Verify a decision

{"actor":"system:backfill","investigation_id":"4f3da8fa-afc8-4160-9199-52efaf368ff8","kind":"publish","page_slug":"fifa-world-cup-2026-crypto-scam-tokens","published_at":"2026-06-08T02:45:30.364Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"FIFA World Cup 2026 Crypto Scam Tokens","sections":[{"content":"Multiple fraudulent cryptocurrency projects have emerged impersonating or exploiting FIFA World Cup 2026 branding. Cybersecurity researchers and law enforcement agencies have documented several distinct categories of abuse: (1) fake tokens claiming to be 'official community tokens' of the World Cup, marketed with fake airdrops and tournament imagery; (2) Solana-based meme coins launched via pump.fun using FIFA and World Cup names without authorization; (3) a token called OFDR ('Official FIFA Defense Reserve') on Solana that uses mock-institutional language while explicitly noting it is fictional; and (4) a coordinated Chinese-speaking phishing operation called GHOST STADIUM running over 300 near-perfect replica fifa.com domains that accept cryptocurrency payments as an on-ramp for stolen funds. FIFA has not officially launched any cryptocurrency, fiat-pegged token, or blockchain coin in connection with the 2026 World Cup. FIFA's legitimate blockchain presence is limited to FIFA Collect (an NFT marketplace on the FIFA Blockchain, an EVM-compatible chain launched May 2025) and FIFA Rivals (a mobile game on the Mythos blockchain developed with Mythical Games). Any other token claiming FIFA endorsement is unauthorized.","heading":"Overview and Scope","severity":"critical","sources":[{"credibility":2,"name":"Malwarebytes: The 2026 World Cup scam economy is already running before the first whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"credibility":2,"name":"Decrypt: World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement"},{"credibility":1,"name":"FIFA official article: FIFA Collect migrates to new FIFA Blockchain","type":"official","url":"https://www.fifa.com/en/tournaments/mens/worldcup/canadamexicousa2026/articles/fifa-collect-migrates-to-new-fifa-blockchain"}]},{"content":"On May 27, 2026, the FBI Internet Crime Complaint Center issued Public Service Announcement I-052726-PSA warning that cyber threat actors are conducting spoofing attacks against FIFA websites using typosquatting techniques, with fraudulent domains including variants such as fifa[.]cab, fifa[.]pink, fifa-ticket[.]live, and worldcup2026-tickets[.]com[.]mx, among more than 31 listed. While this PSA focused on ticket-fraud phishing rather than token scams specifically, it identified cryptocurrency payment requests as a key indicator of fraud and directed victims to report incidents to ic3.gov. On June 3 and 4, 2026, the Los Angeles County Sheriff's Department issued its own alert warning fans about crypto payment requests for tickets, streaming, hospitality, and merchandise, noting that cryptocurrency transactions are difficult or impossible to reverse and therefore preferred by scammers. Both agencies recommend accessing FIFA's official services only by typing fifa.com directly into a browser and avoiding sponsored search results and social media links.","heading":"Law Enforcement Warnings","severity":"high","sources":[{"credibility":1,"name":"FBI IC3 PSA I-052726-PSA: Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"Crypto Times: World Cup 2026 — LASD Issues Warning Over FIFA Crypto Scams","type":"news_article","url":"https://www.cryptotimes.io/2026/06/04/world-cup-2026-lasd-issues-warning-over-fifa-crypto-scams/"},{"credibility":2,"name":"Fox 11 Los Angeles: LA Sheriff warns of scams ahead of World Cup kickoff","type":"news_article","url":"https://www.foxla.com/news/la-sheriff-world-cup-scam-warning"},{"credibility":2,"name":"BleepingComputer: FBI warns of fake FIFA websites running World Cup fraud schemes","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/fbi-warns-of-fake-fifa-websites-running-world-cup-fraud-schemes/"}]},{"content":"Group-IB, a cybersecurity research firm, published detailed findings attributing a large-scale phishing campaign to a threat actor it calls GHOST STADIUM, assessed as Chinese-speaking and financially motivated based on Layui 2.7.6 UI framework usage (a Chinese open-source library), Chinese-language code comments, and an 11-language interface including three Chinese variants. As of the research window (March through May 2026), GHOST