Fake BlockFi Refund Website: How a Crypto Claims Email Led to a Reported $250,000 Theft
Publication date: October 31, 2026
A message promising access to a cryptocurrency refund can arrive at exactly the moment someone is most vulnerable: when they are trying to recover money they believe is already owed to them.
That urgency is something cybercriminals can exploit.
The California Department of Financial Protection and Innovation (DFPI) has published a consumer complaint involving a website at withdrawal.choice-blockfi.com. According to the complaint, a California resident received an email containing a link to the site and believed it would provide access to BlockFi’s refund claims program. After entering login information to validate a cryptocurrency account, the resident reported that more than $250,000 in Polygon and Ethereum assets was stolen.
The DFPI specifically cautions that the domain should not be confused with BlockFi or its efforts to administer refund claims. The reported website is no longer active.
This case illustrates an important cybersecurity risk: scammers do not always need to persuade someone to invest in a new platform. Sometimes, they only need to make a fraudulent website look like a legitimate recovery or claims portal.
For anyone dealing with a cryptocurrency bankruptcy claim, exchange closure, or unresolved digital-asset dispute, understanding this distinction can help prevent a second loss.
The reported BlockFi claims impersonation incident
The DFPI’s Crypto Scam Tracker identifies withdrawal.choice-blockfi.com as an entity impersonating BlockFi.
According to the consumer complaint, the incident began with an email containing a link to the website. The recipient believed the page was connected to BlockFi’s refund claims process and followed the instructions presented there.
The website reportedly requested login information to validate the consumer’s cryptocurrency account. After the information was entered, the consumer reported losing more than $250,000 in Polygon and Ethereum assets.
The DFPI describes the incident as an imposter scam involving hacking. It also makes clear that the suspicious domain was not BlockFi and was not part of BlockFi’s refund-claims administration.
There are several important details to separate:
- The website:
withdrawal.choice-blockfi.com, identified by the DFPI as an impersonation domain. - The contact method: An email containing a link to the purported claims portal.
- The requested information: Login credentials intended to validate a cryptocurrency account.
- The reported outcome: More than $250,000 in Polygon and Ethereum assets stolen.
- The website’s status: The DFPI reports that the domain is no longer active.
These details come from a consumer complaint recorded by the DFPI. They should not be interpreted as a court judgment or a finding that BlockFi itself was involved. The department expressly distinguishes the suspicious website from BlockFi’s claims activities.
Why refund and claims scams are particularly dangerous
People attempting to recover cryptocurrency may already have experienced financial disruption. They may be waiting for a claim decision, trying to understand a bankruptcy distribution, or searching for information about an exchange’s repayment process.
A fraudulent website can exploit that situation by presenting itself as an administrative step in a process the consumer already recognizes.
The approach may look convincing because it uses familiar language:
- Refund eligibility
- Account validation
- Withdrawal authorization
- Identity confirmation
- Claims processing
- Wallet verification
- Distribution status
These terms can appear in legitimate financial and administrative procedures. Their presence alone does not prove that a website is genuine.
The danger arises when a person is directed to an unverified domain and asked to disclose credentials, recovery information, private keys, or other sensitive account details.
A claims portal should never be trusted simply because it uses a familiar company name or appears in an email that looks official.
How a fraudulent claims portal can compromise a crypto account
A fake claims website may be designed to resemble a legitimate login page. Its purpose can be to collect information that gives an attacker access to an account or helps them impersonate its owner.
A common phishing sequence can involve several stages.
1. A convincing message creates urgency
The recipient receives an email claiming that a refund, distribution, or account verification step is available. The message may encourage immediate action by suggesting that a claim could be delayed or lost.
2. The recipient follows an unfamiliar link
Instead of independently navigating to the company’s verified website, the recipient clicks a link supplied in the message. The destination may contain a recognizable brand name alongside additional words, punctuation, or unfamiliar domain extensions.
3. The fake page requests account information
The website asks the visitor to enter login credentials or other information under the pretext of validating an account. The page may copy the appearance of a legitimate service.
4. The information is captured
Information entered into a fraudulent page may be collected by the operator. Depending on what was disclosed, an attacker may attempt to access the account, impersonate the account holder, or obtain additional information.
5. Cryptocurrency may be transferred
If an attacker gains sufficient access, digital assets may be moved to wallets they control. Blockchain transactions can be publicly visible, but that does not automatically reveal the real-world identity of the person controlling a receiving wallet.
The DFPI complaint does not establish every technical step used in the reported incident. This sequence describes a general phishing risk, not a verified reconstruction of the specific attack.
Warning signs to recognize before opening a refund link
A website does not become legitimate because it displays a company’s logo, uses professional language, or contains a familiar brand name.
Before entering any information, examine the destination carefully.
An unfamiliar domain
A domain containing a company name is not necessarily owned or operated by that company. In the reported incident, the address withdrawal.choice-blockfi.com was identified by the DFPI as an impersonation domain.
An unexpected email
Be cautious when a message about a refund or withdrawal arrives unexpectedly, especially if you were not already communicating with the sender through a verified channel.
Requests for login credentials
Do not enter account passwords into a page reached through an unsolicited email. Independently navigate to the official service using a verified address.
Requests for private keys or recovery phrases
Never disclose a wallet’s private key or seed phrase to someone claiming to validate a refund, verify ownership, or release cryptocurrency.
