How to spot a fake crypto exchange before you send
NoxSwap Team
The most common way people lose crypto on a swap is not a hack. It is a copy: a site that looks exactly like a real exchange, often found through a search ad or a link in a chat, with one difference that matters, the deposit address belongs to the scammer. Once coins are sent there, nobody can pull them back. The good news is that a few checks take less than a minute and stop almost every scam of this kind. Here is what to look for, and how a PGP signature lets you prove that an exchange is really who it claims to be.
How the fake exchange scam works
Scammers copy the design, texts and even the order flow of a real exchange, then put it on a domain that looks almost right: an extra letter, a different ending such as .co instead of .io, or a hyphen in the middle. They buy search ads for the brand name, post the link in Telegram groups and forums, or reply to people asking for help with a swap.
Everything on the fake site appears to work. You choose a pair, enter your address, get a quote and a deposit address. The only thing that has changed is that address. Some clones even show a convincing progress screen afterwards, so the victim waits for hours before realising nothing will arrive.
The same trick exists on Tor. Anyone can generate an onion address that starts with the same letters as a real one, so a fake mirror can look legitimate at a glance.
Warning signs you can check in seconds
Look at the full address in the browser bar, not just the logo. Type the domain yourself or use a bookmark instead of clicking links from ads, chats or emails. If you reached the site through a sponsored search result, close it and go to the address you know.
Be suspicious of anything that contacts you first. A real exchange's support does not open a conversation in your DMs, never asks for your seed phrase or private keys, and never asks you to send a test payment to a personal wallet. Rates far better than every competitor are another red flag: a quote that beats the market by 10% is bait, not a deal.
Check where the support channels lead. If the only way to reach the service is a Telegram account with no link from the official site, treat it as unverified.
What a PGP signature proves
PGP is a decades-old standard for signing messages. A service keeps a private key secret and publishes the matching public key. Anything signed with the private key can be checked by anyone holding the public key, and the check fails if a single character of the signed text has been changed.
A clone can copy a website pixel for pixel, but it cannot produce a valid signature without the private key. That is why serious privacy services sign the things that matter: their official addresses, and the details of each order.
How NoxSwap uses signed letters of guarantee
Every NoxSwap order comes with a letter of guarantee signed with our PGP key. It records the order ID, what you send and to which deposit address, what you receive and at which payout address, and the deposit deadline. You find it on your order page right under the order ID, with buttons to copy, download and verify it.
Before you pay, verify the letter and compare the deposit address in it with the one you are about to send to. They must match. If a site cannot show you a letter, or the signature is invalid, do not send anything.
Our list of official addresses, the website and the Tor mirror, is signed with the same key and published on our PGP verification page as mirrors.txt.
Three ways to verify a signature
The quickest is the verifier on our PGP page: paste the whole letter and the check runs in your browser, without sending the text anywhere. The order page's Verify button opens it with your letter already filled in.
If you prefer not to rely on our own site, BitList, an independent directory of privacy services, publishes our public key on its own page and verifies NoxSwap letters in one click.
For a fully offline check, use GnuPG: import the key from noxswap.io/pgp.txt, save the letter as a text file and run gpg --verify on it. Whatever tool you use, compare the key fingerprint with the one published on BitList and on our site. If they ever differ, don't trust the key.
If you think you found a fake
Do not send anything and do not enter wallet credentials. Note the address of the site and where you found the link, then report it to us at info@noxswap.io so we can warn other users and ask the host or registrar to take it down.
If you already sent funds to a fake address, the transaction cannot be reversed by any exchange, including the real one. Report it to the platform where you found the link and to the police in your country; a blockchain transaction record helps the report.