STADIUM had registered more than 4,300 FIFA-impersonating domains since August 2025, with over 300 active phishing domains and approximately 3,800 additional domains parked and pre-positioned for activation. The kit reproduces fifa.com with near-perfect visual accuracy, including a cloned PingIdentity single sign-on flow using spoofed client_id 35072598-fc20-4142-a469-1b940db47e6f. Cryptocurrency enters the scheme at the payment layer: phishing sites offer an Alchemy Pay on-ramp that converts approximately $195 USD card payments into approximately 185 USDT, settled to Binance Smart Chain (BSC) via a gateway identified as ChainUGO (testnet.chainugo.com). This makes fund recovery effectively impossible once a transaction clears. Three shared Meta Pixel IDs (927432823410218, 1842358649811605, 1569148414168343) and a single Tawk.to Property ID link hundreds of GHOST STADIUM domains to the same advertising infrastructure. Fourteen shared hosting IP addresses were identified. Group-IB estimates that premium and hospitality ticket fraud across 79 GHOST STADIUM sites could account for 47,400 or more victims and financial losses between $71 million and $474 million USD, with total campaign losses potentially reaching into the billions.","heading":"GHOST STADIUM Phishing and Crypto Payment Infrastructure","severity":"critical","sources":[{"credibility":2,"name":"Group-IB: The GHOST STADIUM Score — Billions At Stake At The World's Largest Football Tournament","type":"research","url":"https://www.group-ib.com/blog/ghost-stadium-football-fraud/"},{"credibility":2,"name":"Infosecurity Magazine: Thousands of Fake FIFA Domains Target World Cup Fans","type":"news_article","url":"https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/"},{"credibility":2,"name":"Cybersecurity News: GHOST STADIUM Phishing Campaign Targets FIFA World Cup Fans With 300+ Fake Domains","type":"news_article","url":"https://cybersecuritynews.com/ghost-stadium-phishing-campaign-targets-fifa-world-cup-fans/amp/"},{"credibility":2,"name":"BankInfoSecurity: Chinese Phishing Service Scams Thousands of FIFA World Cup Fans","type":"news_article","url":"https://www.bankinfosecurity.com/chinese-phishing-service-scams-thousands-fifa-world-cup-fans-a-31819"}]},{"content":"Malwarebytes threat intelligence researchers documented multiple fake tokens specifically using FIFA World Cup 2026 branding. One site marketed its token as 'the official community token celebrating the FIFA World Cup 2026' and advertised a 'Mega Airdrop,' citing a 7-billion-token total supply and a participant counter fixed at 48 (matching the number of qualified national teams, a detail intended to suggest authenticity). A second site displayed FIFA's official tournament mascot to sell an unlicensed token without any FIFA affiliation. A third token, visible on DEX Screener and pump.fun under the ticker FWC26 ('FIFA World Cup 2026 Coin'), exists on Solana and was launched via pump.fun; it carries no FIFA authorization. A pump.fun listing under the name 'FIFA World Cup 2026' with address 8SZYQSc5cwnkKLzLN8rJjNYmoqgJw8oBvWXs4mpzpump is separately listed. A token called OFDR ('Official FIFA Defense Reserve') also appeared on Solana markets, using mock-bureaucratic language to mimic an institutional body; according to analysis by Bitrue, its own website states it is a fictional institutional concept for demonstration purposes only, and there is no verified evidence of FIFA affiliation. Malwarebytes specifically warns that anyone who connects a wallet to these airdrop sites risks unauthorized transaction approval and full wallet drainage, not just loss of tokens purchased. No contract addresses for the unnamed fake-airdrop sites documented by Malwarebytes have been publicly disclosed in verifiable sources, and this report does not assert addresses beyond those confirmed via DEX Screener and pump.fun listings.","heading":"Fake Airdrop Tokens and Impersonation Tokens","severity":"critical","sources":[{"credibility":2,"name":"Malwarebytes: The 2026 World Cup scam economy is already running before the first whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"credibility":2,"name":"DEX Screener: FWC26 / SOL on Solana / Pump.fun","type":"on_chain","url":"https://dexscreener.com/solana/3vcjvdljkvuy8aenl8lgksio52tzteg7w8d68rijpump"},{"credibility":2,"name":"pump.fun: FIFA World Cup 2026 (8SZYQSc5cwnkKLzLN8rJjNYmoqgJw8oBvWXs4mpzpump)","type":"on_chain","url":"https://pump.fun/coin/8SZYQSc5cwnkKLzLN8rJjNYmoqgJw8oBvWXs4mpzpump"},{"credibility":2,"name":"Bitrue: Is OFDR Legit or Scam? What to Know About Official FIFA Defense Reserve Token","type":"research","url":"https://www.bitrue.com/blog/ofdr-token-legit-or-scam-fifa-defense-reserve"},{"credibility":2,"name":"crypto.news: FIFA faces wave of crypto scams targeting World Cup fans","type":"news_article","url":"https://crypto.news/fifa-faces-wave-of-crypto-scams-targeting-world-cup-fans/"}]},{"content":"Beyond token scams and the GHOST STADIUM phishing kit, security researchers at SecureWorld documented a broader ecosystem of FIFA World Cup 2026 fraud including: more than 13,000 FIFA-themed domains registered between January and May 2026, of which approximately 1,145 (8.8%) were classified as malicious or suspicious; more than 1,700 suspected FIFA impersonation accounts across social media platforms, with Facebook and Instagram accounting for approximately 90% of cases; credential harvesting targeting over 270,000 fans who visited FIFA-related sites; compromise of more than 260 FIFA employee credentials; and a Trojanized version of the 1xBet betting application reported to carry ransomware-like behavior. A shared Google Analytics tracking ID (G-123NZLZV56) embedded across multiple job-scam sites suggests further organized threat actor coordination beyond GHOST STADIUM. Campaigns are distributed via Google Search sponsored results, Facebook and Instagram ads, Telegram channels, and WhatsApp messages. These distribution channels frequently intersect with the crypto token scam layer, where social media ads drive traffic to both fake airdrop sites and phishing ticketing pages.","heading":"Broader Fraudulent Infrastructure","severity":"high","sources":[{"credibility":2,"name":"SecureWorld: FIFA World Cup 2026 Is a Cybercriminal's Dream Scenario","type":"research","url":"https://www.secureworld.io/industry-news/fifa-world-cup-2026-cybercrime"},{"credibility":2,"name":"Rescana: Active Exploitation Alert — FIFA World Cup 2026 Targeted by Fake Ticket Sites, Banking Malware, and Credential Theft","type":"research","url":"https://www.rescana.com/post/active-exploitation-alert-fifa-world-cup-2026-targeted-by-fake-ticket-sites-banking-malware-and-credential-theft"},{"credibility":2,"name":"TechRadar: Fake FIFA ticket websites are exploding ahead of the 2026 World Cup","type":"news_article","url":"https://www.techradar.com/pro/this-enormous-demand-has-made-the-football-tournament-a-magnet-for-fraud-experts-warn-scammers-are-ramping-up-their-work-ahead-of-the-fifa-world-cup-2026-heres-how-to-avoid-being-hit"}]},{"content":"The scam vectors documented by researchers converge on a common harm mechanism: inducing victims to take an irreversible financial action before they can verify legitimacy. For fake-airdrop token sites, the harm path typically involves prompting users to connect a Web3 wallet and sign a transaction approving token spend, which in malicious implementations grants the operator unlimited access to drain the wallet. For phishing ticketing sites in the GHOST STADIUM campaign, crypto payment is offered as a checkout option; Group-IB confirmed that funds routed through the Alchemy Pay on-ramp settle in USDT on Binance Smart Chain and are irrecoverable once confirmed. Law enforcement agencies uniformly note that FIFA's official ticketing system does not accept cryptocurrency as payment, making any FIFA ticketing site offering crypto checkout a reliable indicator of fraud. Malwarebytes identifies three risk outcomes for users who interact with unauthorized token sites: losing money outright, receiving worthless or illiquid tokens, or unintentionally granting scammers access to connected wallets.","heading":"Mechanics of Harm: Wallet Drainage and Irreversible Payments","severity":"critical","sources":[{"credibility":2,"name":"Group-IB: The GHOST STADIUM Score","type":"research","url":"https://www.group-ib.com/blog/ghost-stadium-football-fraud/"},{"credibility":2,"name":"Malwarebytes: The 2026 World Cup scam economy is already running before the first whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"credibility":1,"name":"FBI IC3 PSA I-052726-PSA","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"}]},{"content":"For context and disambiguation, FIFA's only officially sanctioned blockchain assets as of June 2026 are: (1) FIFA Collect, an NFT digital-collectibles marketplace that migrated to FIFA's