FTX scam: what it is, how the fake FTX claim e-mails work and what to do

The exchange's collapse involved fraud that a US court has ruled on. The Department of Justice says a jury convicted founder Samuel Bankman-Fried on seven counts and that he misappropriated billions of dollars of customer money, and he was sentenced to 25 years in March 2024 according to news coverage.

That is about the old company. The FTX Recovery Trust, which pays creditors, is a different thing, and the claims process is real. What is a scam is the set of fake messages that borrow the name to steal claim payouts and wallets, covered on this page.

Do not decide from the e-mail itself. FTX warned in October 2025, as reported, that phishing e-mails look like they come from Kroll or the FTX Recovery Trust. Close the message without clicking and type claims.ftx.com into the address bar yourself.

If your claim and the news are not there, the e-mail is not reliable. A real notice will be on the official site. Personal detail proves nothing, because claimant data was exposed in the Kroll breach of August 2023.

They promise a recovery, in the reported October 2025 wave 118 to 142 percent of your claim value, and send you to a site that copies the FTX customer portal. The page asks you to log in, verify your identity or connect a wallet.

The reported pages used lookalike domains such as clientid-ftxclaims[.]com and a supposed partner called Digital Disbursements. The Trust says it will never ask you to connect your wallets. What you type or approve goes to the scammer.

If you only opened the page and entered nothing, close it and do not open any file it offered; nothing was taken by looking. If you entered a password, change it from a trusted device and turn on two step sign in with an authenticator app.

If you entered a seed phrase or connected a wallet, move your funds to a new wallet at once, because the old one is no longer safe. Report it at ReportFraud.ftc.gov if you are in the US.

If you had an FTX claim in 2023, some of your details may have been. Kroll said an attacker took over an employee's phone number by a SIM swap on 19 August 2023 and reached files with claimant information.

FTX said these held names, addresses, e-mail addresses and balances; Kroll's later letters, as reported, added phone numbers, claim numbers, account IDs and, for some, dates of birth. Check any letter you received, and treat messages that quote your balance with care.

Nothing in the sources we read says these messages install a program. The harm described is stolen logins, seed phrases and wallet permissions. A link can still lead to a download on a bad page, and we did not open the fake pages, so we cannot say none of them do.

Do not open attachments and do not install anything a claims page asks for. If you did, run a full scan with the security software built into your device and keep your seed phrases off it.

Often not, and crypto transfers cannot be cancelled like a card payment. Report the loss to your exchange, to your bank if a card or transfer was used, and to the police, and file a report with ReportFraud.ftc.gov if you are in the US.

Be careful of anyone who contacts you offering to recover the money for an upfront fee: that is a known second scam. Your genuine FTX claim is separate, and only the official claims site can tell you its status.

Do not use anything inside the message. Type claims.ftx.com into your browser yourself, sign in there and look for the same notice. FTX names BitGo, Kraken and Payoneer as distribution partners for payouts, according to coverage of the 2026 notice, so a different partner is a warning sign.

The Trust says it never asks you to connect a wallet. Anyone asking for a seed phrase, a fee or an urgent verification is not the Trust.

In the US, report at ReportFraud.ftc.gov, the FTC's reporting site, and if personal information was taken use IdentityTheft.gov for a recovery plan. Outside the US, use your national fraud or cybercrime reporting service or your financial regulator.

Also report the loss to your exchange or bank. Include the sender address, the link text (do not click it) and the date. This helps others, but we cannot promise that a report will lead to getting money back.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For FTX scam, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.