How to Tell If a Crypto Exchange App or Website Is Real: Official Verification Tools, App Developer Names, Anti-Phishing Codes and a Checklist

Fake exchange apps and phishing websites are among the most common ways into a crypto scam. This post covers how to tell whether an exchange app or website is real: checking addresses and accounts with the exchange’s official verification tool, checking the app developer name before you download, using an anti-phishing code to tell real messages from fake ones, and what phishing addresses usually look like. A checklist closes it out.

The short version: type the official site in yourself once and bookmark it, reach the app through the download page on the official site, and run any suspicious address or account through the exchange’s official verification tool. A verification tool can only show that “this address or account belongs to the exchange”. It cannot prove that an email or a screenshot is genuine. For emails, look for the anti-phishing code, and if someone claiming to be official asks you to transfer coins or hand over a verification code, treat it as a scam.

This post is a compilation of information and is not investment or legal advice. Each exchange’s verification tools, addresses and app store listings may change. Every source in this post is marked with the date I checked it (2026-10-16); before relying on any of it, check the exchange’s official pages at that time.

Check addresses and accounts with the exchange’s official verification tool

Most large exchanges have an official verification tool that tells you whether a website address, email, phone number or social media account is official. I put the table below together on 16 October 2026 from each exchange’s page. The verification tools themselves can also be faked, so type the official site into your browser yourself and open the tool from the footer or the help center. Do not click a “verification link” someone sent you.

KuCoin, Gate, MEXC, BingX and WEEX have similar tools. Their addresses are in the comparison table in “Crypto Scam Playbooks in the Chinese-Speaking World”.

Signs of a fake admin, according to OKX

OKX’s help page (updated 2026-09-01) lists these as signs the person may be a fake admin:

• The username cannot be found through official channel verification.
• They message you first.
• The username contains at least one number.
• The admin details they share do not match those in the official group.
• They claim to have proof of verification, but the account details cannot be found.
• They charge you any fee, such as a listing fee or a “refundable deposit”.

On Telegram, check an admin’s username in the username field. OKX says an account with no username, or with the name written in the bio, may be fake.

What verification tools cannot tell you

• Whether an email or text message is genuine. Bybit warns that sender addresses are easy to spoof. Even if the sending domain looks right, for example the official sending domains listed on OKX’s help page (@okx.com, @mailer1.okx.com, @mailer2.okx.com, @service2.okx.com), you still need the anti-phishing code to judge (see below).
• Whether the request makes sense. The Binance Verify page states that verification only helps confirm identity and does not authorize any action. A genuine official account will not privately ask you for funds, passwords or verification codes either; the official pages of Binance, OKX and Bybit all carry a similar “we will never do this” message.

Check the developer name before downloading an exchange app

Developer names for four exchanges in the official stores

The table below shows the listings I found on 16 October 2026 (App Store checked in the Taiwan, Hong Kong and Singapore storefronts; Google Play checked in Taiwan). The App Store numeric ID and the Google Play package name are the fixed identifiers in the store URL, and they are more reliable than the app name.

OKX’s iOS download guide (updated 2026-08-25) states that the developer of the official iOS app is “OKX Inc.” and that any other developer is an imitation. For Binance, Bybit and Bitget I did not find an official help page that spells out the developer name in the same way; the table shows what I found in the stores.

The table shows three things:

• The developer name is not always the exchange name. Bitget’s developer is BG LIMITED, and Binance appears on the App Store as Binance Switzerland AG. Checking whether “the exchange’s name is in the developer name” is not enough.
• The same exchange may use different names in the two stores. Binance shows as Binance Inc. on Google Play, and Bybit shows only as “Bybit” on Google Play.
• One brand may have several apps from different developers. On the App Store, OKX Wallet’s developer is OKX Technology Inc and Bitget Wallet’s is BitKeep Global Inc.; searching for Binance in the US storefront brings up Binance.US, whose developer is BAM Trading Services, Inc.

