Tracking Crypto Scammers Ahead of the 2026 World Cup

Key takeaways

• Scams remain one of the largest and most pervasive crypto crime typologies, with approximately USD 35 billion flowing to scam-linked wallets in 2025. These volumes stay persistently high because scammers continuously adapt their tactics, narratives, and delivery channels to find and exploit new victims.
• One of the most effective scam tactics is exploiting major global events. Ahead of the 2026 FIFA World Cup, TRM is already tracking multiple crypto scam typologies targeting fans, including fake ticketing sites, fixed-match betting schemes, scammers selling clone-ready phishing kits, and fan-branded meme coin promotions. Scammers seed fraud infrastructure weeks or months before major sporting events, then promote it aggressively as the date nears.
• The amounts received so far are small (under USD 1,700 across the initially identified scam addresses), and some infrastructure has not yet converted victims.
• Scammers routinely use cross-chain bridges and custodial exchange accounts to move proceeds away from initial receiving addresses. TRM has identified bridge activity in World Cup-related scams, reflecting a broader trend in which scammers have moved, in total, approximately USD 1.9 billion through bridges through all time to complicate tracing and maintain access to liquidity.
• As kickoff approaches, TRM expects additional typologies to emerge, including gambling scams, deepfake impersonation of FIFA figures and players, fake token launches, fake live-streaming sites, ticketing and accommodation fraud, and other event-driven social engineering campaigns.

{{horizontal-line}}

In 2025, roughly USD 35 billion flowed to fraud-linked wallets — part of a record USD 158 billion in total illicit crypto activity — with investment schemes driving 62% of fraud inflows, according to TRM’s 2026 Crypto Crime Report.

Scammers have always taken advantage of the excitement around major events, seeking to extract value from victims. Chainabuse community reporting data proves that this pattern holds, with sporting being a relatively small but consistent event type that scammers frequently take advantage of.

Ahead of the 2026 World Cup, TRM is already tracking several distinct crypto scam operations targeting fans, with more typologies expected to emerge as the tournament approaches. The total value received by these scammers is currently low and the incidents appear isolated, but it is expected that the volume and frequency of these scams will ramp up quickly as the tournament approaches.

How event-timed scams work

Consumer payment scams follow a consistent playbook: an operator stands up a website, builds a social-media presence, publishes a crypto receiving address, and works to convert traffic into deposits before the site is flagged and taken down. Sporting events like tournaments compress that cycle by producing concentrated demand spikes for tickets, accommodation, collectibles, and last-minute travel. Scammers price those spikes into their preparation timelines, building and seeding scam infrastructure weeks or months in advance, then promoting it aggressively in the weeks before kickoff.

Law enforcement cyber units have warned fans for months about World Cup-themed ticketing scams, counterfeit merchandise, and impersonation. Today, several cryptocurrency addresses have been identified as operational components of scam infrastructure that are taking advantage of the World Cup as an attack vector.

The scams already operating on-chain

Crypto payment scams leave traceable, immutable, on-chain footprints: every dollar received is observable, tied to a specific address, and dated.

Fake ticket scams and fixed-match betting scams carry the strongest on-chain evidence today — backed by the four addresses identified by TRM and tied to three live operations. Two further categories (scam-kit sellers and fan-branded meme coins) are also emerging — though are currently without confirmed addresses.

1. Fake World Cup ticket scams

Fake ticketing sites mimic official or resale vendors, advertise availability for high-demand matches, and ask for payment in crypto. TRM has identified several of these operations, a sample of which is shown below.

• Tickets I: A Polygon address, also deployed on Ethereum, reported to Chainabuse. The Polygon side received about USD 1,562, almost all of it in a single day on April 1, 2026 — consistent with a short promotional window or a rapid domain rotation. The Ethereum deployment received nothing.
• Tickets II: A Bitcoin address, reported to Chainabuse. The phishing site is still live, but the address has not converted a victim yet or received any on-chain payments.

2. Fixed-match betting scams

Fixed-match pitches promise insider knowledge of pre-arranged match outcomes in exchange for an upfront crypto payment.

TRM identified one such operation, tied to a Bitcoin address. It received small amounts of funds across four days between January and May 2026, in small individual payments consistent with one victim at a time. The receiving exchange address then routed victim payments into a custodial account rather than a self-hosted wallet.

3. Fan-branded “commemorative” meme coin listings ($WORLDCUP)

Meme coins listed on lower-tier exchanges and explicitly disclaimed as having no FIFA affiliation create a third pump-and-dump pathway distinct from the Pump.fun/Pumpswap signal channels. The $WORLDCUP token — listed on LBank as a “World Cup Commemorative Coin” and framed as a fan-made project — is the most prominent example identified to date.

