Verify a decision

{"actor":"system:backfill","investigation_id":"7309b04d-0e4d-4637-87d6-a74c5e709c74","kind":"publish","page_slug":"world-cup-2026-crypto-scam-network","published_at":"2026-06-15T17:32:48.388Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"World Cup 2026 Crypto Scam Network","sections":[{"content":"The World Cup 2026 Crypto Scam Network is not a single operator but a constellation of independent and semi-organized threat actors exploiting the global attention surrounding the 2026 FIFA World Cup, hosted across the United States, Canada, and Mexico. Researchers and law enforcement have documented activity beginning as early as August 2025 and intensifying through June 2026. FortiGuard Labs identified approximately 13,000 World Cup-themed domains registered between January and May 2026, of which roughly 8.8% were assessed as malicious or suspicious. CybelAngel identified 344 domains mimicking the official FIFA 2026 website, with 125 live and serving content as of June 9, 2026. The FBI's Internet Crime Complaint Center issued a formal Public Service Announcement on May 27, 2026, listing more than 30 verified spoofed FIFA domains. The fraud typologies include: fake ticketing portals demanding cryptocurrency payment; fixed-match betting schemes requiring upfront Bitcoin; fan-branded meme coins with alleged insider supply pre-purchases; Android banking trojans distributed via fake streaming apps; visa and employment fraud; and counterfeit merchandise and hospitality offers.","heading":"Overview and Scope","severity":"critical","sources":[{"credibility":1,"name":"FBI IC3 PSA260527 — Threat Actors Spoofing FIFA Websites","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"CybelAngel — FIFA World Cup 2026 Fraud Threat Report (468 IOCs)","type":"research","url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"credibility":2,"name":"The Hacker News — FIFA World Cup 2026 Scams Already Live","type":"news_article","url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html"},{"credibility":2,"name":"Malwarebytes — The 2026 World Cup scam economy is already running before the first whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"}]},{"content":"The FBI's May 27, 2026 PSA (Alert I-052726-PSA) specifically warned of threat actors registering domains that closely mimic official FIFA properties through minor misspellings and alternative top-level domains. Identified examples include fiffa.com, jobs-fifa.com, fifa.cab, fifa.pink, fifa.blue, fifa.pub, fifa-ticket.live, fifaworldcup26.sale, and worldcup2026-tickets.com.mx. CybelAngel researchers attributed the dominant ticketing-fraud cluster to a threat actor tracked as 'Ghost Stadium,' described as a Chinese-speaking, financially motivated group first observed in November 2025. Ghost Stadium is alleged to operate a custom React-based phishing kit supporting 11 languages that replicates FIFA's authentication system including a genuine client ID copied from the live site. As of June 9, 2026, the group had 125 live domains, with 146 of its total domains using Cloudflare nameservers. The domain fifa.city was separately identified as having operated since approximately 2019. Since August 2025, researchers attribute more than 4,300 fraudulent FIFA-branded domains to this and related actors. The FBI and LASD both advise users to navigate directly to fifa.com rather than following links from advertisements, social media, SMS, Telegram, or WhatsApp.","heading":"Domain Spoofing and Typosquatting Infrastructure","severity":"critical","sources":[{"credibility":1,"name":"FBI IC3 PSA260527 — Threat Actors Spoofing FIFA Websites","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"CybelAngel — FIFA World Cup 2026 Fraud Threat Report","type":"research","url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"credibility":2,"name":"BitDefender — FBI Warns Fans About FIFA Scams Ahead of 2026 World Cup","type":"news_article","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-fifa-scams-2026-world-cup"},{"credibility":2,"name":"The Cyber Express — FIFA World Cup 2026 Scams: Fake Domains Target Fans","type":"news_article","url":"https://thecyberexpress.com/fifa-world-cup-2026-scams/"}]},{"content":"TRM Labs documented at least two distinct fake ticketing operations as of June 2026. The first, operating on the Polygon network, received approximately $1,562 in a single transaction on April 1, 2026. The second operates via Bitcoin and had not yet recorded conversions as of TRM's publication but maintained a live phishing site. TRM Labs traced funds from the Polygon ticketing-scam address through a series of cross-chain swaps to the TRON network, consistent with techniques used to obscure the origin of illicit cryptocurrency proceeds. Group-IB estimated ticket fraud losses in the range of $71 million to $474 million when accounting for