Thirteen Mirrors and a 'Receive Node' Button: How the Worldex Fake Exchange Asked Wallets for Unlimited USDT

BlockintAI · 2026-10-20T18:28:14.667Z

BlockintAI research. Site content and code are as the sites served them on Monday, October 19, 2026, between 10:20 PM and 10:55 PM Central Time (CT). Registration (RDAP), DNS and live checks were re-run on Tuesday, October 20, 2026, at 7:09–7:10 AM CT; the FDIC and Japan FSA register checks at 7:10 AM CT. Times are CT unless marked UTC; registration dates are UTC.

On the mobile version of a crypto exchange called Worldex, the first thing you saw was a green button at the top of the screen. It said "Receive Node." Next to it was a second one: "Link wallet."

Underneath was a banner written in the voice of World (formerly Worldcoin): "For every human. Privacy-first. Owned by everyone." Then a scrolling headline, "INTRODUCING WORLD ID," and a market list that led with WLD, World's token.

Worldex was a fake exchange, running on 13 domains at once, each serving exactly the same files. Its homepage promised FDIC insurance. Its About page reused Worldcoin's 2023 homepage text with the name changed. And the code behind "Receive Node" asked the visitor's wallet for something most people would never knowingly hand over: permission for an address chosen by the site's server to take an unlimited amount of the wallet's USDT, whenever it liked.

BlockintAI reported the network on the evening of October 19. By 2:32 AM CT on October 20, all 13 domains were on hold.

Key facts

Thirteen sites, one set of files

Worldex never lived at a single address. The same site answered at 13 domains:

• At Name SRS AB: dappworldexllc[.]com, dappworldexbit[.]com, dappworldexgos[.]com, dappworldexinc[.]com, dappworldexitco[.]com, dappworldexitig[.]com, dappworldexitin[.]com, dappworldexitmg[.]com, dappworldexituk[.]com, dappworldexltd[.]com
• At Gname: worldexllc[.]com, worldexgos[.]com, worldexins[.]com

These weren't copies that drifted apart over time. On the night of October 19, every one of the 13 served the same homepage file, the same desktop app and the same mobile app, down to the byte. The homepage's SHA-256 fingerprint was identical on all of them. So was the fingerprint of the mobile script that holds the "Receive Node" code.

The registration records show how they were bought.

In bulk, by the second. The ten dappworldex names were registered at Name SRS AB, through Gname as a reseller, on April 5, 2026, all inside three seconds, from 10:28:13 to 10:28:16 UTC. All ten were last modified on June 4, 2026, within the same few seconds. The three worldex names at Gname are tighter still: worldexllc[.]com, worldexgos[.]com and worldexins[.]com were all registered at exactly 13:46:09 UTC on March 9, 2026. Nobody types ten domain orders in three seconds by hand.

Certificates in batches. Public certificate logs show one Let's Encrypt certificate, issued September 2, 2026, that covers the www name of all ten dappworldex domains. Another, issued August 6, 2026, covers all three worldex names.

Names built for swapping. The dappworldex suffixes read like a menu: llc, ltd, inc, bit, gos, itco, itig, itin, itmg, ituk. A set like that lets an operator hand out a fresh link whenever an old one gets flagged, without changing anything a victim sees.

One hosting chain. None of the domains pointed straight at a server. Each www name was an alias for a host on a content-delivery network, 135cdn[.]com, which in turn pointed to jiulong176[.]com and then to the same 14 Google Cloud addresses in Google's Frankfurt region (dappworldexgos took a slightly different route, via tdunv1[.]com, to the same servers). Every response carried the header Server: Xcdn. Shortly before the reports went in, worldexllc[.]com was moved to a different 135cdn host with 20 Google Cloud addresses in the U.S.; the files stayed the same.

What the site claimed

"Covered by FDIC insurance"

Halfway down the homepage sat three reasons to trust Worldex. One was labelled "Insured":

"Worldex maintains encryption insurance, and all dollar cash balances are covered by FDIC insurance, up to 250000 dollars."

FDIC insurance covers deposits at FDIC-insured banks. The FDIC's public BankFind database lists every one of them, and a search for an institution named "Worldex" returns nothing. We ran that search again at 7:10 AM CT on October 20, 2026, both as an exact name and as a prefix: zero results. (The same search for "Chase" returns 43, so the search works.) The site names no partner bank that might hold customer money. The FDIC claim has nothing behind it.

