World Cup 2026 Crypto Scam Network

2019-01-01

Domain fifa.city, later identified as part of the fraudulent infrastructure, begins operating. Exact origin date approximate.

2025-08-01

Registration of fraudulent FIFA-branded domains begins at scale. The GHOST STADIUM threat actor cluster, attributed to a Chinese-speaking financially motivated group, is later traced to activity starting this period. Over 4,300 domains are ultimately registered.

2025-11-01

CybelAngel first observes the Ghost Stadium threat actor cluster operating ticketing-fraud domains mimicking the official FIFA 2026 website.

2026-01-01

Fixed-match betting scheme begins receiving small Bitcoin payments from alleged victims. Activity documented across multiple days from January through May 2026.

2026-01-01

FortiGuard Labs begins tracking World Cup-themed domain registrations. Between January and May 2026, approximately 13,000 such domains are registered, of which 8.8% are assessed as malicious or suspicious.

2026-03-01

78 new ticketing-fraud domains are registered in March 2026 alone, attributed to the Ghost Stadium cluster.

2026-04-01

Polygon-based fake ticketing address receives approximately $1,562 in a single transaction — the first confirmed crypto loss tied to a directly identified World Cup ticketing scam address.

2026-04-01

Since April 1, 2026, researchers detect more than 1,100 suspicious domains containing the words 'World' and 'Cup' and over 600 typosquat domains mimicking fifa.com.

2026-04-29

30 fraudulent FIFA-branded domains registered on a single day, attributed to the Ghost Stadium cluster.

2026-05-01

Malwarebytes publishes threat intelligence report titled 'The 2026 World Cup scam economy is already running before the first whistle,' documenting fake crypto token sites, airdrop scams, and a four-part scam economy forming around the tournament.

2026-05-01

Promotional betting channels linked to the fraudulent 2026.com platform become active.

2026-05-27

FBI Internet Crime Complaint Center issues PSA Alert I-052726-PSA warning of threat actors spoofing FIFA websites, listing more than 30 verified fraudulent domains including fiffa.com, jobs-fifa.com, and fifa-ticket.live.

2026-06-03

Los Angeles County Sheriff's Department issues public advisory warning residents that cryptocurrency payment requests are a primary fraud indicator in World Cup-related scams.

2026-06-09

CybelAngel publishes fraud threat report identifying 468 indicators of compromise across four threat vectors, with 125 Ghost Stadium ticketing domains confirmed live.

2026-06-10

World Cup PvP token (WCUP) launches. Bubblemaps alleges that more than 30 pre-funded insider wallets acquire 95% of the supply within one minute of launch. Token reaches $50 million market cap within 24 hours following influencer promotion on X.

2026-06-11

TRM Labs publishes formal report identifying four active crypto scam addresses connected to three live operations targeting World Cup fans, with total confirmed receipts under $1,700 across directly identified addresses.