Fake Token Migration and Swap Scams

A token migration scam is a fraud in which criminals tell you that a token you hold must be "upgraded", "migrated" or "swapped" to a new version, then send you to a fake portal that drains your wallet through a malicious approval, signature or seed phrase request. The scam works because real migrations do happen, so the story sounds plausible.

Projects legitimately change contracts for upgrades, rebrands or chain moves. Polygon's move from MATIC to POL is one well-known example of a genuine transition. Every real migration creates a window in which holders expect instructions, and scammers race to fill that window with fake ones.

Why Real Migrations Create an Opening

There are legitimate reasons a project might ask holders to swap tokens:

• Contract upgrades. A bug or new feature requires a new token contract.
• Rebrands and token changes. A project replaces one token with a successor.
• Chain moves. A token moves from one blockchain to another, such as from an ERC-20 to a project's own mainnet.
• Redenominations. Supply is split or merged, for example 1 old token becomes 100 new ones.

Each of these creates confusion, and confusion is profitable for scammers. Many holders do not follow project news closely, so a convincing message that says "the old token is being retired" can feel like urgent, helpful information. Related reading: Phishing Through Search Ads.

How the Scam Works, Step by Step

1. 1Pick a target. Scammers watch for announced migrations, or simply invent one for a popular token.
2. 2Build the portal. They clone the project's website design onto a look-alike domain with a "Migrate" or "Claim V2" button.
3. 3Spread the link. They post it in replies to official accounts, run search ads, send direct messages on Telegram and Discord, airdrop worthless tokens whose name is a URL, or impersonate support staff.
4. 4Create urgency. Messages claim the old token will "stop working" or "lose all value" within hours.
5. 5Take the funds. The portal asks you to connect your wallet and then approve unlimited spending, sign a permit or Permit2 message, send tokens to a "migration contract", or "validate" your wallet by entering your seed phrase.
6. 6Drain and launder. Once you sign, an automated drainer moves your tokens out, often within seconds, and splits them across many addresses.

For more on the signing tricks involved, see our guide to ice phishing and permit signatures.

A Hypothetical Example

The following is an illustrative composite, not a real case.

Imagine a holder named Sam owns a mid-sized DeFi token. One morning, Sam sees a reply under the project's official post: "Reminder: V1 tokens are deprecated at midnight UTC. Migrate here." The link leads to a site that looks identical to the project's site, with one letter changed in the domain. We cover this in more detail in Fake WalletConnect and Wallet Pop-Up Phishing.

Sam connects a wallet and clicks "Migrate". The wallet shows an approval request for the token with an unlimited amount. Sam assumes this is normal for a swap and confirms. Within a minute, the entire token balance leaves the wallet. A second request then asks Sam to sign a message to "receive V2 tokens"; it is a permit for another token in the wallet. No V2 tokens ever arrive. The real project had announced no migration at all. See also: Fake Bridge Websites.

Warning Signs Checklist

How to Verify a Genuine Migration

1. 1Go to the source yourself. Type the project's official domain or use a bookmark. Check the official docs and blog for a migration page. Our guide on verifying a website is the official project site explains how.
2. 2Cross-check the announcement. Confirm it appears on the project's verified social accounts and, ideally, is reported by exchanges that list the token.
3. 3Check your exchange. If your tokens are on an exchange, look for its official notice. Exchanges usually handle the swap for customers.
4. 4Verify the new contract. Compare the new token's address across official documentation and a block explorer, as described in our guide to verifying a token's official contract address.
5. 5Read the transaction before signing. Confirm the contract you are approving matches the documented migration contract and limit the approval amount where possible.
6. 6Wait if unsure. Genuine migrations rarely punish holders for taking a day to verify.

What to Do If You Fell for It

Act quickly, in this order:

1. 1Revoke approvals. Use a reputable approval tool to revoke any approval or permit given to the scam contract. See how to revoke token approvals.
2. 2Secure the wallet. If you entered your seed phrase, treat the wallet as compromised and move remaining assets to a brand-new wallet with a new seed phrase. Follow our checklist on what to do immediately if your wallet is compromised.
3. 3Record evidence. Save the URL, screenshots, transaction hashes and scammer addresses.
4. 4Report it. Tell the real project, your wallet provider and the platform where you saw the link. You can also flag the site and addresses to us through our scam report form.
5. 5Beware recovery scams. People who promise to recover your funds for a fee are almost always running a second scam.

Bottom line

Token migration scams exploit a real process: projects do sometimes swap or upgrade tokens. The defense is simple but strict. Only follow migration instructions you found yourself on official channels, verify the new contract address, never share a seed phrase, and treat urgency and private messages as red flags. If a migration is genuine, it will still be there after you have checked.