The site's own code shows how little thought went into the line. Its French translation of the same sentence credits a company called "Demo." The Indonesian one credits "ActisEx." Those are leftovers from whatever brand the template carried before it was relabelled Worldex.

World's words, with the name swapped

The About page opened with a big headline: "THE GLOBAL ECONOMY BELONGS TO EVERYONE." Then:

"Worldex is building the world's largest identity and financial network as a public utility, giving ownership to everyone."

That is Worldcoin's text, from before the project renamed itself World. The Internet Archive's copy of worldcoin.org from May 1, 2023 reads, sentence for sentence, the same: "The global economy belongs to everyone. Worldcoin is building the world's largest identity and financial network as a public utility, giving ownership to everyone. We aim to create universal access to the global economy regardless of country or background…" Worldex kept the "We believe" lines ("in the inherent worth and equality of every individual," "in the right to personal privacy," "in open and public collaboration") and the "How it works" blurbs for World ID, the token and World App, changing "Worldcoin" to "Worldex" each time.

It went further than borrowing a mission statement. A "Who we are" paragraph described a "Worldex Foundation" and said "Tools for Humanity helped launch Worldex," linking to World's and Tools for Humanity's real websites. The mobile banners recycled two 2023 Worldcoin announcement headlines, now on World's blog, with the name changed: "Worldcoin has passed 1 million sign-ups" (January 13, 2023) became "Worldex HAS PASSED 1 MILLION SIGN-UPS," and "Worldcoin commits to Optimism's Superchain vision ahead of mainnet launch" (May 11, 2023) became "Worldex COMMITS TO OPTIMISM'S SUPERCHAIN VISION AHEAD OF MAINNET LAUNCH."

The point of this is the same as a fake Coinbase logo. Someone told to "look it up" finds a large, well-known crypto project with a real token and years of news coverage, and a site that seems to speak in its voice.

Numbers that don't agree with each other

The homepage boasted "$217B Quarterly trading volume," "103M+ Authenticated user" and "100+ Supported countries." The mobile banner said the platform had just passed one million sign-ups. The About page showed a running counter that read 2,281,172 "sign-ups" when it was captured at 10:36 PM CT on October 19. And the same About page said the whole thing was "Currently in beta" and "expects to launch in the Second half of the year 2026."

An exchange can't have 103 million verified users and $217 billion a quarter in trading while it's still in beta, waiting to launch. The numbers are decoration.

A licence claim tucked into the code

The site's code also carries a second "About us" text that the rendered About page never displayed, so visitors were not shown it. It claims that "the Worldex group has obtained digital asset service licenses in many countries and regions around the world" and has "established regulated entities in Japan, South Korea, Gibraltar and many other countries and regions." Japan publishes its register of crypto-asset exchange service providers. Worldex isn't on the Financial Services Agency's English list, current as of September 30, 2026.

The button: what "Receive Node" actually did

The mobile site's code is public: any browser that loads the page downloads it. Here is what it shows, step by step.

1. "Link wallet" asks a browser wallet (such as one in a wallet app's built-in browser) to connect, then has the wallet sign a login message supplied by the server. On its own, that's an ordinary wallet login.

2. "Receive Node" is the button that matters. When pressed with a wallet connected, the page asks the Worldex server for a small bundle of instructions: a spender address, a gas price, a gas limit and a status code.

3. If the server's status code says go, the page builds a transaction on the Tether USDT contract on Ethereum (0xdac17f958d2ee523a2206206994597c13d831ec7, which Etherscan tags "Tether: USDT Stablecoin"). It calls approve(), naming the server's spender address and this amount:

   11579208923731619542357098500868790785326998466564056403945758400791312963993

4. The wallet pops up a request to sign. The moment it is signed and broadcast, the page sends the transaction hash back to the server. When the transaction confirms, it reports in again, and the button's label changes. The labels built into the code, translated from the Chinese, run: "Confirming," "Account opened," and, if something goes wrong, "Abnormal authorisation, re-join."

That 77-digit number is in USDT's smallest units (USDT has six decimal places). It works out to about 1.16 × 10^70 USDT: a number with 71 digits before the decimal point, and about one-tenth of the largest value the contract can store. No one could ever hold that much USDT. In practice it means no limit at all.

The spender isn't in the page. It arrives from the server at the moment of the click, which means the operator can change it at will and a visitor can't check it in advance.

