Fake launchpad sites and phishing: how wallets get drained during sales

02 September 2026

The mechanics of a token sale are complex enough without adding deliberate traps. Attackers have refined three specific vectors to drain wallets during launches. Understanding how each works is the first step to avoiding it.

Fake launchpad sites with wallet-draining signatures

This is the most direct attack. A user searches for a launchpad, clicks a sponsored ad or a compromised link, and lands on a site that looks identical to the real platform. The difference is invisible: the site requests a wallet signature that is not a simple login.

When a legitimate launchpad asks you to connect your wallet, it typically requests a "sign message" that proves you own the address. The fake site requests a different signature type. One common variant is the permit or permit2 signature, which grants the attacker approval to spend your tokens. Another is the eth_sign or personal_sign of a raw transaction that transfers assets.

Your wallet will display a warning: "Signing this message could have dangerous consequences" or "This request is asking you to sign a transaction, not a message." Many users ignore that warning. They see a familiar interface and click confirm. Within seconds, the attacker drains the wallet of all tokens the signature allowed.

The attacker does not need your private key. They only need one signed approval. That single signature is enough to move your assets out of your control.

Discord and Twitter compromises

Sales generate urgency. Announcements come from official channels, and attackers exploit that trust.

A project's Discord server gets compromised through a stolen admin token or a social engineering attack on a moderator. The attacker posts a link to a fake contribution site, often pinned as the "official sale link." The same happens on Twitter: a verified account gets hijacked, and a tweet goes out with a malicious URL.

The window for damage is narrow. Real teams usually detect the breach within minutes and issue warnings. But in those minutes, dozens of users connect their wallets and sign the draining payload. The pinned message still looks official even after the account is secured. Users who do not refresh the page see the old, compromised link.

The verification step is simple. Do not click links from announcements. Go to the project's official website manually. Cross-check the URL against what was listed in the launchpad's verified channel before the sale started.

Impersonator token contracts on DEXs

After a sale ends, the token launches on a DEX. Attackers deploy copycat contracts with the same ticker and similar names. They list the fake token at a low price, and unsuspecting buyers see a "cheap" entry. The real token is trading higher, so the fake one looks like a bargain.

The impersonator contract usually has a hidden function: it can blacklist holders, freeze transfers, or mint unlimited supply. Once enough liquidity enters, the attacker calls the hidden function and drains the pool or freezes all holders. The fake token's price goes to zero.

Checking the contract address is mandatory. The real project publishes the correct address on its official website and in its pinned Discord messages. Do not trust contract addresses from DEX search results or third-party aggregators. Cross-reference with at least two official sources.

The infinite approval exploit

Some fake sites do not ask for a signature. They request an "approve" transaction for a specific token, setting a very high allowance. This is the infinite approval attack. The user approves the attacker's contract to spend an unlimited amount of a token, usually USDT, USDC, or the sale token itself.

Once approved, the attacker can drain that token from your wallet at any future time. The initial transaction looks harmless: "Approve [contract] to spend [token]." The amount is set to the maximum uint256 value. Many wallets do not flag this as dangerous because approval transactions are common.

The fix is to check the allowance amount before signing. If it is 2^256 - 1, reject the transaction. Legitimate launchpads only request approval for the exact amount you intend to contribute.

Concrete verification steps

1. Only connect your wallet to the domain listed in the launchpad's official documentation. Bookmark that domain. Do not search for it.

2. Before signing any wallet prompt, read the full message. If it says "Sign" and your wallet displays a red warning, cancel.

3. Check the contract address on the token's official website or the launchpad's verified announcement. Use a block explorer to confirm the deployer is the same address that deployed the sale contract.

4. For sale contributions, verify the contribution address matches the one confirmed by the project across multiple channels (website, Discord, Twitter, and Telegram).

5. Set a daily or per-transaction spending limit on your wallet if your wallet supports it. This limits the damage from a single compromised session.

As of August 31, 2026, no on-chain pair for "flovicommunity" has been found by the queries tried. That absence does not confirm a project exists or does not exist. It means no attacker can yet profit by impersonating it on a DEX. That fact may change tomorrow. The vectors described here will not.

Back to token launches