Pressure to act immediately
Threats that a claim will expire, a refund will be cancelled, or funds will disappear unless you act immediately are reasons to stop and verify the message.
Unexpected payments
A demand for an additional cryptocurrency deposit, release fee, or wallet-validation payment should be independently investigated. Do not assume that a payment request is legitimate because it appears inside a claims portal.
What to do if you clicked a suspicious crypto refund link
If you have visited a suspicious website but have not entered any information, close the page. Do not download files, connect a wallet, or follow further instructions from the sender.
If you entered login credentials, take action promptly:
- Use a trusted device. Avoid continuing to interact with the suspicious website.
- Change affected passwords. Access the genuine service independently and change the compromised password. Change it anywhere else it was reused.
- Secure your email account. Email access can be used to reset other accounts. Review recovery details, active sessions, and forwarding rules.
- Enable stronger authentication. Use a supported multifactor authentication method and review existing authentication devices.
- Contact the legitimate provider. Use contact details obtained independently from its verified website or official communications.
- Preserve evidence. Keep the original email, full sender address, message headers, suspicious URL, screenshots, timestamps, and any transaction records.
- Contact the relevant exchanges. If cryptocurrency was transferred, promptly notify the exchanges or services involved and provide transaction details.
- Report the incident. Consider reporting it to the appropriate financial regulator and law-enforcement agency.
If a wallet’s seed phrase or private key was exposed, treat that wallet as compromised. Moving remaining assets to a newly created secure wallet may be necessary. Do not use a recovery phrase on the suspicious website again.
Preserving blockchain evidence after cryptocurrency theft
When cryptocurrency is stolen, transaction information can become important evidence. The first priority is to preserve the available records before accounts, websites, or messages become inaccessible.
Useful evidence may include:
- The transaction hash for each suspected unauthorized transfer.
- The sending and receiving wallet addresses.
- The blockchain network involved, such as Ethereum or Polygon.
- The date and time of each transaction.
- Exchange withdrawal confirmations and account statements.
- Screenshots of the suspicious website and its login process.
- The original phishing email, including its headers.
- Communications with anyone who claimed to administer the refund.
- Records of any subsequent contact or payment demands.
A transaction hash can help an investigator locate a transfer on the relevant blockchain. Wallet addresses can be examined for transaction history and potential links to other addresses or services.
However, a visible transaction does not by itself establish who controlled a wallet, where the funds ultimately went, or whether the assets can be recovered. Those conclusions require careful analysis and supporting evidence.
Cyb3rsect’s investigative approach emphasizes preserving original records and distinguishing confirmed blockchain activity from assumptions about the people or organizations behind it. Readers can also review our guides on Blockchain Transaction Tracing, Digital Evidence Preservation, and Crypto Recovery Scam Investigation when preparing records for an investigation.
Be careful of a second scam after the first loss
People who lose cryptocurrency may subsequently receive messages from individuals claiming to be recovery specialists, investigators, attorneys, or representatives of financial institutions.
Some may claim to have located the stolen assets or promise that a refund can be released after a payment.
This creates another opportunity for exploitation.
A person who has already experienced a loss should be particularly cautious about anyone who:
- Guarantees that stolen cryptocurrency will be recovered.
- Demands an upfront payment before explaining the proposed work.
- Claims to have privileged access to a blockchain or exchange.
- Requests private keys, seed phrases, or remote access to a device.
- Uses an unfamiliar website to collect identity or account information.
- Claims to represent a regulator, court, exchange, or bankruptcy administrator without verifiable authorization.
A legitimate investigation can examine available evidence and explain what can and cannot be established. It should not promise a guaranteed recovery outcome.
For more information, see our guide to Recognizing Cryptocurrency Recovery Scams and our article on How to Trace a Cryptocurrency Wallet.
How Cyb3rsect approaches suspected crypto phishing incidents
A suspected refund-portal impersonation incident may involve more than a single fraudulent webpage. Relevant evidence can include the original email, domain information, login activity, device records, exchange transactions, and blockchain movements.
A structured investigation can help establish a timeline and identify which evidence is available for further examination.
Depending on the incident, investigative work may include:
- Reviewing suspicious domains and website content.
- Examining phishing emails and message headers.
- Organizing transaction hashes and wallet addresses.
- Mapping relevant blockchain movements.
- Reviewing screenshots, account records, and communications.
- Preparing a documented evidence timeline.
Cyb3rsect provides cybersecurity and digital-investigation assistance for people seeking to understand suspicious online activity and cryptocurrency transactions. The purpose of an investigation is to establish what the evidence supports, identify relevant leads, and explain practical next steps—not to guarantee that funds can be recovered.
If you believe you have interacted with a fake refund portal, preserve the original evidence and avoid making additional payments until the situation has been independently assessed.
Final thoughts: Verify the claims process before trusting the link
The reported withdrawal.choice-blockfi.com incident is a reminder that cryptocurrency recovery efforts can attract impersonation and phishing attempts.
A familiar company name in a web address is not proof of authorization. An email claiming that a refund is ready is not proof that a claim exists. And a website requesting account validation should never be trusted without independent verification.
The safest approach is to access claims information through verified channels, protect account credentials, and preserve evidence immediately if something appears suspicious.
For people facing a potential cryptocurrency theft, careful documentation and independent verification are essential first steps. Cyb3rsect encourages anyone dealing with a suspicious claims portal or unauthorized crypto transaction to prioritize account security and evidence preservation before taking further action.
