bitpie[.]co

This domain, bitpie.co, poses a significant phishing threat by masquerading as a legitimate cryptocurrency wallet service. Analysis indicates the site is designed to deceive users into entering sensitive credentials, such as private keys or recovery phrases, under the pretense of accessing or managing digital assets. Once obtained, these credentials are likely used to drain cryptocurrency holdings from victims' wallets. The site specifically targets users familiar with multi-chain wallets, as suggested by its page title, which references global leadership in multi-chain wallet services. The threat extends beyond credential theft, as the domain may also distribute malware or facilitate fraudulent transactions under the guise of wallet updates or security verifications.

Infrastructure analysis reveals multiple red flags supporting the malicious classification of bitpie.co. The domain was registered on April 30, 2026, a future date that suggests either a typographical error in registration records or an attempt to obscure its true creation timeline. It is hosted on IP address 172.67.211.183 and registered through a widely used registrar, which is consistent with patterns observed in phishing campaigns. The domain appears on 3 security blocklists, and 17 out of 95 security vendors on VirusTotal have flagged it as malicious. The SSL certificate, issued by Let's Encrypt with identifier E7, does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. The page title, written in a mix of Chinese and English, further indicates a targeted approach to lure users from specific linguistic or regional demographics.

Users who have visited bitpie.co or interacted with its content should take immediate action to mitigate potential risks. First, revoke any permissions granted to the site in cryptocurrency wallet applications or browser extensions. Second, monitor all linked accounts and wallets for unauthorized transactions, particularly focusing on the chains or assets mentioned on the phishing site. If credentials were entered, transfer assets to a new, secure wallet and generate fresh private keys or recovery phrases. Additionally, scan the device used to access the site for malware, as phishing pages often redirect to or host malicious payloads. Report the domain to relevant security teams or blocklist providers to aid in broader mitigation efforts. Finally, educate users on recognizing phishing indicators, such as mismatched URLs, suspicious registration dates, and unsolicited requests for sensitive information.