premium pricing across fraudulent resale operations. The Los Angeles County Sheriff's Department issued an advisory on June 3, 2026 specifically identifying cryptocurrency payment requests as a primary red flag: 'Be cautious of sellers requesting payment through cryptocurrency, wire transfer, peer-to-peer payment apps, gift cards, or other methods that are difficult to reverse.' Law enforcement noted that cryptocurrency transactions cannot be reversed, making digital assets the preferred payment method for fraudsters. FIFA does not accept cryptocurrency for any official ticket or merchandise transactions.","heading":"Fake Ticketing Portals and Cryptocurrency Payment Fraud","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"credibility":2,"name":"CryptoTimes — World Cup 2026: LASD Issues Warning Over FIFA Crypto Scams","type":"news_article","url":"https://www.cryptotimes.io/2026/06/04/world-cup-2026-lasd-issues-warning-over-fifa-crypto-scams/"},{"credibility":2,"name":"Decrypt — World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement"},{"credibility":2,"name":"FOX 11 Los Angeles — LA County Sheriff warns of scams ahead of World Cup kickoff","type":"news_article","url":"https://www.foxla.com/news/la-sheriff-world-cup-scam-warning"},{"credibility":2,"name":"CybelAngel — FIFA World Cup 2026 Fraud Threat Report","type":"research","url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"}]},{"content":"TRM Labs identified a fixed-match betting operation using a Bitcoin address that received small payments across at least four days between January and May 2026. The scheme involves operators contacting prospective victims and claiming to possess insider knowledge of pre-arranged match outcomes, then demanding upfront cryptocurrency payments in exchange for alleged guaranteed betting tips. Payments from this address were routed to custodial exchange accounts rather than self-hosted wallets, a pattern consistent with rapid liquidation. TRM noted that confirmed losses across all documented World Cup-related crypto scam addresses totaled approximately $1,700 as of their mid-June 2026 report, though this figure reflects only the addresses directly identified and not the broader fraud ecosystem. CybelAngel separately identified 87 indicators of compromise tied to betting and gambling fraud infrastructure, including a fraudulent platform at the domain 2026.com that used fabricated 'official regional partner' badges, operated Telegram channels for deposit-driven monetization, and distributed a companion app called '2026 Sports' that profiles devices and uses non-standard communication channels.","heading":"Fixed-Match Betting Schemes","severity":"high","sources":[{"credibility":2,"name":"TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"credibility":2,"name":"Bitcoinist — TRM Warns Crypto Scammers Are Seeding World Cup 2026 Ticket And Betting Traps","type":"news_article","url":"https://bitcoinist.com/trm-world-cup-2026-crypto-scams-ticket-betting/"},{"credibility":2,"name":"CybelAngel — FIFA World Cup 2026 Fraud Threat Report","type":"research","url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"}]},{"content":"TRM Labs documented multiple fan-branded cryptocurrency tokens being marketed in connection with the 2026 World Cup, characterizing them as potential pump-and-dump vehicles. The most extensively documented case involves the token World Cup PvP (ticker: WCUP), which launched on June 10, 2026 and reached a peak market capitalization of approximately $50 million within its first day, after promotion by multiple cryptocurrency influencers on X (formerly Twitter). On-chain analytics firm Bubblemaps alleged that 95% of WCUP's circulating supply was acquired by more than 30 newly created wallets within approximately one minute of the token's launch. These wallets were allegedly funded from a centralized exchange roughly 30 minutes before launch, then used to snipe the supply at the moment of token creation. The alleged insider group then distributed holdings across more than 2,500 new wallets using Uniswap Router transactions in an apparent attempt to obscure the concentration. Bubblemaps reported that most influencers who promoted WCUP did not disclose payment arrangements to their followers. The token had approximately $536,000 in liquidity at time of reporting, which Bubblemaps noted would be insufficient to absorb a coordinated sell-off by early holders. TRM Labs also flagged a separate token called WORLDCUP listed on the LBank exchange, warning that such tokens lack official affiliation with FIFA and carry elevated risk of total loss. Separately, Malwarebytes documented websites marketing tokens as 'the official community token celebrating the FIFA World Cup 2026,' advertising features including a 'Mega Airdrop,' a 7-billion-token total supply, and a participant counter set to the