Boulevard published coverage of the Malwarebytes discovery, amplifying the consumer warning. The story received broad mainstream and security-industry coverage.”
reviewerFox News, TechRepublic, Dark Reading, Consumer Affairs, and Security Boulevard all published coverage of the Malwarebytes discovery on February 19, 2026.The timeline entry bundles five outlets under a single February 19, 2026 date, but only Dark Reading (Feb 18) and Consumer Affairs (~Feb 19, per its URL slug '021926') actually published then; Fox News, TechRepublic, and Security Boulevard published weeks to months later.Proposed correction (not yet applied)Dark Reading (February 18, 2026) and Consumer Affairs (February 19, 2026) published early coverage of the Malwarebytes discovery, with Fox News (March 9, 2026), TechRepublic (March 10, 2026), and Security Boulevard (April 21, 2026) following in subsequent weeks and months, amplifying the consumer warning. The story received broad mainstream and security-industry coverage. - #25[disputed][awaiting moderator]in the timeline
“2026-02-19”
reviewerFox News, TechRepublic, Dark Reading, Consumer Affairs, and Security Boulevard published this coverage on 2026-02-19 (timeline date field).A single date field cannot represent the true spread of publish dates (Feb 18 to Apr 21); Feb 18 is the earliest defensible date, but the event text (see companion finding) should spell out the actual per-outlet dates rather than implying simultaneous publication.Proposed correction (not yet applied)2026-02-18
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #14[unverifiable][awaiting moderator]in section: Known Cryptocurrency Wallet Addresses
“The actual operator identities behind these wallet addresses had not been publicly attributed as of the research publication date.”
reviewerThe actual operator identities behind the wallet addresses had not been publicly attributed as of the research publication date.No source attributes the operation to a named individual or group; absence of attribution is consistent with, but not provable from, available reporting. - #15[unverifiable][awaiting moderator]in section: Operator Identity and Attribution
“No law enforcement action against specific operators had been publicly announced as of the Malwarebytes discovery on February 18, 2026.”
reviewerNo law enforcement action against specific operators had been publicly announced as of the Malwarebytes discovery on February 18, 2026.Consistent with everything found, but proving a negative (no enforcement action exists anywhere) is outside what search can conclusively establish.
confirmed
17 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“A fraudulent cryptocurrency presale operation, discovered by Malwarebytes on February 18, 2026, that deployed a custom AI chatbot impersonating Google's Gemini assistant to sell a non-existent token called 'Google Coin.'”
reviewerMalwarebytes discovered/published the Google Coin scam report on February 18, 2026.Directly confirmed by the primary Malwarebytes report and same-day Dark Reading coverage. - #3[confirmed][no action needed]in the summary
“Google (Alphabet Inc.) has never issued a cryptocurrency; this operation was entirely fabricated and constitutes an AI-automated impersonation fraud with no legitimate entity behind it.”
reviewerGoogle (Alphabet Inc.) has never issued a cryptocurrency.Uncontroversial and consistently reported across all sources. - #4[confirmed][no action needed]in section: Operation Overview and Discovery
“The operation was discovered and analyzed by Malwarebytes researchers who found the site fully operational, accepting cryptocurrency payments around the clock through an AI-powered chatbot.”
reviewerMalwarebytes found the Google Coin site fully operational, accepting cryptocurrency payments around the clock through an AI-powered chatbot.Consistent with the primary source and secondary coverage. - #5[confirmed][no action needed]in section: Brand Impersonation and Identity Fraud
“The embedded chatbot introduced itself as 'Gemini — your AI assistant for the Google Coin platform,' using Gemini's sparkle icon and a green 'Online' status indicator to reinforce the illusion of authenticity.”
reviewerThe embedded chatbot introduced itself as 'Gemini — your AI assistant for the Google Coin platform.'Direct quote match against the primary source. - #7[confirmed][no action needed]in section: Brand Impersonation and Identity Fraud
“The site also referenced a fictitious 'Google-Chain' blockchain network.”
reviewerThe site referenced a fictitious 'Google-Chain' blockchain network.Confirmed directly against the primary source. - #8[confirmed][no action needed]in section: AI-Automated Fraud Engine
“The chatbot maintained a scripted persona as 'Gemini,' refused to break character under questioning, and declined to provide any verifiable company details — including a registered legal entity, regulatory license, audit firm, or official contact email.”
reviewerThe chatbot maintained a scripted persona as 'Gemini,' refused to break character, and declined to provide verifiable company details.Corroborated by both the primary Malwarebytes report and independent TechRepublic reporting. - #9[confirmed][no action needed]in section: AI-Automated Fraud Engine
“According to Chainalysis's 2026 Crypto Crime Report, AI-enabled scam operations are 4.5 times more profitable than traditional scams, generating an average of $3.2 million per operation versus $719,000 for non-AI operations.”