The fan-made framing is a familiar pattern: explicit disclaimers of brand affiliation provide legal insulation for the issuer while the event timing supplies the speculative narrative needed to attract buyers. Holders are exposed to standard low-liquidity meme coin loss patterns when issuers and early holders exit, regardless of whether the project markets itself as legitimate. These listings appear on exchanges with lighter listing standards rather than tier-one venues, which itself signals the project’s risk profile to experienced participants.

How scammers use bridges to move funds, including World Cup scam proceeds

The amounts involved in these cases are modest, but the movement of funds follows patterns commonly seen in consumer crypto fraud. Rather than remaining at the receiving address, proceeds are typically routed through services that help operators move value across blockchain ecosystems or into accounts where funds can be withdrawn.

Both patterns are visible in the operations identified by TRM. Analysts traced funds from the Polygon ticketing-scam address through a series of cross-chain swaps that ultimately moved value onto the Tron network. In some cases, funds moved directly from Polygon to Tron; in others, they passed through Bitcoin before arriving on Tron. Separately, the fixed-match betting operation directs victim payments to an exchange deposit address, routing funds into a custodial exchange account.

The laundering patterns illustrate how scam operators use existing crypto infrastructure to move proceeds away from the original receiving address, complicating tracing efforts while preserving access to liquidity. Scammers in particular rely on cross-chain bridges to move scammed funds. Overall, over USD 1.9 billion in total scam funds have moved through bridges in this way, shown below. While there were peaks in this activity in 2025, bridge usage by scammers remains elevated and a key off-ramp for moving scammed funds.

Other scam typologies that could surface during the tournament

The operations above are the ones with on-chain evidence today. Based on what TRM observes around major global events, several more typologies are likely to appear as the World Cup approaches:

• Gambling and betting scams beyond fixed-match pitches: Fake sportsbooks and “guaranteed-return” betting pools that take crypto deposits and never pay out.
• Impersonation and deepfakes of FIFA officials, players, sponsors, and tournament brands: AI-generated video and audio promoting fake giveaways, ticket drops, or investment schemes. TRM has documented the rise of AI-enabled fraud and deepfake-driven impersonation across crypto scams.
• Fake token launches and pump-and-dumps: World Cup- or FIFA-themed tokens promoted around the event and designed to draw buyers before the operators sell into the demand.
• Fake live-streaming platforms: Sites offering free or cut-price match streams that harvest payment details or funnel users toward crypto payments.
• Ticketing, accommodation, and merchandise fraud: The event-driven staples — counterfeit tickets and jerseys, fake short-term rentals, and travel package scams that move onto crypto rails to evade chargebacks.

Protecting the public from event-timed scams

For law enforcement units staffing tournament-time fraud lines, exchange compliance teams watching for scam-tied inflows, and ticketing and travel platforms whose users are the targets, the operational signal is that the scam infrastructure exists today and can absorb far more volume than it is currently carrying.

One step forward is to screen transactions against reported addresses such as those in this report that are surfaced in Chainabuse. Those addresses can then also be screened against TRM’s broader scam-attribution dataset, and against the routing patterns (e.g. cross-chain swaps and custodial deposit address funnels). TRM expects additional addresses to surface as the tournament approaches.

For fans: only buy tickets through official channels, treat crypto-only payment demands as a red flag, and be wary of “guaranteed” outcomes or insider offers.

Methodology notes

Received-value figures are sourced from TRM’s address-asset daily volume dataset, summing incoming USD value across the Ethereum, Polygon, and Bitcoin chains for the four addresses identified by TRM analysts via Chainabuse reports. Cross-chain swap observations and custodial exchange attributions are from TRM’s address-attribution dataset. Category figures (2025 fraud flows, total illicit volume, fraud-typology and stablecoin shares) are from TRM’s 2026 Crypto Crime Report. Data current as of June 8, 2026.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What types of scams is TRM already seeing ahead of the World Cup?

To date, TRM has observed three distinct operations tied to four crypto addresses: two fake-ticketing sites and one fixed-match betting pitch. All three were reported to Chainabuse and validated against TRM’s on-chain attribution data.

2. Why are the amounts received so small?

Scam infrastructure is often launched and rotated quickly to evade detection, so individual receiving addresses are short-lived. Also, consumer fraud at this stage aggregates many small payments from individual victims rather than producing one large loss. Two of the four addresses have received nothing yet — but they are positioned and live, waiting for traffic.

3. What should I do if I’ve fallen victim to one of these scams?

Report it. File a report on Chainabuse, notify your national law enforcement authority (e.g. in the US, the FBI’s Internet Crime Complaint Center), and preserve everything, including transaction IDs, wallet addresses, screenshots, and any communications with the scammers. On-chain reports help investigators trace funds across blockchains and, in some cases, work with exchanges to freeze them before they are cashed out.

4. What can compliance teams and law enforcement do to protect consumers?

Screen transactions against the addresses in Chainabuse reports, against TRM’s broader scam-attribution dataset, and against routing patterns like cross-chain swaps and custodial deposit address funnels. TRM expects additional addresses to appear as the World Cup approaches.