symbolic number 48 matching the tournament's team count. FIFA has not officially issued or endorsed any cryptocurrency token.","heading":"Fan Meme Coins and Pump-and-Dump Token Schemes","severity":"high","sources":[{"credibility":2,"name":"CryptoNews.net — 95% of World Cup Token WCUP Supply Pre-Purchased by Single Group, Bubblemaps Alleges","type":"on_chain","url":"https://cryptonews.net/news/altcoins/33000264/"},{"credibility":2,"name":"KuCoin News — FIFA World Cup Token WCUP Suspected of Wallet Bundling Manipulation","type":"news_article","url":"https://www.kucoin.com/news/flash/fifa-world-cup-token-wcup-suspected-of-wallet-bundling-manipulation"},{"credibility":2,"name":"TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"credibility":2,"name":"Malwarebytes — The 2026 World Cup scam economy is already running before the first whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"credibility":2,"name":"The Market Periodical — Bad Actors Target 2026 FIFA World Cup with Crypto Scam Ticket Sales and Memecoins","type":"news_article","url":"https://themarketperiodical.com/2026/06/12/bad-actors-target-2026-fifa-world-cup-with-crypto-scam-ticket-sales-and-memecoins/"}]},{"content":"The Hacker News reported in June 2026 that two Android banking trojan families, identified as Massiv and Perseus, are being distributed through unofficial streaming applications that impersonate legitimate services offering World Cup broadcasts. These applications are not available through the Google Play Store and are distributed via third-party links. Once installed, both malware families request Android accessibility permissions and, if granted, can intercept one-time authentication codes, overlay fake login screens on top of legitimate banking and cryptocurrency applications, and drain funds from compromised accounts. The Perseus variant is additionally reported to scan note-taking applications for saved passwords and cryptocurrency wallet recovery phrases. Security researchers identified that 10 to 12 percent of open Wi-Fi networks in host cities are entirely unsecured with WPS enabled, creating an additional attack surface for credential interception.","heading":"Android Banking Malware in Fake Streaming Applications","severity":"critical","sources":[{"credibility":2,"name":"The Hacker News — FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins","type":"news_article","url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html"}]},{"content":"CybelAngel documented 14 indicators of compromise tied to employment and task fraud and 12 tied to travel and visa operations. The visa fraud cluster exploits the complex tri-nation visa landscape across the United States, Canada, and Mexico. A key malicious domain identified was usavisaworldcup.com, which allegedly collects passport scans and demands cryptocurrency payments for fraudulent visa processing services. This operation was amplified via a TikTok account using the handle visa.applications.usa and hosted at least 20 event-themed malicious domains on shared infrastructure. On the employment side, CybelAngel observed threat actors cloning FIFA's official recruitment portal using the same phishing kit repurposed for impersonating Coca-Cola, Netflix, Spotify, Hilton, and UEFA. CybelAngel noted that employment and task fraud grew from 1.6% of job-scam reports during Qatar 2022 to 38.8% by mid-2024, indicating a structural shift in how fraudsters exploit major sporting events.","heading":"Visa, Employment, and Travel Fraud with Cryptocurrency Components","severity":"high","sources":[{"credibility":2,"name":"CybelAngel — FIFA World Cup 2026 Fraud Threat Report (468 IOCs)","type":"research","url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"}]},{"content":"The FBI Cyber Division and Internet Crime Complaint Center issued PSA260527 on May 27, 2026, formally warning of typosquatting and domain spoofing attacks against FIFA's official web presence and listing more than 30 verified fraudulent domains. The Los Angeles County Sheriff's Department issued a separate public advisory on June 3, 2026 identifying cryptocurrency payment requests as among the clearest indicators of fraud in the context of World Cup-related offers. LASD specifically cautioned against sellers requesting payment through cryptocurrency, wire transfer, peer-to-peer payment apps, gift cards, or other irreversible methods. Both agencies recommend that victims contact local law enforcement, notify their financial institutions, preserve all transaction documentation, and file complaints with the FBI's Internet Crime Complaint Center at ic3.gov. Chainalysis estimated that crypto theft across all fraud typologies in 2025 reached $3.4 billion, providing broader context for the scale of the threat environment in which these World Cup schemes operate.","heading":"Law Enforcement Warnings and Victim