A newly preserved security investigation has identified zetachain[.]run, a website presenting itself as a ZetaChain swapping, bridging and staking interface, as a potential cryptocurrency phishing threat. PhishDestroy recorded the site on October 19, while its retained intelligence shows a match with the public Scam Sniffer blocklist.
The security service assigned the domain a 75 out of 100 evidence-risk score in its detailed assessment and recorded two URLQuery security detections. Those results support investigating the site and warning users against assuming it is an official ZetaChain service. They do not establish that anyone connected a wallet, signed a malicious transaction or lost cryptocurrency.
Registration records place the site’s creation on October 11, eight days before the preserved capture. The exact date of its first malicious operation, if any, has not been independently established.
What Did Researchers Capture on the ZetaChain-Themed Site?
In its stored investigation of the domain, PhishDestroy recorded a page titled “ZetaChain Swap | Bridge & Staking Zeta Tokens | ZetaHub.” That description closely resembles services a ZetaChain user might expect to find on a legitimate crypto application.
ZetaChain is a blockchain network with cross-chain functionality and a native ZETA token used for staking and network fees. Its official documentation describes ZetaHub’s asset-transfer functionality. A site that presents swapping, bridging and staking in one interface therefore uses language familiar to the project’s ecosystem, regardless of whether the observed page actually executed those operations.
PhishDestroy preserved its first primary capture at 01:28 UTC on October 19, or 04:28 in Cairo. The retained records also contain a URLScan capture at the same time. Those timestamps date the investigators’ observations, not the domain’s launch or the start of any attack.
The report’s automated content analysis mentions Coinbase, Coinbase Wallet, Ledger and other Web3 references. Their appearance in a captured page or classification output should not be interpreted as endorsement, integration confirmation or evidence that any named wallet provider’s own systems were compromised.
How Strong Is the Scam Sniffer Evidence?
PhishDestroy’s archived report shows a Scam Sniffer blocklist match as well as its own PhishDestroy listing. A separate review of Scam Sniffer’s public GitHub threat database also located zetachain.run in a blacklist archive named for October 11, 2026.
That archive filename is a useful lead, but by itself it does not prove the precise moment Scam Sniffer first classified the domain. Archived datasets can be assembled, updated or indexed after an underlying observation. Researchers would need the relevant insertion history or original detection record to establish when the domain was first added.
PhishDestroy’s 75/100 score is its own analytical indicator, not a measured probability that a visitor will be defrauded. Its dataset also showed two detections through URLQuery, while an earlier retained VirusTotal scan at 02:31 UTC showed zero detections across 92 engines. Different security feeds can reach different results because they have distinct inputs, classifications and update schedules.
A zero-detection result from one scanner does not certify safety; equally, an automated classification does not supply a victim list or prove the existence of a working malicious transaction payload. The distinction resembles an earlier DaveFinances investigation into gaps between crypto phishing blocklists, where differing security observations had to be separated from confirmed attacker activity.
Why Is an Imitation Swap or Bridge Page Risky?
Swaps and bridges often legitimately require users to connect a wallet and sign transactions. That makes a convincing imitation especially dangerous: the surrounding interface can look routine even when the authorization requested is not.
There are several technically distinct possibilities. A deceptive site may request a normal transaction sending tokens to an attacker-controlled address. It may attempt a token allowance or Permit2 authorization that enables later transfers. It might instead harvest recovery phrases, impersonate support, or simply redirect visitors to another page.
None of those specific mechanisms has been independently demonstrated for zetachain[.]run. The available investigation does not identify a confirmed attacker wallet, a decoded malicious signature, drained balances or affected users. Describing the site as a proven wallet-draining campaign would go beyond the public evidence.
The risk to an individual investor depends on what the page asks the wallet to do, not only its name or appearance. As our guide to identifying cryptocurrency scams before connecting a wallet explains, an ordinary connection can expose a public wallet address, while token approvals, off-chain permits, transfers and recovery-phrase disclosure create different levels of exposure.
Does the Domain’s Technical Infrastructure Identify Its Operator?
PhishDestroy’s domain record lists PDR as the registrar and Cloudflare nameservers, with a resolved IP address belonging to a shared content-delivery network. This provides hosting and registration context, but not a reliable identity for the site’s owner or the person who created its content.
Shared edge IP addresses can serve unrelated websites. Linking a domain to Cloudflare infrastructure is not proof that Cloudflare operates the page, or that other domains sharing the same IP belong to the same adversary. Similarly, the use of a valid HTTPS certificate confirms an encrypted connection to the hostname, not legitimacy of the claims made by its operator.
The eight-day-old registration is an additional reason for caution when combined with a branded Web3 interface and phishing detections. Domain age alone is not decisive: real crypto projects and legitimate community tools also launch new sites. The meaningful issue is whether the destination can be independently verified from the project’s established channels.
Other cases illustrate the importance of that distinction. DaveFinances reported on Scam Sniffer’s October 13 additions to its drainer and seed-phishing indicators, but those separate entries cannot be assumed to share an operator or codebase with this new ZetaChain-themed observation.
What Should ZetaChain Users Verify Now?
Users should navigate to the network’s official documentation through a trusted bookmark or an independently verified channel, rather than connecting a wallet to a link presented in an advertisement, private message or unsolicited token-claim offer. A familiar name in a browser tab and references to well-known wallet brands are not adequate proof of authenticity.
If a wallet has already been connected to an unfamiliar page, the next step depends on what was authorized. Disconnecting may end the application’s access to the current session but does not necessarily revoke on-chain token allowances. Users should inspect approvals through an independently located wallet or block-explorer tool. Anyone who disclosed a recovery phrase should treat the affected keys as compromised and use a trusted device to establish a fresh wallet.
The next research priorities are technical evidence capable of revealing the site’s actual behavior: saved JavaScript and contract calls, spender addresses, wallet-connection prompts, browser behavior across sessions, and any transaction traces or victim reports. An official ZetaChain response would also clarify whether the project has identified an impersonation attempt.
For now, the confirmed development is the preserved October 19 threat-intelligence observation and blocklist evidence concerning a domain registered October 11. No publicly verified theft, victim count or compromised ZetaChain infrastructure has been established.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574