How fake crypto exchanges operate — and how to tell the difference

Fake crypto exchanges are the infrastructure layer behind most pig-butchering and romance-investment scams. Understanding how they are built — and how they differ from a real exchange — is the single fastest way to spot one.

What a fake exchange actually is

A "fake exchange" is almost never an exchange in any technical sense. It is a web application that presents the user interface of an exchange: an order book, a chart, a balance page, a withdrawal flow. The numbers shown are not backed by matching engines, real assets, or custodial infrastructure. They are generated on the server and rendered to the specific user to whom they are shown.

There are two common implementations:

1. Admin-controlled databases. The user's "balance" is a number stored in the operator's database. "Trades" are database writes with fictional order matching. "Profits" accrue by scheduled increments.
2. Template kits. Ready-made scam-exchange templates are sold in dark markets with full admin panels. New domains can be stood up in hours.

Why the UI is convincing

Legitimate exchange UI patterns — candlestick charts, depth books, ticker tapes — are open-source components or well-understood design patterns. Cloning them is trivial. What distinguishes a real exchange is not the UI, but the infrastructure and regulatory posture behind it, which the UI cannot reveal.

The most deceptive feature is usually the withdrawal button. Real exchanges allow small withdrawals to complete successfully. Fake exchanges often do too — for the first or second attempt, at small amounts. This is the operator building confidence.

Where the scam reveals itself

Four patterns are near-universal:

• Cannot find the exchange via independent search. The only links you have come from the counterparty who introduced you. Real licensed exchanges are indexed by major regulators' public registries.
• Licence claim that does not check out. The "licence" points to a regulator's registry — but the registry does not list the exchange, or lists a different entity with the same name.
• Withdrawal friction that scales with amount. Small withdrawals succeed. Large ones trigger "tax," "unfreezing," "upgrade," or "channel" fees. Each fee is presented as the last one.
• Deposit address ownership. The deposit address you sent to belongs, on-chain, to an address cluster associated with operator infrastructure — not to a major regulated exchange's hot-wallet cluster.

How to actually verify an exchange is legitimate

1. Search the exchange name on a regulator's own registry (HKMA / SFC in Hong Kong, MAS in Singapore, FCA in the UK, SEC/CFTC in the US). Do not rely on a "verified" badge on the exchange's own site.
2. Check on-chain attribution tools (e.g., Arkham Intelligence) for whether the deposit address is attributed to a known regulated exchange.
3. Look for independent press coverage that predates your first contact with the counterparty. Fake exchanges are usually very new.
4. Check the exchange's incident response and complaint procedure. Licensed venues are required to publish them; fake venues do not.

If you have already deposited

Preserve everything:

• Conversation history with the counterparty
• Every URL you visited while using the "exchange"
• Every transaction hash for every deposit
• Any KYC documents you submitted (these may be held by the operator to threaten you later)

Our evidence preservation checklist covers this in detail. Then read our risk disclosure before engaging any recovery service.