Guidance","severity":"high","sources":[{"credibility":1,"name":"FBI IC3 PSA260527","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"CryptoTimes — World Cup 2026: LASD Issues Warning Over FIFA Crypto Scams","type":"news_article","url":"https://www.cryptotimes.io/2026/06/04/world-cup-2026-lasd-issues-warning-over-fifa-crypto-scams/"},{"credibility":2,"name":"Decrypt — World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement"},{"credibility":2,"name":"FOX 11 Los Angeles — LA County Sheriff warns of scams ahead of World Cup kickoff","type":"news_article","url":"https://www.foxla.com/news/la-sheriff-world-cup-scam-warning"}]}],"sources_used":[{"credibility":1,"name":"FBI IC3 PSA260527 — Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"credibility":2,"name":"CybelAngel — FIFA World Cup 2026 Fraud: 468 IOCs and Four Active Threat Vectors","type":"research","url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"credibility":2,"name":"Malwarebytes — The 2026 World Cup scam economy is already running before the first whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"credibility":2,"name":"The Hacker News — FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins","type":"news_article","url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html"},{"credibility":2,"name":"Decrypt — World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement"},{"credibility":2,"name":"CryptoTimes — World Cup 2026: LASD Issues Warning Over FIFA Crypto Scams","type":"news_article","url":"https://www.cryptotimes.io/2026/06/04/world-cup-2026-lasd-issues-warning-over-fifa-crypto-scams/"},{"credibility":2,"name":"FOX 11 Los Angeles — LA County Sheriff warns of scams ahead of World Cup kickoff","type":"news_article","url":"https://www.foxla.com/news/la-sheriff-world-cup-scam-warning"},{"credibility":2,"name":"BitDefender Hot for Security — FBI Warns Fans About FIFA Scams Ahead of 2026 World Cup","type":"news_article","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-fifa-scams-2026-world-cup"},{"credibility":2,"name":"Bitcoinist — TRM Warns Crypto Scammers Are Seeding World Cup 2026 Ticket And Betting Traps","type":"news_article","url":"https://bitcoinist.com/trm-world-cup-2026-crypto-scams-ticket-betting/"},{"credibility":2,"name":"CryptoNews.net — 95% of World Cup Token WCUP Supply Pre-Purchased by Single Group, Bubblemaps Alleges","type":"on_chain","url":"https://cryptonews.net/news/altcoins/33000264/"},{"credibility":2,"name":"KuCoin News — FIFA World Cup Token WCUP Suspected of Wallet Bundling Manipulation","type":"news_article","url":"https://www.kucoin.com/news/flash/fifa-world-cup-token-wcup-suspected-of-wallet-bundling-manipulation"},{"credibility":2,"name":"The Market Periodical — Bad Actors Target 2026 FIFA World Cup with Crypto Scam Ticket Sales and Memecoins","type":"news_article","url":"https://themarketperiodical.com/2026/06/12/bad-actors-target-2026-fifa-world-cup-with-crypto-scam-ticket-sales-and-memecoins/"},{"credibility":2,"name":"The Cyber Express — FIFA World Cup 2026 Scams: Fake Domains Target Fans","type":"news_article","url":"https://thecyberexpress.com/fifa-world-cup-2026-scams/"},{"credibility":2,"name":"Cybersecurity News — Cybercriminals Exploit 2026 FIFA World Cup With Phishing, Fake Stores, and Ticket Scams","type":"news_article","url":"https://cybersecuritynews.com/cybercriminals-exploit-2026-fifa-world-cup-with-phishing/"}],"summary":"The 2026 FIFA World Cup has attracted a coordinated wave of crypto-linked fraud operating across multiple typologies, including typosquatting domain networks, fake ticket portals demanding cryptocurrency payment, fixed-match betting schemes, pump-and-dump fan meme coins, and Android banking malware bundled in fake streaming apps. Law enforcement agencies including the FBI Cyber Division and the Los Angeles County Sheriff's Department have issued public warnings, while blockchain analytics firm TRM Labs and cybersecurity vendors Malwarebytes, CybelAngel, and The Hacker News have documented active infrastructure running since at least August 2025, months before the first match.","timeline":[{"date":"2019-01-01","event":"Domain fifa.city, later identified as part of the fraudulent infrastructure, begins operating. Exact origin date approximate.","source":"CybelAngel FIFA World Cup 2026 Fraud Threat Report","source_url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"date":"2025-08-01","event":"Registration of fraudulent FIFA-branded domains begins at scale. The GHOST STADIUM threat actor cluster, attributed to a Chinese-speaking financially motivated group, is later traced to activity starting this period. Over 4,300 domains are ultimately registered.","source":"The Hacker News — FIFA World Cup 2026 Scams Are Already Live","source_url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html"},{"date":"2025-11-01","event":"CybelAngel