Most crypto domains can still be spoofed by email.
The biggest names mostly can't

Scan of 30–31 October 2026. Top 50 crypto projects: 6 of 47 domains can be spoofed. Top 100 centralized exchanges: 8 of 96. The long tail of 5,535 smaller project domains: 77.9%, or 68.1% of those with an MX record.

The short version

• We checked the DMARC policy of 8,522 crypto domains on 30–31 October 2026, using public DNS only. A domain counts as spoofable when it has no DMARC record, only a monitoring policy (p=none) or an invalid record.
• The top is mostly covered. 6 of the top 47 project domains (12.8%) and 8 of the top 96 centralized exchanges (8.3%) are spoofable. But only 28 of the 47 project domains and 50 of the 96 exchanges tell receivers to reject forged mail. The rest settle for quarantine or less.
• Protection falls off quickly with rank. Among the top 500 projects, 33.2% are spoofable. Among all ranked centralized exchanges, 16.7%. Among ranked decentralized exchanges, 61.5%. In the long tail without a CoinGecko rank, 77.9%.
• Domains not set up for mail (no MX record, or a null MX) are the easiest to fake: 2,300 of 2,559 are spoofable. Only 25 have the setup such a domain should have.
• DMARC only stops mail sent as the exact domain. It does nothing against look-alike domains, which most documented post-hack phishing has used. This study measures one door, and many crypto domains leave it open.

Read this first

• Passive DNS only. We looked up public DNS records. We sent no mail and tested no mail server, so "spoofable" describes the published policy, not whether a particular forged message would reach an inbox.
• The registered domain only. We checked example.com, not mail.example.com or other subdomains (the subdomain policy is reported as a flag).
• Status on the scan date. The numbers describe DNS on 30–31 October 2026. Domains can have changed since.
• DMARC protects the exact domain. It does not stop look-alike domains, Unicode look-alikes or display-name tricks.
• Quarantine counts as not spoofable. Forged mail should land in spam, not the inbox. That is a choice, so the top groups also show "not fully protected": everything that is not reject.

Why we built this

On 29 October 2026 Binance put its loss from a hack at about $6.3 billion. According to TechCrunch, Binance said its initial investigation pointed to a "compromised" engineer's laptop; blockchain analysts attribute the theft to the North Korean group known as TraderTraitor. Binance later said the intrusion began with a fake job interview (BleepingComputer, 3 November 2026). Security firms warned customers to expect fake "compensation" emails. That warning has precedent: after the Bybit hack in February 2025, researchers counted 596 suspicious domains in three weeks, at least 43 of them impersonating Bybit, many built around words like "refund" and "recovery".

The hack did not come through email, and nothing in this study says it did. It is the moment when an exchange's customers are most likely to open a message that claims to come from it. So we asked a narrow question: which crypto domains still let anyone send mail that carries their exact name in the From address?

Forging the From address of a real domain is a long-recognised problem. The US Cybersecurity and Infrastructure Security Agency (CISA) puts it plainly: "anyone can spoof [a domain] to give the appearance that mail is coming from you". Since 2017 it has required US federal agencies to publish a DMARC policy of p=reject (BOD 18-01). The UK's National Cyber Security Centre gives the same advice to all organisations: DMARC makes it "difficult for cyber criminals to spoof your email address". Since February 2024 Gmail and Yahoo have required bulk senders to publish a DMARC record, although a monitoring-only p=none is enough to comply.

DMARC has a clear limit. It protects the domain in the From address and nothing else (RFC 9989). As CISA puts it, a domain's DMARC policy has "no effect on the deliverability of email coming from domains you don't own". It does not stop a misspelled domain or a Unicode look-alike. It stops the real domain from being forged, and only if the owner asks receivers to act.

Data and method

Domains. 8,522 crypto domains: exchanges, chains and token projects from CCXT, ethereum-lists, Trust Wallet and the MetaMask allowlist, enriched with CoinGecko's lists. We froze the list on 30 October 2026, before scanning, and recorded its sha256. We checked only the registered domain (for example example.com, not mail.example.com).

Rank. Projects are ranked by CoinGecko market cap (top 50, 500 and 1,000). Exchanges are ranked by CoinGecko's trust score, and we count only centralized exchanges, using CoinGecko's own flag. Decentralized exchanges are shown separately. The two rankings are never mixed. A domain that is both a coin and an exchange, such as binance.com for BNB and Binance, appears in both groups, so the groups are never added up. Everything without a rank is the long tail.

Scan. Each domain was checked once through the Lookproof API on 30–31 October 2026: DNS lookups only, no mail sent. We read the DMARC policy that receivers should apply under RFC 9989, which includes test mode and policies inherited from a parent domain. RFC 9989 is recent, and many receivers still follow its predecessor, RFC 7489; below we show where that changes the numbers.

