Google Coin / Fake Gemini AI Chatbot Presale Operation
Summary
A fraudulent cryptocurrency presale operation, discovered by Malwarebytes on February 18, 2026, that deployed a custom AI chatbot impersonating Google's Gemini assistant to sell a non-existent token called 'Google Coin.' The site mimicked Google's visual identity, displayed fabricated endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX, and promised investors 7x returns through irreversible cryptocurrency payments. Google (Alphabet Inc.) has never issued a cryptocurrency; this operation was entirely fabricated and constitutes an AI-automated impersonation fraud with no legitimate entity behind it.
Connected Entities
2 entities · 10 linked investigations- 98388xymWKS6EgYSC9baFuQkCpE8rYsnScV4L5Vu8jt→mentioned with→Google Coin / Fake Gemini AI Chatbot Presale Operation(50%)
Connected Through
1 shared actor · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇98388x…u8jtwallet
Timeline(3 events)
2026-01-14
Chainalysis published its 2026 Crypto Crime Report documenting 1,400% year-over-year growth in impersonation scams and $17 billion in total crypto scam losses for 2025, providing the broader industry context into which the Google Coin operation fits.
CoinDesk / Chainalysis2026-02-18
Malwarebytes researchers discovered and documented the live Google Coin presale site operating a fake Gemini AI chatbot. The site itself claimed this date as its token listing deadline, manufacturing urgency. Six cryptocurrency wallet addresses (Ethereum, Solana, Bitcoin, and others) were identified as payment destinations.
Malwarebytes2026-02-19
Fox News, TechRepublic, Dark Reading, Consumer Affairs, and Security Boulevard published coverage of the Malwarebytes discovery, amplifying the consumer warning. The story received broad mainstream and security-industry coverage.
Fox News / TechRepublic / Dark ReadingDecision Log
- hash: YyqCtQxhdV1YWMYwJpdhDTNATk5Zphqti9b1tNtR6GM
- hash: 5sW9mjtp4s5w8dChw7ceSH7bMjFGSKwtqUE8XNPFGsYt
- hash: 4kKqnPsiG5taEifEsJ4x4zqUQH2C1ey9HotFk7Z4uPmH
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 6/2/2026, 11:06:39 PM
last updated: 6/3/2026, 3:24:06 AM
avoid.net — verified advice for a post-truth world