So the safest approach is to reach the store from the download page on the exchange’s official site and check the developer name and ID once more, rather than searching the store and tapping the first result. Binance’s article on spotting fake apps from 21 February 2023 also warns that fake listings occasionally appear in the official stores too.

Other warning signs you can see on the store page

The same Binance article lists several things to check:

• Developer information: whether it gives a real company, email or website, and then confirm online that these belong to the official company.
• Reviews: be suspicious of an unusual number of either negative or positive reviews. Widely used apps usually have many downloads and have been listed for years; a new listing with lots of reviews and downloads is a warning sign.
• Permissions: fake apps often ask for unnecessary permissions after installation, so read the privacy policy before installing.
• Test with a small amount first: fake apps often swap the deposit address for the scammer’s, so before a large transfer, test deposits and withdrawals with a small amount.

Android: get the APK only from the official site

When you need to install an APK directly, where the file comes from is the part most likely to go wrong. OKX’s Android download guide (updated 2026-09-02) says:

• Do not install from chat groups, search ads, cloud drives, third-party APK sites or links sent by strangers.
• Get the APK link from the official download page on okx.com: choose Android, then use “copy APK download link” in the download FAQ; before downloading, confirm that the site belongs to okx.com. If the official link is temporarily unavailable, you can email download@okx.com or contact official customer support.
• If the page, the installer, the developer information, the permissions requested or the login flow looks suspicious, stop. Do not enter passwords, verification codes, seed phrases or private keys.

What phishing addresses usually look like: an extra word, a hyphen, a different domain ending

An FBI warning dated 21 December 2022 notes that fake domains often differ only by one misspelled word or one misplaced letter. The Hong Kong SFC’s list of suspicious virtual asset trading platforms (checked 2026-10-16) is a good real-world example: two entries posted on 14 August 2026 together contain dozens of domains with “hashkey” or a similar spelling. They show several common tricks:

HashKey Exchange is one of the SFC’s licensed virtual asset trading platforms. The SFC does not say entry by entry whether these addresses impersonate HashKey; calling them imitations is my inference. The list also states that it is not exhaustive, so a site missing from it is not necessarily safe.

The same logic applies to Binance, OKX, Bybit and Bitget: if an address has extra words, numbers or hyphens before or after the main domain, or ends in something other than what you normally use, do not log in. Check it with the verification tool first.

Search ads and links in private messages: the most common ways into phishing sites

Search ads

The same FBI warning says scammers buy search engine ads that impersonate brands, and the ads look almost exactly like real search results. It singles out cryptocurrency exchange platforms: the fake sites look like real exchanges and ask you to enter your login details. The FBI gives three recommendations:

1. Check the address before clicking an ad; fake domains often contain misspellings.
2. Do not search for banks or exchanges. Type the address straight into the address bar.
3. Use an ad-blocking browser extension when searching.

Groups, private messages and QR codes

OKX’s guide to common scam tactics (updated 2026-09-07) says scammers often build fake websites impersonating legitimate organizations and also copy real sites. It recommends that you find the official website or contact details yourself instead of using a link the other person gives you, and that you do not open unknown links or attachments, scan unfamiliar QR codes or share your screen.

In “Crypto Scam Playbooks in the Chinese-Speaking World” I wrote that I often get pulled into Telegram groups impersonating Binance and OKX. I never click links sent in those groups.

Anti-phishing codes: confirm that an email or text message came from the exchange

An anti-phishing code is a string of text you set yourself at the exchange. Every genuine message the exchange sends you afterwards carries it.

• Binance’s help page (updated 2026-08-28) says the anti-phishing code appears in all genuine Binance emails and text messages. If it is missing or wrong, the message may be phishing and should be reported.
• Bybit’s help page says a missing or incorrect anti-phishing code is a strong indicator of a scam email or text message, and that you should confirm it matches the one you set before opening the message.