Lookproof is our own tool. To check it, we compared 300 random domains against direct DNS lookups on 11 November 2026: 294 matched. Of the 6 that differed, 5 reflect DNS changes since the scan and 1 our stricter rule for invalid records (an invalid record that says p=reject counts as broken).

Category	Policy receivers apply	Spoofable?
Protected	reject	No
Partial	quarantine	No (forged mail lands in spam)
Monitoring only	none	Yes
Unprotected	No DMARC record	Yes
Broken	Invalid DMARC record	Yes

A malformed report address alone does not make a record broken; see below.

We count quarantine as not spoofable because forged mail should end up in the spam folder, not the inbox. That is a choice, so for the top groups we also show "not fully protected": everything that is not reject.

A record whose only error is a malformed report address (rua or ruf, for example without mailto:) is counted by its policy, not as broken. Receivers ignore an invalid tag and apply the rest of the record (RFC 9989, section 4.8), so the policy is enforced. The owner just doesn't get some or all of the DMARC reports. 9 domains with p=reject or p=quarantine are in that case.

Two rule choices move the headline numbers slightly. Counting the 3 invalid records that still say p=reject by their policy, as a receiver that ignores the error would, gives 77.8% for the long tail instead of 77.9%. Counting quarantine with pct below 100 as spoofable, as receivers on RFC 7489 may treat it, gives 10 of 96 for the top exchanges instead of 8.

Excluded. 1,150 domains that no longer exist (NXDOMAIN, confirmed by a second lookup), 196 whose name servers did not answer (lame delegation) and 13 where the lookups kept failing. That leaves 7,163 domains. If the 13 failed domains had been included, the overall share would move by at most 0.13 percentage points.

Results

The top is covered. Below it, a different picture

Enlarge chart

The top 50 has 47 domains because two of the top 50 coins have no website on our list and one only has a secondary domain. The top 100 exchanges have 96 domains: three ranks have no domain on our list and one domain was undecided. All 97 domains in the top 100 belong to exchanges CoinGecko flags as centralized.

With 47 and 96 domains, the top groups are small. The 95% intervals are wide: 6.0–25.2% for the top 50 projects and 4.3–15.6% for the top 100 exchanges.

The best setups at the top are easy to find. bitcoin.org among projects and kraken.com and coinbase.com among exchanges, all at the very top of their rankings, publish p=reject: mail that forges their domain should be refused outright.

Where protection stops at quarantine

Enlarge chart

Among the top 100 centralized exchanges, the most common weaker setup is quarantine, not the absence of a policy: 38 of 96 use it, against 5 with a monitoring-only policy and 3 with a broken record. None has no DMARC record at all. Quarantine tells receivers to put forged mail in the spam folder rather than reject it. We do not count it as spoofable, but it is not full protection either, and it is why only 50 of the 96 reach p=reject.

In the long tail, the most common category is not a weak policy but none at all: 3,558 of 5,535 domains have no DMARC record.

Domains not set up for mail

Enlarge chart

2,559 of the included domains publish no MX record (2,341) or a "null MX" that says explicitly that they take no mail (218). Without an MX record, mail can still be delivered to the domain's own address, so we cannot say these domains never send or receive mail, only that they are not set up for it. They can still be forged. CISA's advice covers exactly this case: "Even if you do not send mail from your domain, anyone can spoof it." 2,300 of them (89.9%) are spoofable. Only 25 have the full setup for a domain without mail: null MX, v=spf1 -all and p=reject. The free lockdown tool checks a domain and gives you the three records.

If we leave these domains out, the overall share drops from 71.4% to 61.1%. We show both, so a reader can't mistake "spoofable" for "spoofable and actively used for mail".

Why so many domains stop short

p=none meets the big mailbox providers' rules. Gmail and Yahoo require a DMARC record from bulk senders, but a monitoring policy is enough. A domain can be fully compliant with Gmail's sender rules and still land in our "monitoring only" category. 976 domains in the study are there.

Moving to reject takes work. A domain owner has to find every service that sends mail in their name, from the help desk to the newsletter tool, and make each one pass SPF or DKIM before p=reject is safe. Quarantine is a common resting point on the way.

Many crypto domains have no mail team. A token project's website is often a landing page on a domain nobody has thought about as a mail domain. These are the domains with no DMARC record at all.

