FIFA World Cup 2026 Crypto Scam Infrastructure
Summary
A coordinated, multi-vector scam infrastructure emerged around the 2026 FIFA World Cup (June 11 – July 19, 2026), targeting fans through fake ticketing domains, insider-heavy memecoins, deepfake impersonation campaigns, fake live-streaming sites, and phishing-as-a-service kits. The FBI, TRM Labs, Malwarebytes, and FortiGuard Labs each issued independent warnings, with FortiGuard identifying over 13,000 FIFA-themed domains registered between January and May 2026, approximately 8.8% of which were classified as malicious or suspicious. Law enforcement flagged 30+ explicitly spoofed FIFA domains by name, while blockchain analytics firms documented a low-liquidity memecoin with alleged 95% insider supply concentration and cross-chain bridge laundering patterns.
Connected Entities
1 entities · 10 linked investigationsTimeline(11 events)
2025-08-01
FortiGuard Labs documents the start of fraudulent FIFA domain registrations, with over 4,300 domains registered from August 2025 onward ahead of the 2026 tournament.
FortiGuard Labs2026-01-01
Fixed-match betting scam begins receiving Bitcoin payments from victims; TRM Labs later identifies the address as part of its World Cup fraud cluster.
TRM Labs2026-01-01
FortiGuard Labs documents a surge in FIFA-themed domain registrations between January and May 2026, with over 13,000 new domains registered and 8.8% classified as malicious or suspicious.
FortiGuard Labs2026-04-01
A Polygon-based fake ticketing address receives approximately $1,562 in a single day, consistent with a short promotional window; TRM Labs later identifies this as part of its World Cup fraud cluster.
TRM Labs2026-05-04
Malwarebytes publishes threat intelligence report documenting a four-part scam economy already operational before the World Cup, including fake token airdrop sites using FIFA branding.
Malwarebytes2026-05-27
FBI Cyber Division issues Public Service Announcement I-052726-PSA through IC3, formally warning fans about over 30 spoofed FIFA domains and typo-squatting campaigns.
FBI IC32026-06-03
Los Angeles County Sheriff's Department issues advisory warning fans about crypto-only payment demands in fake ticket, hospitality, merchandise, and streaming scams.
Decrypt2026-06-10
WCUP (World Cup PvP) token launches; Bubblemaps alleges that over 30 newly created wallets with no prior history acquired 95% of supply within the first minute, with the token reaching a $50 million market cap.
BitcoinWorld / Bubblemaps2026-06-11
FIFA World Cup 2026 tournament begins. TRM Labs publishes its full crypto scam tracking report, documenting four active fraud addresses and five scam typologies.
TRM Labs2026-06-12
Multiple media outlets, including Bitcoin Foundation, CoinCentral, and Cryptopolitan, publish coverage of the coordinated World Cup crypto scam infrastructure based on TRM Labs and FBI findings.
Bitcoin Foundation2026-06-23
Help Net Security reports Malwarebytes has identified over 40 fake World Cup streaming websites using identical templates that deliver ad fraud and crypto scheme redirects instead of match streams.
Help Net SecurityDecision Log
- hash: 7f3jSWm3gprx1qqfwzCctS7bDDr7aK89hf1ZHy4LFfRe
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/27/2026, 5:31:18 PM
last updated: 6/27/2026, 5:31:28 PM
avoid.net — verified advice for a post-truth world