first observes the Ghost Stadium threat actor cluster operating ticketing-fraud domains mimicking the official FIFA 2026 website.","source":"CybelAngel FIFA World Cup 2026 Fraud Threat Report","source_url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"date":"2026-01-01","event":"Fixed-match betting scheme begins receiving small Bitcoin payments from alleged victims. Activity documented across multiple days from January through May 2026.","source":"TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World Cup","source_url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"date":"2026-01-01","event":"FortiGuard Labs begins tracking World Cup-themed domain registrations. Between January and May 2026, approximately 13,000 such domains are registered, of which 8.8% are assessed as malicious or suspicious.","source":"The Hacker News — FIFA World Cup 2026 Scams Are Already Live","source_url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html"},{"date":"2026-03-01","event":"78 new ticketing-fraud domains are registered in March 2026 alone, attributed to the Ghost Stadium cluster.","source":"CybelAngel FIFA World Cup 2026 Fraud Threat Report","source_url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"date":"2026-04-01","event":"Polygon-based fake ticketing address receives approximately $1,562 in a single transaction — the first confirmed crypto loss tied to a directly identified World Cup ticketing scam address.","source":"TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World Cup","source_url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"date":"2026-04-01","event":"Since April 1, 2026, researchers detect more than 1,100 suspicious domains containing the words 'World' and 'Cup' and over 600 typosquat domains mimicking fifa.com.","source":"BitDefender — FBI Warns Fans About FIFA Scams Ahead of 2026 World Cup","source_url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-fifa-scams-2026-world-cup"},{"date":"2026-04-29","event":"30 fraudulent FIFA-branded domains registered on a single day, attributed to the Ghost Stadium cluster.","source":"CybelAngel FIFA World Cup 2026 Fraud Threat Report","source_url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"date":"2026-05-01","event":"Malwarebytes publishes threat intelligence report titled 'The 2026 World Cup scam economy is already running before the first whistle,' documenting fake crypto token sites, airdrop scams, and a four-part scam economy forming around the tournament.","source":"Malwarebytes — The 2026 World Cup scam economy is already running before the first whistle","source_url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"date":"2026-05-01","event":"Promotional betting channels linked to the fraudulent 2026.com platform become active.","source":"CybelAngel FIFA World Cup 2026 Fraud Threat Report","source_url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"date":"2026-05-27","event":"FBI Internet Crime Complaint Center issues PSA Alert I-052726-PSA warning of threat actors spoofing FIFA websites, listing more than 30 verified fraudulent domains including fiffa.com, jobs-fifa.com, and fifa-ticket.live.","source":"FBI IC3 PSA260527","source_url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"date":"2026-06-03","event":"Los Angeles County Sheriff's Department issues public advisory warning residents that cryptocurrency payment requests are a primary fraud indicator in World Cup-related scams.","source":"CryptoTimes — World Cup 2026: LASD Issues Warning Over FIFA Crypto Scams","source_url":"https://www.cryptotimes.io/2026/06/04/world-cup-2026-lasd-issues-warning-over-fifa-crypto-scams/"},{"date":"2026-06-09","event":"CybelAngel publishes fraud threat report identifying 468 indicators of compromise across four threat vectors, with 125 Ghost Stadium ticketing domains confirmed live.","source":"CybelAngel FIFA World Cup 2026 Fraud Threat Report","source_url":"https://cybelangel.com/blog/our-investigation-of-fifa-world-cup-2026-fraud-threat-report/"},{"date":"2026-06-10","event":"World Cup PvP token (WCUP) launches. Bubblemaps alleges that more than 30 pre-funded insider wallets acquire 95% of the supply within one minute of launch. Token reaches $50 million market cap within 24 hours following influencer promotion on X.","source":"CryptoNews.net — 95% of World Cup Token WCUP Supply Pre-Purchased by Single Group, Bubblemaps Alleges","source_url":"https://cryptonews.net/news/altcoins/33000264/"},{"date":"2026-06-11","event":"TRM Labs publishes formal report identifying four active crypto scam addresses connected to three live operations targeting World Cup fans, with total confirmed receipts under $1,700 across directly identified addresses.","source":"TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World Cup","source_url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"}]},"v":1}