Lookproof Browse tools

Press kit: How spoofable is crypto?

Material for journalists about the study Most crypto domains can still be spoofed by email. The biggest names mostly can't. Free to use under CC BY 4.0.

Key figures

  1. Only 8 of the top 96 centralized exchanges can be spoofed by email, but just 50 of them tell receivers to reject forged mail.
  2. In the long tail of 5,535 crypto domains without a CoinGecko rank, 77.9% can be spoofed.
  3. Domains not set up for mail are the easiest to fake: 2,300 of 2,559 (89.9%) can be spoofed.

Summary

Lookproof checked the DMARC policy of 8,522 crypto domains on 30–31 October 2026, using public DNS only and sending no mail. A domain counts as spoofable when it has no DMARC record, only a monitoring policy or an invalid record. The biggest names are mostly protected: 6 of the top 47 project domains and 8 of the top 96 centralized exchanges are spoofable. Protection falls off quickly with rank, and most smaller domains have no DMARC record at all. DMARC stops only mail that forges the exact domain, not look-alike domains. We do not name spoofable domains.

Charts

Each chart as a PNG file, 2000 pixels wide.

Method

  1. Domains: 8,522 crypto exchange, chain and token domains from CCXT, ethereum-lists, Trust Wallet and the MetaMask allowlist, enriched with CoinGecko; the list was frozen on 30 October 2026, before scanning.
  2. Scan: each registered domain checked once through the Lookproof API on 30–31 October 2026, with public DNS lookups only and no mail sent.
  3. Spoofable: the DMARC policy receivers apply under RFC 9989 is none, or there is no record, or it is invalid; quarantine counts as not spoofable.
  4. Groups: projects by CoinGecko market cap, centralized exchanges by CoinGecko trust score; groups overlap and are never added up.
  5. Excluded: 1,150 domains that no longer exist, 196 with lame delegation and 13 undecided, leaving 7,163 domains.

The full method, the results table and the aggregate dataset (segments.csv) are on the study page.

License

Text, charts and data are licensed under CC BY 4.0. Please credit "Lookproof, How spoofable is crypto?" with a link to the study.

Contact

Questions, interviews or the raw numbers behind a chart: [email protected].

Tue, Lookproof