Top presale phishing patterns observed in Q1 2026

Reports from chain-analytics firms and on-chain forensics suggest Q1 2026 was a volume-record quarter for crypto phishing — driven primarily by the wave of presale TGEs in February-March. Four patterns dominated the loss volume.

1. TGE-day claim site clones (highest volume)

The pattern: a presale announces TGE 24-48 hours in advance. Attackers register lookalike domains (e.g. claim-projectname.app vs the real projectname.app/claim) and run paid Google Ads targeting search terms like “[project] claim”. When users search the morning of TGE, the malicious ad ranks above the legitimate site.

Q1 2026 specifics:

• Lookalike domains used .app, .xyz, .io, and .finance TLDs to evade obvious detection.
• Several attacks used compromised verified Twitter accounts to amplify the malicious links.
• The malicious “claim” transaction was usually a setApprovalForAll on the user’s most valuable holdings, exploited by a separate sweeper transaction within minutes.

Defense: bookmark the real claim URL the day before TGE, from the project’s original domain. Use a fresh dedicated wallet for claims. Read every transaction on the hardware wallet’s screen.

2. Fake “token migration” sites (medium volume)

The pattern: weeks or months after TGE, an attacker claims the project is migrating V1 → V2 and provides a “migration contract” address. The user sends V1 tokens; nothing comes back.

Q1 2026 specifics:

• Several attacks targeted projects that had announced legitimate migrations, riding the legitimate news.
• Attackers spun up fake project Twitter accounts, fake Discord channels, and fake “team member” Telegram profiles.
• A handful of attacks compromised the legitimate project’s Discord webhook to broadcast the malicious migration link inside the official server.

Defense: migrations are announced through multiple official channels with at least 30 days notice. Verify the migration contract address from at least two independent sources. There is no “urgent” migration. If a “team member” DMs you about it, it’s fake.

3. Telegram / Discord “support” DMs (medium volume)

The pattern: user posts a question in the project’s official Discord or Telegram. Within minutes, an attacker DMs them claiming to be “support” or “team” and offers to help — typically by asking the user to “verify” their wallet via WalletConnect or a “diagnostic” page.

Q1 2026 specifics:

• Attackers used display names matching real team member names.
• Some used compromised handles of real team members (typically dormant accounts).
• The “verify wallet” prompt usually triggered a malicious sign request that drained funds.

Defense: official project teams almost never DM first. Treat any DM offering “support” as fake. If you need help, post in the public channel and wait for a verified-pinned-author response.

4. Address-poisoning waves (lower volume, higher per-incident loss)

The pattern: an attacker generates wallet addresses whose first/last characters match addresses you’ve recently transacted with. They send a tiny “dust” transaction from the lookalike address. When you next copy-paste a recipient address from your wallet’s transaction history, you might pick the attacker’s address by accident.

Q1 2026 specifics:

• Address-poisoning campaigns increased by an estimated 200% over Q4 2025 (Chainalysis preliminary data).
• Attacks targeted high-balance wallets identified through on-chain analysis.
• Per-incident losses ranged from $5K to over $400K (the largest single Q1 incident).

Defense: use the address-book or labels feature in your wallet. Don’t copy from transaction history. Verify the full address character by character. For large transfers, send a small test amount first.

What’s working as defense

The wallets that survived Q1 phishing volume share a few patterns:

• Dedicated claim wallets. Users who claimed presale tokens with empty fresh wallets (and transferred to main wallets via explicit transactions) lost claim-wallet gas and nothing more.
• Hardware-wallet transaction reading. Users who read the hardware wallet’s on-device screen rejected the malicious setApprovalForAll calls.
• Bookmark discipline. Users who navigated to TGE claim pages from pre-saved bookmarks (rather than clicking links from emails or X) were not exposed to the lookalike-domain wave.
• Address books. Users with named address-book entries didn’t fall to address-poisoning.

What’s not working

• Browser warnings. Most phishing pages render fine in browsers; warnings come too late.
• Anti-phishing extensions. Useful but trail attacks by hours-to-days.
• Wallet extensions’ built-in checks. They flag known malicious contracts; new ones aren’t flagged.
• “I’ll be careful” intent. TGE morning urgency overrides intent in 100% of incidents we’ve reviewed.

What to expect in Q2 2026

If patterns hold:

• Volume-weighted attacks will shift toward the next wave of presales hitting TGE.
• Migration-fake attacks will increase as Q4 2025 / Q1 2026 projects hit their “V2 token” cycles.
• Address-poisoning will continue scaling — it’s cheap to run and hard to fully defend against.
• Verified-account compromise (X / Discord) will become more sophisticated. Don’t rely on “blue check = legitimate”.

The honest summary

Phishing is the dominant loss mechanism for presale buyers, not bad presales themselves. Q1 2026 patterns reinforce what we’ve been writing: dedicated claim wallets, hardware-wallet transaction reading, bookmark discipline, address books. These four habits prevent the overwhelming majority of incidents.

If your operational discipline isn’t already at this level, fix it before the next presale TGE you participate in.