A 2026 list of crypto scam websites would already be wrong
If a site asked for a wallet connection, a seed phrase or a payment before it would release funds, a 2026 list of crypto scam websites won't settle it. Domains on a list can be dead or replaced by the time you read them, and the same pitch tends to come back under a new name. The token is easier to check: genuine USDT moves through exactly one contract per network, and a block explorer records what that contract did with any address.
The one detail a copied website can't fake
Tether's own documentation names exactly one contract for USDT on each network it supports. TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t runs the TRON version, and a separate address, 0xdAC17F958D2ee523a2206206994597C13D831ec7, runs the Ethereum version. A website can copy a logo, a layout and a countdown timer in an afternoon, but it can't make a different contract into Tether's. A token issued from any other address that calls itself USDT is not the stablecoin Tether backs, whatever the site says about it. So the test is simple: if the contract address a site uses is not one of these two, the token is not USDT, however the page looks.
As a made-up example: picture two contract addresses that share the same first few characters and the same last few characters, with only a handful of characters different in the middle. Placed side by side on a page, they read as the same token. Looked up in full on a blockchain explorer, they turn out to be two unrelated contracts, and only one of them is Tether's.
Balances work in a way that helps you spot a fake one. An ERC-20 token, and TRON's TRC-20 equivalent, keeps a single running balance per address, and each transfer adds to whatever that address already held. Any balance a site shows you should therefore be built from transfers you can find on the real contract in a block explorer. If those transfers aren't there, the site generated the number itself and no payment happened.
Three pitches that outlast any single domain
Three pitches turn up across different sites, logos and languages, whatever the domain.
Each one ends the same way: money, a credential or a wallet approval leaves your side before anything genuine comes back.
- An exchange or trading site that accepts deposits freely but asks for a verification payment, a tax or a membership fee before a withdrawal goes out.
- A support message, chat or email that asks for a seed phrase, a private key or a one-time code, framed as account recovery or as releasing a frozen balance.
- A page that asks you to connect a wallet and approve a transaction described only in vague terms. A plain transfer shows you the recipient address and the amount in your wallet before you sign; an approval with no clear recipient or amount is the one to refuse.
Checking the claim against Tronscan or Etherscan
The check below works whatever the site looks like. It has four steps and needs only the block explorer for the network the token claims to run on.
If you want a quick first pass before checking by hand, TrustSniffer's website checker runs a version of this lookup automatically and returns a trust band for the domain, a rating of how far we judge the domain can be trusted. A low band is reason enough to stop; a good one still calls for the manual comparison below before you pay anything.
- Find the contract address the site says it's using. It's often shown in a field labelled token or contract, or inside the pop-up that appears when you connect a wallet.
- Open Tronscan for a TRON address or Etherscan for an Ethereum address, and search that contract address directly rather than searching the site's name.
- Read what comes back. The same search shows the sender, recipient, amount and time of every transfer tied to that contract, so you can see whether real transfers exist or whether the balance only lives on the site's own page.
- Compare the address you found against Tether's two listed contracts. If it doesn't match either one, stop there. If it does match, that confirms the token itself is genuine USDT, though it says nothing about the site, the person asking you to pay, or the withdrawal they promised.
What a matching contract settles, and what it leaves open
A matching contract rules out one specific risk: a lookalike token standing in for USDT. It doesn't confirm that an exchange will process a withdrawal, that a support agent is who they claim, or that a signed approval won't give a wallet drainer (code that moves tokens out of your wallet once you approve it) access to your funds. Each of those needs its own check.
If the address doesn't match any contract you can verify, or a withdrawal keeps getting held behind a new fee, treat the site as a scam and stop sending money to move the first payment along. If the picture is still unclear after checking the contract and the transfer history, TrustSniffer's wallet checker puts the same address next to flags from other reports. Flags there mean stop; no flags means you still shouldn't send more until the promised withdrawal has actually arrived.