own EVM-compatible blockchain (the FIFA Blockchain) starting May 20, 2025, accessible at collect.fifa.com; and (2) FIFA Rivals, a blockchain mobile game developed with Mythical Games operating on the Mythos blockchain, launched in 2025. Neither product involves a circulating fungible utility or meme token. FIFA president Gianni Infantino reportedly discussed the concept of a FIFA Coin at a February 2026 event, but no such product has been launched or officially announced as of the date of this report. Any token using the FIFA name or World Cup 2026 branding outside of these official products should be treated as unauthorized.","heading":"Legitimate FIFA Blockchain Presence","severity":"low","sources":[{"credibility":1,"name":"FIFA Collect: Welcome to the FIFA Blockchain","type":"official","url":"https://collect.fifa.com/pages/fifa-blockchain"},{"credibility":1,"name":"FIFA official: FIFA Collect migrates to new FIFA Blockchain","type":"official","url":"https://www.fifa.com/en/tournaments/mens/worldcup/canadamexicousa2026/articles/fifa-collect-migrates-to-new-fifa-blockchain"},{"credibility":2,"name":"CoinTelegraph: Why FIFA is Building Its Own Blockchain","type":"news_article","url":"https://cointelegraph.com/explained/why-fifa-is-building-its-own-blockchain-and-what-it-means-for-5-billion-fans"}]}],"sources_used":[{"credibility":1,"name":"FBI IC3 PSA I-052726-PSA: Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"Malwarebytes: The 2026 World Cup scam economy is already running before the first whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"credibility":2,"name":"Group-IB: The GHOST STADIUM Score: Billions At Stake At The World's Largest Football Tournament","type":"research","url":"https://www.group-ib.com/blog/ghost-stadium-football-fraud/"},{"credibility":2,"name":"Decrypt: World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement"},{"credibility":2,"name":"crypto.news: FIFA faces wave of crypto scams targeting World Cup fans","type":"news_article","url":"https://crypto.news/fifa-faces-wave-of-crypto-scams-targeting-world-cup-fans/"},{"credibility":2,"name":"Crypto Times: World Cup 2026 — LASD Issues Warning Over FIFA Crypto Scams","type":"news_article","url":"https://www.cryptotimes.io/2026/06/04/world-cup-2026-lasd-issues-warning-over-fifa-crypto-scams/"},{"credibility":2,"name":"BleepingComputer: FBI warns of fake FIFA websites running World Cup fraud schemes","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/fbi-warns-of-fake-fifa-websites-running-world-cup-fraud-schemes/"},{"credibility":2,"name":"Infosecurity Magazine: Thousands of Fake FIFA Domains Target World Cup Fans","type":"news_article","url":"https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/"},{"credibility":2,"name":"BankInfoSecurity: Chinese Phishing Service Scams Thousands of FIFA World Cup Fans","type":"news_article","url":"https://www.bankinfosecurity.com/chinese-phishing-service-scams-thousands-fifa-world-cup-fans-a-31819"},{"credibility":2,"name":"SecureWorld: FIFA World Cup 2026 Is a Cybercriminal's Dream Scenario","type":"research","url":"https://www.secureworld.io/industry-news/fifa-world-cup-2026-cybercrime"},{"credibility":2,"name":"Rescana: Active Exploitation Alert — FIFA World Cup 2026 Targeted by Fake Ticket Sites, Banking Malware, and Credential Theft","type":"research","url":"https://www.rescana.com/post/active-exploitation-alert-fifa-world-cup-2026-targeted-by-fake-ticket-sites-banking-malware-and-credential-theft"},{"credibility":2,"name":"Bitrue: Is OFDR Legit or Scam? What to Know About Official FIFA Defense Reserve Token","type":"research","url":"https://www.bitrue.com/blog/ofdr-token-legit-or-scam-fifa-defense-reserve"},{"credibility":2,"name":"DEX Screener: FWC26 / SOL on Solana / Pump.fun","type":"on_chain","url":"https://dexscreener.com/solana/3vcjvdljkvuy8aenl8lgksio52tzteg7w8d68rijpump"},{"credibility":2,"name":"pump.fun: FIFA World Cup 2026 (8SZYQSc5cwnkKLzLN8rJjNYmoqgJw8oBvWXs4mpzpump)","type":"on_chain","url":"https://pump.fun/coin/8SZYQSc5cwnkKLzLN8rJjNYmoqgJw8oBvWXs4mpzpump"},{"credibility":1,"name":"FIFA Collect: Welcome to the FIFA Blockchain","type":"official","url":"https://collect.fifa.com/pages/fifa-blockchain"},{"credibility":1,"name":"FIFA official: FIFA Collect migrates to new FIFA Blockchain","type":"official","url":"https://www.fifa.com/en/tournaments/mens/worldcup/canadamexicousa2026/articles/fifa-collect-migrates-to-new-fifa-blockchain"},{"credibility":2,"name":"TechRadar: