Monero scams and phishing: how to protect your XMR

The golden rule

Your seed (25 words, or 16 for Polyseed) is your money. Anyone who sees it can empty your wallet, and Monero transactions cannot be reversed. Type it only into wallet software you installed from the official source, on your own device, when restoring a wallet. Never into a website, a form, a chat or a "support" agent.

Real Monero scams, 2019 to 2026

Domain names are written with [.] so they cannot be clicked. Do not visit them.

A note on XMRWallet.com

XMRWallet.com is still online. In February and March 2026 the anti-phishing group PhishDestroy published allegations that it sends users' view keys to its server and hijacks transactions. We found no independent audit and no public rebuttal from the operator, and the allegations are unproven. Its Trustpilot rating was 2.2 out of 5, with 2026 reviews reporting lost funds. We do not recommend it. Details: XMRWallet review.

Common scam types

Fake web wallets

People search "monero web wallet" or "MyMonero login", click the first result or ad, and paste their seed into a copy. The real MyMonero closed on 6 January 2026; any site still offering a MyMonero login is fake. See Monero web wallet and MyMonero for how to recover your funds safely.

Fake apps and malware downloads

Copycat apps in app stores, and cloned download pages with malware. Check the publisher name, download only via links from getmonero.org's downloads page, and verify the file hash and signature for desktop wallets.

Fake "update" or "upgrade" messages

Monero does not announce updates by email. The coming FCMP++ upgrade will need new wallet software, but no coin migration and no seed. Expect scammers to exploit it, and the EU's 10 July 2027 deadline too.

Fake support and recovery services

Accounts on social media or chat apps that offer to "help" with a stuck transaction or to recover stolen coins. They want your seed or an upfront fee. Real recovery of stolen Monero is not something a stranger can do for a fee.

P2P and swap scams

Buyers who send reversible bank or card payments and then charge them back, fake escrow sites, and swap sites that never deliver. Prefer trading platforms with escrow and reputation, such as the Haveno-based markets compared in Haveno vs RetoSwap vs Bisq, and start with small amounts. See buying Monero without KYC.

"Doubling", mining and investment schemes

Promises to multiply your XMR, cloud-mining contracts with guaranteed returns, and giveaways that require you to send coins first. All of them are scams.

Address-swapping malware

Malware that replaces a copied address with the attacker's. Check the first and last characters of the address after pasting, and send a small test amount for big payments. Our address validator checks that an address is valid Monero, though it cannot tell you whose it is.

Safety checklist

1. Type getmonero.org or the wallet's own domain yourself, or use a bookmark. Do not click ads or search results for wallet sites.
2. Use well-known wallets that scan on your device: Cake Wallet, Feather, Monerujo, Stack Wallet or the official GUI.
3. Verify desktop downloads with the published SHA256 hash and signature.
4. Write your seed on paper. No photos, no cloud notes, no password managers you have not thought through.
5. For larger amounts, use a hardware wallet.
6. Be suspicious of urgency, unexpected messages and anyone who contacts you first.
7. Run through the privacy checklist for safer settings.

If you think you have been scammed

1. Move any remaining funds now to a brand-new wallet with a new seed, created on a clean device. Assume the old seed is compromised.
2. Scan or reset the device if you installed anything suspicious.
3. Report it to your national police or cybercrime unit, and to the platform that hosted the fake site or app.
4. Keep evidence: URLs, screenshots, transaction IDs and dates.
5. Ignore recovery offers. People who contact victims promising to get coins back are almost always running a second scam.

Frequently asked questions