SecuritySnack finds 250 domains linked to crypto scam laundering

SecuritySnack - Idolized Crypto Scams, published on 25 February 2026, documents a cryptocurrency scam operation active since at least January 2025 that spans roughly 250 identified domains across multiple themes. The investigation identifies two thematic campaigns linked by a shared Ethereum wallet address and registration pattern, with the first a broad network of fake giveaway sites impersonating idolised figures and the second more technically sophisticated fake token presale sites such as megaeth[.]bid.

The on‑chain analysis suggests a single actor controls both campaigns, moving funds through a multi‑layer laundering pipeline ending at high‑volume mixers or OTC services, while the central funder address appears to feed operated wallets rather than victims’ deposits. Two confirmed victim transactions on megaeth[.]bid total 0.1521825 ETH (about $300), with the rest of the activity concentrating on self‑funding and ledger churn rather than real-money deposits.

The report notes hundreds of domains, shared infrastructure such as streetplug[.]me, and an infrastructure capable of much larger volume, implying sustained, repeatable operation beyond the observed $300 impact.