With blockchain becoming harder to crack, attackers are increasingly targeting the people using it rather than the code underneath.
The FBI has notified users on the Tron network about a fake token impersonating the agency.
A post published on X by its New York field office on March 19 warned of a phishing campaign that tries to get people to give up their personal information and access to their wallets by pretending to be an official investigation notice.
Scam Targeting Tron Users
According to the law enforcement agency, attackers are sending out a malicious TRC20 token with the subject line “FBI message,” telling people to complete an “AML verification” or risk having their assets blocked. The message directs users to a fake website, where it prompts them to submit their personal information.
The FBI advised anyone who gets the tokens not to visit the site or give out personal details. It also urged any victims who may have already shared their identifying information to report the matter to the agency’s Internet Crime Complaint Center.
The warning is in line with research published by blockchain security company AMLBot on October 30, 2025, which showed a similar scheme targeting Tron wallets. The company says that attackers watch blockchain activity to find addresses that are affected by Tether freezes. Once a wallet is flagged, the user gets a “Survey” token with a link to a fake recovery site that looks like official communication.
If they follow the link, the website asks them to check their wallet status and then connect it to the platform. According to AMLBot, users are then asked for a fee in TRX, upon which the website quietly sends out an update that gives attackers access to the victim’s wallet, allowing them to take over accounts and wait for money that has been frozen to be released.
Shift Toward User-Targeted Attacks
The rise of the fake “FBI tokens” is another sign of a bigger shift in the way crypto scams are done that was recently reported by blockchain analytics company Nominis. The firm released a report on March 14 showing that total losses from crypto exploits had dropped sharply in February 2026, but attackers were increasingly focusing on manipulating users instead of finding technical flaws.
You may also like:
Nominis says that in a lot of the recent thefts, criminals used phishing links, fake interfaces, and false transaction approvals to get the information they wanted. All of these are tactics that depend on manipulating users to either sign malicious permissions or disclose sensitive data.
A very recent example is the March 1 hack of Bitrefill, where attackers drained several hot wallets and made off with gift card inventory. The company confirmed that the thieves gained access to its systems using compromised credentials from an employee’s laptop. Investigations linked the incident to North Korean entities.
Security researchers say these patterns show that with the blockchain infrastructure becoming harder to exploit, attackers are finding ways to manipulate user behavior. And going by the FBI’s warning, impersonation tactics, especially those involving authority figures or law enforcement, are still a major threat to crypto users.
Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).
LIMITED OFFER for CryptoPotato readers at Bybit: Use this link to register and open a $500 FREE position on any coin!
The content published on Finance Insider Today is for informational and educational purposes only. It does not constitute financial advice, investment advice, or any other form of professional advice. Always conduct your own research and consult a qualified financial advisor before making any investment decisions. Finance Insider Today is not responsible for any financial losses resulting from decisions made based on information published on this website. Past performance is not indicative of future results. Financial markets carry significant risk. Never invest more than you can afford to lose.