Notification

Before publication we set out to notify the spoofable domains among the top 100 centralized exchanges and top 50 projects, plus binance.com, which this study names, and two domains whose only error was a malformed report address: 17 domains in all. 12 were notified privately: 11 by email on 3–4 November 2026 and 1 by direct message on X. Of the 12 we notified, 10 were spoofable; 1 has fixed it so far (by 9 November 2026), verified with our own DNS lookups on two public resolvers (1.1.1.1 and 8.8.8.8). 3 acknowledged receipt. For 2, the only route was a public GitHub issue, where we asked for a private contact without giving details; neither replied. 3 had no public contact route we could use.

We do not name spoofable domains. Not on this page, not in the dataset.

What you can do

If you run a crypto domain:

• Check what receivers see today. Our free email security check shows the policy in seconds, in the same categories as this study.
• If the domain sends no mail: publish a null MX, v=spf1 -all and v=DMARC1; p=reject. That is three DNS records and no ongoing work. See how to lock down a domain without mail, or get the records for your domain.
• If it sends mail: start with p=none and a report address, read the reports for a couple of weeks, then move to p=reject. Don't forget sp= for subdomains: 52 domains in our data reject forged mail on the main domain but not on subdomains.

If you use exchanges:

• A reject policy on the real domain removes one trick, not phishing. Check the actual sender domain letter by letter, especially after a hack, and never act on a "refund" or "recovery" email. Go to the exchange's site yourself.

Methodology notes

Domain list frozen on 30 October 2026 (8,522 domains). Each domain was checked once through the Lookproof API on 30–31 October 2026; only domains without a valid answer were retried, up to two times, hours apart. Categories follow the DMARC policy receivers apply under RFC 9989; pct is not part of the category (RFC 9989 removed it), and 77 domains with pct below 100 are counted by their policy. A record whose only error is a malformed rua/ruf address counts by its policy (RFC 9989, section 4.8); 9 such domains were first counted as broken and were reclassified after review on 3 November 2026. Quarantine counts as not spoofable; the "not fully protected" share includes it. Projects are ranked by CoinGecko market cap and centralized exchanges by CoinGecko trust score, with CoinGecko's centralized flag; ranks from 29–30 October 2026. One domain per rank; a domain that is both a coin and an exchange (binance.com for BNB and Binance) counts in both groups, and groups are never summed. 1,150 NXDOMAIN, 196 lame delegation and 13 undecided domains are excluded; 6 of the 13 failed only on four extra DKIM selectors we asked for, where the domain's name servers answered with a server failure, and would probably have been decided without them. DKIM is checked on known selectors only, so "not found" is not "missing". Mail provider is inferred from MX records. Numbers are the status on the scan date; DNS changes. The scanner truncated TXT answers above 50 records. We re-checked all domains against direct DNS on 2026-11-05: two domains were affected (SPF not seen), and no reported figure changes. DNS may have changed since 30 October. Before publication we set out to notify the spoofable domains among the top 100 centralized exchanges and top 50 projects, plus binance.com, which the article names, and two domains whose only error was a malformed report address: 17 domains in all. 12 were notified privately: 11 by email on 3–4 November 2026 and 1 by direct message on X. Of the 12 we notified, 10 were spoofable; 1 has fixed it so far (by 9 November 2026), verified with our own DNS lookups on two public resolvers (1.1.1.1 and 8.8.8.8). 3 acknowledged receipt. For 2, the only route was a public GitHub issue, where we asked for a private contact without giving details; neither replied. 3 had no public contact route we could use. We do not name spoofable domains. Sources for the news context: TechCrunch, TRM Labs, Chainalysis, BleepingComputer, BforeAI; for the policy context: CISA BOD 18-01, UK NCSC, Google's email sender guidelines.

Dataset

The groups behind every number on this page, as CSV. Aggregates only: no domain names, ranks or CoinGecko ids. Groups overlap, so rows must not be added up.

• segments.csv: one row per group, with counts, shares, 95% intervals, DMARC categories and flags.
• categories.csv: the DMARC categories in long format (segment, category, count), for charts.
• readme.txt: column descriptions, group definitions and license.

License: CC BY 4.0. Please credit "Lookproof, How spoofable is crypto?" with a link to this page.

Writing about the study? The press kit has the key figures, a short summary and the charts as PNG files.

Sources

• CISA, BOD 18-01: Enhance Email and Web Security
• UK NCSC, Email security and anti-spoofing
• Google, Email sender guidelines
• RFC 9989, DMARC
• RFC 9989, DMARC (section 4.8)
• TechCrunch, North Korean hackers blamed for stealing record $6.3B in Binance breach
• TRM Labs, analysis of the Binance hack (29 October 2026)
• Chainalysis, Binance exploit: latest findings and response
• BleepingComputer, Binance says fake job interview led to crypto heist (3 November 2026)
• BforeAI, Bybit opportunists: malicious infrastructure report

Market cap rank and exchange type: CoinGecko API. Powered by CoinGecko.

Check the domain, not the display name.