A fake OnRe airdrop page is attempting to attract ONyc holders with a supposed 2 million-token distribution, while a separate website impersonating OKX offers a suspicious Android application through an unrelated download domain. Meanwhile, a new Bitquery investigation finds that buyers of Pendle yield tokens in points-based markets received approximately $730 million less on-chain than they paid across expired Ethereum markets. The phishing investigations have not established confirmed customer losses, while the Pendle figures require a distinction between on-chain shortfalls and the value of rewards received outside the blockchain.
Three new developments highlight different risks facing cryptocurrency users and investors, from counterfeit websites targeting wallet holders to the economics of speculative DeFi yield products.
Fake OnRe airdrop page targets ONyc holders
A newly documented phishing website is impersonating OnRe through the domain 0nre-financa.com, using a zero at the beginning instead of the letter O in OnRe’s name.
The page advertises a supposed 2 million ONyc Community Distribution, claiming that 12,847 wallets qualify for an allocation. It displays a November 30 snapshot date and December 15 claim opening, alongside a prominent “Connect Wallet to Check Allocation” button.
The domain is the giveaway, and not a subtle one.
OnRe’s legitimate website operates at onre.finance, with its application available through app.onre.finance. The counterfeit page uses a different domain and a fabricated-looking distribution announcement to create the impression of an official reward campaign.
Security researchers documented the website on November 6. URLScan captured the page at 06:53:29 UTC, or 08:53:29 in Cairo, and classified the capture as malicious with a reported engine score of 93/100. ScamSniffer also listed the domain, while PhishDestroy recorded it shortly afterward.
The registration and detection dates should be kept seperately. Public registration records place the domain’s creation on October 24, while November 6 marks its newly documented detection in the investigation.
There is no confirmed evidence that users successfully connected wallets, approved malicious transactions or lost funds through this particular page. The presence of a wallet-connection button alone does not establish that assets were transferred or that a malicious authorization was executed.
The campaign resembles other recently documented fake reward and wallet-drainer infrastructure. DaveFinances previously reported on ScamSniffer’s identification of new drainer and seed-phishing indicators, including websites using familiar DeFi terminology to attract potential victims.
Counterfeit OKX website offers suspicious Android application
A second website, wp-okx.com.cn, is impersonating cryptocurrency exchange OKX through a Chinese-language landing page that advertises trading services and an Android application download.
The captured page displays OKX branding alongside platform statistics claiming more than 50 million users, 300 trading pairs and $8.2 billion in custody. These figures were not independently verified and should not be treated as information published by the legitimate exchange.
The website provides two external routes: an Android installation package hosted at dkgwpqxvfnr[.]com/upgradeapp/android_ACE863952.apk and a login destination at btmzhjpdgxc[.]org/join/ACE863952.
The second page looks more like an exchange, at least on the first screen. But the download and login destinations do not belong to OKX’s official domain.
URLScan captured the website at 07:10:52 UTC on November 6 and assigned its phishing classification a 100/100 score. PhishDestroy subsequently recorded the domain and identified matches against the MetaMask and SEAL security blocklists.
The domain was registered on October 13, meaning November 6 represents the first documented phishing capture in this investigation rather than its creation date. Its registration history and the captured page provide separate pieces of evidence about the site’s timeline.
No confirmed APK execution, stolen login credentials or customer losses have been established. The fake application’s distribution route is nevertheless a significant concern because installing an unverified Android package can expose users to credential theft and potentially malicious device activity.
The incident follows earlier security findings involving malicious software distributed under cryptocurrency-related branding. In September, DaveFinances examined how SlowMist and OKX researchers linked the FomoPeek iOS application to a crypto-theft campaign. That investigation concerned a different application and attack mechanism, and there is no established connection between the two cases.
For users, the distinction between an exchange-branded website and an authentic exchange download route is essential. DaveFinances has also outlined how to examine suspicious cryptocurrency websites before connecting a wallet, including domain variations and the permissions requested during wallet interactions.
Pendle investigation finds $730 million on-chain shortfall
A new investigation by blockchain analytics firm Bitquery has examined 455 expired Pendle markets on Ethereum, finding that yield tokens delivered less than buyers had priced in across 394 markets, or approximately 87% of the sample.
The most significant finding concerns points-based markets. Across these markets, holders of Pendle yield tokens received approximately $730 million less on-chain than they paid, according to Bitquery’s analysis of 243,572 wallets.
Only 2.8% of wallets in those points markets came out ahead under the investigation’s methodology, before assigning any value to off-chain points and airdrops.
That is a large gap, but it is not a cash-loss figure in the usual sense.
Pendle separates interest-bearing assets into principal tokens (PTs) and yield tokens (YTs). Buyers of YTs pay for the future interest and, in some markets, associated reward points. The price of the token reflects the yield buyers expect to receive before the market expires.
Bitquery compared the yield priced into each market with what the underlying tokens subsequently delivered. Its findings indicate that the median annualized yield priced in by buyers was 8.8%, while the median yield actually delivered was 3.6%.
The $730 million figure represents an aggregate on-chain shortfall, not a confirmed amount of realized cash losses. Bitquery excluded the value of points and airdrops because those rewards are distributed and accounted for outside the on-chain records included in its methodology. Some participants may therefore have received additional benefits that the calculation could not value.
The research also found that only 25% of buyers in 102 markets without points, where interest was paid on-chain, made money. The median buyer in those markets lost 25% of the amount invested.
Beyond individual trading outcomes, the investigation identified a substantial decline in Pendle’s deposits. Total value locked fell from approximately $10.57 billion at the end of August 2025 to $1.02 billion in November 2026, a reduction of roughly 90%.
Ethereum accounted for approximately 76% of the remaining deposits in the latest snapshot. The analysis covered Ethereum markets rather than every Pendle deployment, and excluded 160 markets that were not listed in the application’s interface, along with markets that had not yet expired.
Bitquery’s findings are therefore evidence about the historical performance of a defined group of yield-token markets, not an allegation that Pendle suffered a security breach or that its underlying smart contracts were exploited. The results also do not establish the complete economic return for every participant because off-chain rewards were excluded.
The numbers are striking, though Pendle itself is not accused of an exploit here. The investigation instead raises questions about how buyers price future rewards, particularly when points programs become a substantial part of the expected return.
The full Bitquery investigation of Pendle’s expired Ethereum yield-token markets provides the underlying methodology, wallet analysis and market-level comparisons.
Across the three developments, the immediate concerns differ. The OnRe and OKX cases involve counterfeit websites attempting to exploit established brands and user trust, without confirmed losses in the evidence reviewed. The Pendle investigation examines a much larger economic outcome, but one that must be interpreted alongside the off-chain rewards excluded from its calculations. In each case, the underlying evidence is more useful than the headline number alone.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.