The page itself never moves anyone's money. It doesn't have to. Once the approval is on the blockchain, the spender can pull USDT out of the wallet later, from anywhere, without asking again.

This matches a pattern the FBI warned about in a July 2022 public service announcement on "liquidity mining" scams. Victims, it said, are told to connect their wallet "by clicking a button to receive a so-called mining certificate, voucher, or node," and by accepting the permissions "unknowingly authorize scammers to pull an unlimited amount of funds out of their cryptocurrency wallets." Worldex's menus carried the same vocabulary: "Smart pool" on the mobile site, and "Mining Pool lock … Serve the miners and improve mining income" on the desktop site.

What an unlimited token approval lets someone do

Tokens like USDT have a built-in permission system. When you approve an address, you tell the token contract: "this address may move up to X of my tokens." The approved address, called the spender, can then call the contract's transferFrom function and move your tokens to anywhere it wants, up to that limit, without any further signature from you.

Legitimate apps use this every day. A decentralised exchange needs it to swap your tokens. But an unlimited approval to an address controlled by a scam operator means:

• It doesn't expire. As ethereum.org's guide puts it, "There are no expiration dates on contract permissions." An approval granted today can be used next year.
• It covers future money too. The spender can take whatever USDT is in that wallet now, and any USDT you put there later.
• Disconnecting doesn't cancel it. Logging out of the site, deleting its app or "disconnecting" your wallet from it leaves the approval in place on the blockchain.
• It can sit unused. A scam can show a growing balance on a fake dashboard for weeks, encouraging more deposits, and empty the wallet later.

The only thing that ends an approval is revoking it: sending a transaction that sets the allowance back to zero.

How to check and revoke your approvals

If you've connected a wallet to a site you now doubt, check it. Viewing approvals is free:

1. Look up your wallet. Go to revoke.cash or Etherscan's Token Approval Checker and enter your wallet address. Both list every token approval the address has granted, with the spender and the amount. Type the address of these tools yourself; scammers run fake "revoke" sites too.
2. Find anything you don't recognise, especially an "Unlimited" allowance for USDT (or USDC, or any token you hold) to a spender you can't identify.
3. Revoke it. Connect the wallet that owns the approval and press Revoke. Your wallet will ask you to sign a transaction. The tools don't charge for this, but the transaction costs a small network fee in ETH. Refresh afterwards to make sure the allowance shows zero.

ethereum.org's guide, "How to revoke smart contract access to your crypto funds," walks through the same steps and lists other free tools, including Blockscout. If tokens have already been taken, revoke anyway so nothing else can go. Then move whatever is left to a new wallet, and write down the transaction hash of every transfer you didn't make. Investigators will need them.

Shared plumbing

The 135cdn[.]com and jiulong176[.]com chain that served Worldex wasn't exclusive to it. At 7:09 AM CT on October 20, the www name of ceexbe[.]com still pointed through kun888.cdn.135cdn[.]com and xkk.eu.jiulong176[.]com to the same 14 Google Cloud addresses, although it didn't answer on HTTPS.

ceexbe[.]com is named in an entry in California's DFPI Crypto Scam Tracker, filed under "Fraudulent Trading Platform" and "Pig Butchering Scam." Two California residents describe the platform, which ran at ceexbe[.]com and ceexapp[.]com. One got a message from "Daniel" that seemed to arrive by mistake; over months Daniel built a relationship, talked up his crypto profits and set up an account in the victim's name. The other got a "wrong number" text that led to an ongoing relationship and a trading "app" installed as a web clip; when they tried to withdraw, the platform demanded a "VIP" upgrade with a minimum cumulative deposit of $18,000. That resident reported losing more than $13,000.

A content-delivery network sells capacity to many customers. What the overlap shows is that Worldex and CEEX sat on the same delivery infrastructure.

Where things stand

BlockintAI reported the 13 domains on October 19, 2026: to Name SRS AB by email at 10:57 PM CT, to Gname through its abuse form between 11:01 and 11:04 PM CT, and to Google Cloud, Google Safe Browsing and Netcraft between 11:05 and 11:10 PM CT.

Registration records show what happened next:

• All ten Name SRS domains were placed on hold (status client hold) between 1:45 and 1:47 AM CT on October 20, under three hours after they were reported.
• The three Gname domains went on hold between 2:12 and 2:32 AM CT, within about three and a half hours of being reported.

A domain on hold stops resolving, so none of the 13 loads in a browser any more.

