MalwareBytes

How World Cup crypto prediction sites take your money


Crypto prediction and betting sites are appearing around the World Cup, and researchers have already tracked scams aimed at fans, including fake ticketing, fixed-match betting, prediction scams, and fan-branded meme coins.

We investigated one prediction site ourselves. While we aren’t claiming every site works the same way, it matched several well-known scam patterns. Whether it’s a worthless token, a fake betting platform, or a disappearing website, the result is often the same: you lose money.

What you need to know

  • This isn’t a single scam. Different sites use different tactics, but many follow the same playbooks.
  • Even if a site pays out exactly what it promises, you could receive a token that’s difficult or impossible to sell.
  • Some sites simply keep your deposit and stop responding.
  • Crypto transactions generally can’t be reversed. Once you’ve sent the money, recovering it may be impossible.
A World Cup-themed crypto prediction site

How you lose money

The last three examples below are based on a token we investigated directly. The first two are common scam patterns seen across this category.

  • Pump-and-dump: A token is promoted through the game, early participants receive genuine payouts that build trust, then the creators sell their holdings and the price collapses. Later buyers are left with a token few people want.
  • Take the money and vanish: You deposit crypto to unlock betting or enter the game. The site keeps the money and disappears.
  • Fake free-to-play: The game is advertised as free, but you have to buy or hold a token before you can participate. The game attracts users; the token sale generates revenue.
  • Copycat naming: A new token uses a name similar to an established cryptocurrency, making it easier for people to mistake it for a legitimate project.
  • Manufactured activity: The same tokens move repeatedly through a central wallet, creating the appearance of trading activity. On charts, it can look like an active market when little genuine trading is taking place.

Traditional crypto advice doesn’t help much here

You’ve probably heard advice like “never share your seed phrase.” That’s still important, but it isn’t what’s happening here.

These sites don’t need access to your wallet or seed phrase. They persuade you to send money voluntarily. Once you’ve done that, there may be nothing to recover.

How to check a token

  • Look at how many people actually hold the token. A token with very few holders, despite lots of apparent trading, deserves extra scrutiny.
Just four holders, which is a major red flag for a supposedly active token
Just four holders, which is a major red flag for a supposedly active token
  • Check the transfer history, not just the trading volume. On one token we examined, identical amounts repeatedly moved into and back out of the same central wallet. We confirmed this pattern across more than a dozen addresses. Genuine market activity rarely produces repeated matching round trips like this.
Repeated transfers create the appearance of trading
Repeated transfers create the appearance of trading
  • Search the token name alongside “price.” If a similarly named cryptocurrency already exists, you may be looking at a copycat.
A copycat token on Pump.fun
A copycat token on Pump.fun
  • Before sending money, ask yourself what happens if you never see it again. If you aren’t comfortable with that answer, don’t send it.

If you’ve already sent money

  • Don’t send more to unlock a refund or payout. That’s often part of the scam.
  • Assume the money may be gone. Waiting for the site to make things right rarely works.
  • Disconnect unfamiliar apps, then revoke any spending permissions you granted. Disconnecting a wallet from a site doesn’t necessarily revoke any spending approvals you’ve already granted. Check your wallet’s support pages for instructions on reviewing and revoking those permissions.
  • Report the scam to help protect others:
    • Report the website to your country’s cybercrime reporting service or consumer protection agency.
    • Report the wallet address if the wallet or exchange you use provides an abuse reporting option.
    • If you found the site through social media or a search engine, report the post or advert so it can be reviewed.

Whether the site pays you in a token that quickly becomes worthless or simply disappears with your deposit, the outcome can be much the same.

If a crypto prediction game asks you to buy or hold a token before you can play, stop and ask why. The game may be there to encourage token sales rather than reward successful predictions.


Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →



Source link