Scam emails impersonating compensation from crypto asset exchange Binance and urging users to send funds have been confirmed in Japan as well, following the unauthorized outflow of roughly ¥1 trillion (about $6.3 billion) in assets from the exchange. The findings come from an investigation published November 3 by Romanian security firm Bitdefender, with victims identified in five countries including Japan.
The targeted countries confirmed were Japan, the United States, Germany, Ireland and Finland. The scam emails claim the recipient's Bitcoin address is registered as an unclaimed compensation target and demand that 0.0042 BTC (about ¥50,000 at ¥12.07 million per BTC) be sent to a designated address as a wallet verification fee — a precondition for receiving compensation. The emails say the fee will be refunded along with the compensation and include a case number and deadline to pressure recipients into deciding quickly.
On October 29, Binance announced that roughly ¥1 trillion (about $6.3 billion) in crypto assets had been illicitly drained and said it would cover all losses using its user protection fund and company funds. Bitdefender caught the emails on November 1, just days after the incident — meaning the announced compensation policy was repurposed as a pretext for fraud.
The firm also identified another scam email citing the Binance incident. It impersonates crypto wallet Trust Wallet, warns that accounts will be suspended unless verification procedures are completed, and directs recipients to a fake verification page. Emails with nearly identical wording had been circulating before the incident, suggesting attackers combined an existing tactic with a timely news hook.
Binance co-founder Changpeng Zhao (CZ) warned in a post on X about fake sites mimicking Trust Wallet's official domain. According to Zhao, the attackers replaced the letter "u" in the domain with "a" and changed the ending extension from ".com" to ".cam." The sites prompt visitors to connect their wallets and, under the guise of checking transaction history, prepare fraudulent transfers. The scheme also supports Phantom and OKX Wallet in addition to Trust Wallet, broadening the target pool.
What the tactics share is that they leverage trust in legitimate services to get users to take active steps themselves. A defining feature is that they involve actions such as transfers or wallet connections; the fake sites are said to query connected wallet balances via external APIs and even prepare transfer transactions in advance.
Bitdefender is urging users not to comply with transfer requests framed as receiving compensation or verifying a wallet, and to check notifications through official apps and websites. Binance Japan also cautioned as of October 30 against responding to suspicious links or messages.
For crypto users in Japan, the burden of judging the authenticity of notifications claiming to be from exchanges has grown further. Wording that stokes anxiety — such as compensation or account suspension — is a classic tactic for clouding judgment. Habitually checking outward signs such as domain spelling, extensions and whether a transfer is being requested is the first line of defense against falling victim.
Crypto fraud has a track record of spawning copycat schemes whenever an exchange suffers an outage or an outflow incident. This case likewise shows that accurately grasping the content of official announcements and maintaining skepticism toward guidance from anything other than official channels is the starting point for protection.
Note: Based on Bitdefender's investigation results and company announcements.