The holds take down these names, not the operation behind them. The kit is built to run on many domains at once, and the delivery network behind it is still up. A new set of names with the same files would look exactly the same to a visitor.

Red flags in the Worldex playbook

• A button that promises something for connecting your wallet. "Receive Node," "claim your voucher," "join the mining pool": any button that hands you a reward for signing a wallet request is asking for a permission, not giving you a gift.
• A wallet pop-up that says "approve," "allow" or "spending cap." Read it before you sign. If it names a token you hold and an amount you didn't choose, or says "unlimited," reject it.
• FDIC claims from a crypto platform. FDIC insurance covers deposits at insured banks. Search the name in the FDIC's BankFind; if nothing comes up, the claim is false.
• A famous project's words on an unfamiliar site. Worldex used Worldcoin's 2023 mission statement and headlines. A brand's text proves nothing about who runs a site.
• Numbers that contradict each other. 103 million users and "still in beta" can't both be true.
• The same site at many addresses. If the "official" link you were given keeps changing, or a search turns up near-identical domains, you're looking at a mirror set built to outlast takedowns.
• Licence claims you can't find. Regulators publish registers. Japan's FSA lists every registered crypto-asset exchange; look the platform up before you believe it.
• "Recovery" offers. Anyone who contacts you offering to get drained funds back for a fee is running the next scam.
• Report it. In the U.S., report fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Elsewhere, report to your national police cybercrime unit. If you've been scammed, you can also file a report at blockint.ai with the website, the approval or transfer transaction hashes and anything the site or its contacts told you; it is free, and anonymous reports are accepted.

#CryptoScam #Drainer

Related BlockintAI reading

• Fourteen Domains, One Template: How the FXO Fake Broker Kept Moving
• AXIO / Benthorne fake exchange kit
• Svgweb / Rockie fake exchange kit

Sources

Registration, certificates and DNS

• RDAP registration records (checked Oct 20, 2026, 7:09 AM CT), e.g. dappworldexllc[.]com, dappworldexituk[.]com, worldexllc[.]com, worldexins[.]com, worldexgos[.]com
• CertSpotter certificate logs: dappworldex certificate, Sept 2, 2026; worldex certificate, Aug 6, 2026
• DNS over HTTPS (Google Public DNS), Oct 20, 2026, 7:09 AM CT: www.dappworldexllc[.]com (no answer); www.ceexbe[.]com (135cdn/jiulong176 chain)
• Google Cloud published IP ranges (region lookup): https://www.gstatic.com/ipranges/cloud.json

Claims checked

• FDIC BankFind, institution search for "Worldex" (0 results, Oct 20, 2026, 7:10 AM CT): https://api.fdic.gov/banks/institutions?search=NAME:Worldex and the BankFind Suite: https://banks.data.fdic.gov/bankfind-suite/bankfind
• Japan Financial Services Agency, "List of Registered Crypto-asset Exchange Service Providers in Japan," as of Sept 30, 2026: https://www.fsa.go.jp/en/regulated/licensed/en_kasoutuka.pdf
• Internet Archive copy of worldcoin.org, May 1, 2023: https://web.archive.org/web/20230501225444/https://worldcoin.org/
• World, "Worldcoin has passed 1 million sign-ups. Here's what's next," Jan 13, 2023: https://world.org/blog/announcements/worldcoin-passed-1-million-sign-ups
• World, "Worldcoin commits to Optimism's Superchain vision ahead of mainnet launch," May 11, 2023: https://world.org/blog/announcements/worldcoin-commits-optimism-superchain-vision-ahead-mainnet-launch

Token approvals

• Tether USDT contract on Ethereum (Etherscan tag "Tether: USDT Stablecoin"): https://etherscan.io/address/0xdac17f958d2ee523a2206206994597c13d831ec7
• FBI IC3 public service announcement, "Scammers Target and Exploit Owners of Cryptocurrencies in Liquidity Mining Scam," July 21, 2022: https://www.ic3.gov/PSA/2022/PSA220721
• ethereum.org, "How to revoke smart contract access to your crypto funds" (updated June 6, 2026): https://ethereum.org/guides/how-to-revoke-token-access/
• Revoke.cash: https://revoke.cash
• Etherscan Token Approval Checker: https://etherscan.io/tokenapprovalchecker

Shared infrastructure

• California DFPI Crypto Scam Tracker, entry "ceexbe[.]com ceexapp[.]com": https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/