reviewerAI-enabled scam operations are 4.5 times more profitable than traditional scams, averaging $3.2 million per operation versus $719,000 for non-AI operations.Exact figures confirmed against the primary Chainalysis report. - #10[confirmed][no action needed]in section: Financial Projections and Pressure Tactics
“When asked whether a user would profit from buying 100 tokens, the bot responded that purchasing 100 tokens at the presale price of $3.95 each (totaling $395) would be worth approximately $2,755 at the projected listing price of $27.55 per token — approximately 7x growth.”
reviewer100 tokens at $3.95 presale (=$395) would be worth ~$2,755 at the $27.55 listing price, ~7x growth.Figures confirmed exactly against the primary source and consistent secondary reporting. - #11[confirmed][no action needed]in section: Financial Projections and Pressure Tactics
“The site presented a tiered bonus structure: 5% for 100 tokens, scaling to 30% for 100,000 tokens.”
reviewerThe site presented a tiered bonus structure: 5% for 100 tokens, scaling to 30% for 100,000 tokens.Confirmed by both the primary source and independent secondary reporting. - #12[confirmed][no action needed]in section: Financial Projections and Pressure Tactics
“Manufactured urgency was a central tactic: the site displayed a 'Stage 5 of 5' presale counter, claimed over 9.9 million tokens had already been sold, and posted February 18 as a hard listing deadline.”
reviewerThe site displayed a 'Stage 5 of 5' presale counter, claimed over 9.9 million tokens sold, and posted February 18 as a hard listing deadline.Confirmed exactly against the primary source. - #13[confirmed][no action needed]in section: Known Cryptocurrency Wallet Addresses
“The following addresses were documented in the February 2026 research: Ethereum address 0xEc7a42609D5CC9aF7a3dBa66823C5f9E5764d6DA and Solana address 98388xymWKS6EgYSC9baFuQkCpE8rYsnScV4L5Vu8jt.”
reviewerMalwarebytes identified six cryptocurrency wallet addresses, including the specific Ethereum and Solana addresses quoted.Wallet addresses verified character-for-character against the primary source's published IOC list. - #16[confirmed][no action needed]in section: Broader Context: AI-Enabled Impersonation Fraud Surge
“Chainalysis's 2026 Crypto Crime Report found that impersonation scams grew 1,400% year over year in 2025, with the average payment per victim rising more than 600%.”
reviewerChainalysis's 2026 Crypto Crime Report found impersonation scams grew 1,400% year over year in 2025.The 1,400% growth figure is confirmed; see separate finding for the average-payment-increase figure in the same sentence. - #18[confirmed][no action needed]in section: Broader Context: AI-Enabled Impersonation Fraud Surge
“Roughly 60% of all funds flowing into crypto scam wallets in 2025 were tied to scammers using AI tools.”
reviewerRoughly 60% of all funds flowing into crypto scam wallets in 2025 were tied to scammers using AI tools.Confirmed via secondary reporting closely paraphrasing the Chainalysis report's own figure. - #19[confirmed][no action needed]in section: Broader Context: AI-Enabled Impersonation Fraud Surge
“The FBI's 2025 Internet Crime Complaint Center (IC3) report documented $11 billion in reported cryptocurrency fraud losses from 181,565 complaints, with investment fraud accounting for nearly 49% of all scam-related losses.”
reviewerThe FBI's 2025 IC3 report documented $11 billion in reported cryptocurrency fraud losses from 181,565 complaints.Complaint count matches exactly; dollar figure ($11B vs. actual ~$11.37B) is a reasonable rounding, not a material misstatement. - #20[confirmed][no action needed]in section: Broader Context: AI-Enabled Impersonation Fraud Surge
“The FBI's 2025 Internet Crime Complaint Center (IC3) report documented $11 billion in reported cryptocurrency fraud losses from 181,565 complaints, with investment fraud accounting for nearly 49% of all scam-related losses.”
reviewerInvestment fraud accounted for nearly 49% of all scam-related losses in the FBI's 2025 IC3 report.Figure and near-verbatim phrasing confirmed against reporting on the primary IC3 report. - #22[confirmed][no action needed]in the timeline
“Chainalysis published its 2026 Crypto Crime Report documenting 1,400% year-over-year growth in impersonation scams and $17 billion in total crypto scam losses for 2025, providing the broader industry context into which the Google Coin operation fits.”
reviewerChainalysis's 2026 Crypto Crime Report (published via CoinDesk coverage) documented 1,400% YoY growth in impersonation scams and $17 billion in total crypto scam losses for 2025.Date and figures confirmed against the CoinDesk report and corroborating secondary coverage. - #23[confirmed][no action needed]in the timeline
“Malwarebytes researchers discovered and documented the live Google Coin presale site operating a fake Gemini AI chatbot. The site itself claimed this date as its token listing deadline, manufacturing urgency. Six cryptocurrency wallet addresses (Ethereum, Solana, Bitcoin, and others) were identified as payment destinations.”
reviewerMalwarebytes researchers discovered the live Google Coin site on February 18, 2026, which was also the site's own claimed listing deadline; six wallet addresses were identified.Confirmed directly against the primary source.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.