Anti-phishing codes only cover emails and text messages. They cannot stop a fake website you open yourself or a fake app you install by mistake. For how to set one up at each exchange, see “Exchange Account Security Settings Compared”.

How to tell if an exchange app or website is real: checklist

Before you use it for the first time

• Type the official site address in yourself once, confirm it, bookmark it, and always go in through the bookmark after that.
• Reach the App Store or Google Play through the download page on the official site, and check the developer name and app ID (package name).
• If you need an APK on Android, get the link only from the official download page.
• Set an anti-phishing code and remember what it looks like.
• Note where the exchange’s official verification tool sits on its official site.

Every time before you log in or click a link

• The domain in the address bar matches your bookmark, with no extra words, numbers or hyphens before or after it, and the ending has not been swapped.
• You did not arrive from a search ad, a group, a private message, a QR code or a link from a stranger.
• The email or text message carries the correct anti-phishing code. If it asks you to log in or take some action, always do it in the app or through your bookmark, never through a link in the message.

When someone contacts you claiming to be official

• Run their account, group link and website address through the official verification tool.
• If they message you first, ask for a fee, ask for passwords, verification codes or a seed phrase, or ask you to send coins to an address, end the conversation.
• If they send a screenshot showing they are “verified”, look up the same username yourself.

If you already entered details on a suspicious site or installed an app of unknown origin

These are my own suggestions, not an official exchange procedure:

1. Stop using that site or app, and go back into the real exchange through your bookmark or the official store.
2. Change your password and check your two-factor authentication settings. Look at the account’s login history, device list, API keys and withdrawal address whitelist for anything unfamiliar that has been added.
3. If something is wrong with the account, report it through customer support opened inside the app or the official site. Do not turn to a “support agent” who shows up on their own in a group or private message.
4. If assets have already been moved out, follow the reporting channels by region in the last section of “Crypto Scam Playbooks in the Chinese-Speaking World”, and do not pay anyone who claims they can recover your funds.

For protecting the account itself (passkeys, withdrawal whitelists), see “Exchange Account Security Settings Compared”. For where long-term holdings are safer, see “Cold Wallet vs Hot Wallet vs Exchange Custody”. For how to judge safety and transparency when picking an exchange, see “How to Choose a Crypto Exchange”.

FAQ

How do I check that an exchange website is official?

Paste the address into the exchange's own official verification tool, such as Binance Verify, OKX's official channel verification, Bitget's official verification, or Bybit's Authenticity Check. Open the verification tool from the official site you typed in yourself, not from a link someone sent you.

What are the app developer names for Binance, OKX, Bybit and Bitget?

On 16 October 2026 the App Store developer names were Binance Switzerland AG, OKX Inc., Bybit Fintech Limited and BG LIMITED; on Google Play they showed as Binance Inc., OKX INC., Bybit and BG LIMITED. The same exchange may not use the same name in both stores, so the safest approach is to reach the store from the download page on the official site.

If the verification tool says it is official, does that mean the email is real?

Not necessarily. Bybit's help page warns that sender addresses on emails and text messages are easy to spoof, and a verification result does not guarantee the message really came from an official Bybit mailbox. For emails, also check for the anti-phishing code you set.

Can I download an exchange's Android app from an APK website?

It is not recommended. OKX's Android download guide says not to install from chat groups, search ads, cloud drives, third-party APK sites or links sent by strangers, and to get the APK link from the official download page on okx.com.

Is it safe to search for an exchange on Google and click the first result?

Watch out for the ads at the top. A December 2022 FBI warning said scammers buy search ads that impersonate brands and copy sites that look like real exchanges to steal login details. The FBI recommends typing the address straight into the address bar instead of searching for it.

Does an anti-phishing code block fake websites?

No. Binance's help page says the anti-phishing code appears in all genuine Binance emails and text messages, so you can tell whether they came from Binance. It helps you spot fake messages; against fake websites you rely on verification tools and typing the address yourself.