World Cup 2026 Crypto Scam Network
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3526x9…WFwvSummary
The 2026 FIFA World Cup has attracted a coordinated wave of crypto-linked fraud operating across multiple typologies, including typosquatting domain networks, fake ticket portals demanding cryptocurrency payment, fixed-match betting schemes, pump-and-dump fan meme coins, and Android banking malware bundled in fake streaming apps. Law enforcement agencies including the FBI Cyber Division and the Los Angeles County Sheriff's Department have issued public warnings, while blockchain analytics firm TRM Labs and cybersecurity vendors Malwarebytes, CybelAngel, and The Hacker News have documented active infrastructure running since at least August 2025, months before the first match.
Connected Entities
1 entities- + 3 more
Timeline(16 events)
2019
Domain fifa.city, later identified as part of the fraudulent infrastructure, begins operating. Exact origin date approximate.
CybelAngel FIFA World Cup 2026 Fraud Threat ReportAugust 2025
Registration of fraudulent FIFA-branded domains begins at scale. The GHOST STADIUM threat actor cluster, attributed to a Chinese-speaking financially motivated group, is later traced to activity starting this period. Over 4,300 domains are ultimately registered.
The Hacker News — FIFA World Cup 2026 Scams Are Already LiveNovember 2025
CybelAngel first observes the Ghost Stadium threat actor cluster operating ticketing-fraud domains mimicking the official FIFA 2026 website.
CybelAngel FIFA World Cup 2026 Fraud Threat Report2026
Fixed-match betting scheme begins receiving small Bitcoin payments from alleged victims. Activity documented across multiple days from January through May 2026.
TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World Cup2026
FortiGuard Labs begins tracking World Cup-themed domain registrations. Between January and May 2026, approximately 13,000 such domains are registered, of which 8.8% are assessed as malicious or suspicious.
The Hacker News — FIFA World Cup 2026 Scams Are Already LiveMarch 2026
78 new ticketing-fraud domains are registered in March 2026 alone, attributed to the Ghost Stadium cluster.
CybelAngel FIFA World Cup 2026 Fraud Threat ReportApril 2026
Polygon-based fake ticketing address receives approximately $1,562 in a single transaction — the first confirmed crypto loss tied to a directly identified World Cup ticketing scam address.
TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World CupApril 2026
Since April 1, 2026, researchers detect more than 1,100 suspicious domains containing the words 'World' and 'Cup' and over 600 typosquat domains mimicking fifa.com.
BitDefender — FBI Warns Fans About FIFA Scams Ahead of 2026 World Cup29 April 2026
30 fraudulent FIFA-branded domains registered on a single day, attributed to the Ghost Stadium cluster.
CybelAngel FIFA World Cup 2026 Fraud Threat ReportMay 2026
Malwarebytes publishes threat intelligence report titled 'The 2026 World Cup scam economy is already running before the first whistle,' documenting fake crypto token sites, airdrop scams, and a four-part scam economy forming around the tournament.
Malwarebytes — The 2026 World Cup scam economy is already running before the first whistleMay 2026
Promotional betting channels linked to the fraudulent 2026.com platform become active.
CybelAngel FIFA World Cup 2026 Fraud Threat Report27 May 2026
FBI Internet Crime Complaint Center issues PSA Alert I-052726-PSA warning of threat actors spoofing FIFA websites, listing more than 30 verified fraudulent domains including fiffa.com, jobs-fifa.com, and fifa-ticket.live.
FBI IC3 PSA2605273 June 2026
Los Angeles County Sheriff's Department issues public advisory warning residents that cryptocurrency payment requests are a primary fraud indicator in World Cup-related scams.
CryptoTimes — World Cup 2026: LASD Issues Warning Over FIFA Crypto Scams9 June 2026
CybelAngel publishes fraud threat report identifying 468 indicators of compromise across four threat vectors, with 125 Ghost Stadium ticketing domains confirmed live.
CybelAngel FIFA World Cup 2026 Fraud Threat Report10 June 2026
World Cup PvP token (WCUP) launches. Bubblemaps alleges that more than 30 pre-funded insider wallets acquire 95% of the supply within one minute of launch. Token reaches $50 million market cap within 24 hours following influencer promotion on X.
CryptoNews.net — 95% of World Cup Token WCUP Supply Pre-Purchased by Single Group, Bubblemaps Alleges11 June 2026
TRM Labs publishes formal report identifying four active crypto scam addresses connected to three live operations targeting World Cup fans, with total confirmed receipts under $1,700 across directly identified addresses.
TRM Labs — Tracking Crypto Scammers Ahead of the 2026 World CupDecision Log
- hash: 6UExSkMb3fuJkF4RLgz9j6WUNW8sjfXk1DQYxwy5dYAk
This investigation is cryptographically anchored to the Solana blockchain (1 event). 15 of 15 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/15/2026, 5:32:37 PM
last updated: 7/26/2026, 8:09:22 PM
3 viewsavoid.net — verified advice for a post-truth world