Fake FIFA ticket websites are exploding ahead of the 2026 World Cup","type":"news_article","url":"https://www.techradar.com/pro/this-enormous-demand-has-made-the-football-tournament-a-magnet-for-fraud-experts-warn-scammers-are-ramping-up-their-work-ahead-of-the-fifa-world-cup-2026-heres-how-to-avoid-being-hit"},{"credibility":2,"name":"Fox 11 Los Angeles: LA Sheriff warns of scams ahead of World Cup kickoff","type":"news_article","url":"https://www.foxla.com/news/la-sheriff-world-cup-scam-warning"},{"credibility":2,"name":"The Next Web: FIFA World Cup 2026 scams are live — fake sites and malware","type":"news_article","url":"https://thenextweb.com/news/fifa-world-cup-2026-scams-phishing-malware"},{"credibility":2,"name":"Cybersecurity News: GHOST STADIUM Phishing Campaign Targets FIFA World Cup Fans With 300+ Fake Domains","type":"news_article","url":"https://cybersecuritynews.com/ghost-stadium-phishing-campaign-targets-fifa-world-cup-fans/amp/"}],"summary":"A broad category of unauthorized cryptocurrency tokens, fake airdrop campaigns, and wallet-draining sites have emerged exploiting FIFA World Cup 2026 branding ahead of the tournament, which runs June 11 through July 19, 2026. None of these tokens or projects hold any official affiliation with FIFA. Law enforcement agencies including the FBI Internet Crime Complaint Center and the Los Angeles County Sheriff's Department have issued public warnings, while cybersecurity firm Group-IB has attributed a coordinated phishing and payment-theft campaign to a Chinese-speaking threat actor called GHOST STADIUM, estimating potential financial losses in the range of $71 million to $474 million for premium-ticket fraud alone.","timeline":[{"date":"2025-08-01","event":"GHOST STADIUM campaign begins registering FIFA-impersonating domains, with over 4,300 ultimately registered by the time of Group-IB's analysis window.","source":"Group-IB blog","source_url":"https://www.group-ib.com/blog/ghost-stadium-football-fraud/"},{"date":"2025-05-20","event":"FIFA Collect officially migrates to the FIFA Blockchain (EVM-compatible), establishing the only sanctioned FIFA NFT marketplace.","source":"FIFA official website","source_url":"https://www.fifa.com/en/tournaments/mens/worldcup/canadamexicousa2026/articles/fifa-collect-migrates-to-new-fifa-blockchain"},{"date":"2026-02-01","event":"FIFA president Gianni Infantino reportedly discusses concept of a FIFA Coin at a World Liberty Forum event at Mar-a-Lago; no product is launched.","source":"crypto.news","source_url":"https://crypto.news/fifa-faces-wave-of-crypto-scams-targeting-world-cup-fans/"},{"date":"2026-05-01","event":"Malwarebytes publishes threat intelligence report documenting multiple fake FIFA World Cup 2026 tokens, including a site claiming to be 'the official community token' with a 7-billion-token Mega Airdrop, and another using the official mascot to sell an unlicensed token.","source":"Malwarebytes threat intelligence blog","source_url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"date":"2026-05-27","event":"FBI Internet Crime Complaint Center issues PSA I-052726-PSA warning the public about cyber threat actors spoofing FIFA websites using typosquatting, listing over 31 fraudulent domains and identifying cryptocurrency payment requests as a key fraud indicator.","source":"FBI IC3","source_url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"date":"2026-06-03","event":"Los Angeles County Sheriff's Department issues public warning about FIFA World Cup 2026 scams, specifically flagging cryptocurrency payment requests for tickets, merchandise, and streaming as indicators of fraud.","source":"Crypto Times / MyNewsLA","source_url":"https://www.cryptotimes.io/2026/06/04/world-cup-2026-lasd-issues-warning-over-fifa-crypto-scams/"},{"date":"2026-06-04","event":"Group-IB publishes detailed GHOST STADIUM research documenting 300+ active phishing domains, the BSC/USDT crypto payment on-ramp, and estimated losses of $71 million to $474 million for premium ticket fraud alone.","source":"Group-IB blog","source_url":"https://www.group-ib.com/blog/ghost-stadium-football-fraud/"},{"date":"2026-06-11","event":"FIFA World Cup 2026 tournament begins, with the United States, Canada, and Mexico as host nations, creating the peak-risk window for all scam categories.","source":"Decrypt","source_url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement"}]},"v":1}