Meme coin traders are being targeted by a new phishing scam that uses fake Cloudflare verification pages to trick users into running malicious code on their computers.
The attack has already caused a major loss. Crypto trader @cladzsol reported losing around $600,000 after interacting with one of the malicious websites.
Reports on Sept. 16 said several meme coin-related pages were redirecting visitors to fake Cloudflare verification screens. Instead of simply verifying that the visitor is human, the pages instruct users to run commands or scripts on their computers. This can allow malware to access the system and potentially steal crypto assets.
The attack is different from many common crypto wallet-draining scams. Those attacks usually ask users to connect their wallets and approve a malicious transaction. In this case, the attacker first tries to get the victim to run code directly on their computer.
The malicious websites have reportedly appeared through links connected to meme coins. Traders researching newly launched tokens may click these links expecting to reach an official project website, but instead they can be sent to a fake verification page.
The fake pages are designed to look like legitimate Cloudflare security checks. After following the instructions, the user may download and execute a malicious script.
The attack also takes advantage of how quickly meme coin traders move between token pages, social media accounts and project websites.
Some token tracking and trading platforms display website and social media links taken from token metadata. According to the reports, attackers can place malicious websites in these fields and make them appear to be official project links.
There is no evidence in the reports that DexScreener itself was hacked or compromised. However, the incident has raised concerns about how quickly links shown through token tracking platforms are reviewed.
The latest campaign is part of a wider trend in crypto scams where attackers copy trusted brands and familiar websites to make malicious activity look legitimate.
In August, a Hyperliquid trader reportedly lost around $550,000 after clicking a sponsored Google advertisement that led to a fake version of the decentralized trading platform. Security firm Salus linked the infrastructure used in that attack to the Inferno drainer ecosystem.
Crypto wallet drainers have also commonly used fake project websites, fraudulent airdrops, malicious social media links and fake token pages. In many of these cases, victims are asked to connect a wallet and approve a transaction or digital signature.
The fake Cloudflare campaign takes a different approach. Instead of relying mainly on a blockchain approval, it tries to convince users to execute a script on their computer. Once the malicious code is running locally, attackers may be able to access information stored on the device.
Malware has become another major threat to crypto users. Recent attacks have targeted wallets, password managers, browsers and other information stored on computers.
In August, cybersecurity company Morphisec discovered a fake Claude desktop application that distributed RevStealer malware. The malicious program was presented as “Claude Opus 5 Free Desktop” and could target more than 50 cryptocurrency wallets on Windows systems.
Another campaign reported in May used malicious developer packages to target crypto and AI developers. Security platform Socket identified dozens of malicious packages across npm, PyPI and Rust software ecosystems. The campaign was designed to steal wallet information, GitHub tokens, cloud credentials, API keys and SSH access.
These attacks used different methods, but they shared one key step: convincing victims to install or execute something that appeared legitimate.
Meme coin traders have faced similar threats before. In August 2024, Solana decentralized exchange aggregator Jupiter warned users about a malicious Chrome extension called Bull Checker after users reported having their wallets drained.
The extension was promoted as a tool for viewing meme coin holders. Jupiter found that it could change transactions during interactions with decentralized applications and add instructions that transferred tokens to another wallet.
In another incident in November 2024, a Gigachad meme coin investor reportedly lost $6.09 million after clicking a fake Zoom meeting link. Malware was downloaded to the victim’s laptop, and the attacker later drained three wallets containing 95.27 million GIGA tokens.
The latest reports highlight a simple warning for meme coin traders: if a website claiming to be a Cloudflare verification page tells you to run a command, paste code or execute a script, close the page immediately.
Legitimate security checks should not require users to run unknown commands with administrator privileges on their computers.
