Arcus Scams, Fake Sites and Fake Tokens: How to Stay Safe

Arcus is new, popular and has a points program, which is the exact profile scammers target. Since June 25, 2026, 54 domains containing "arcus" have been added to MetaMask's open-source phishing blocklist. Fake ARCUS tokens trade on the same chain as the real exchange. And because Arcus's own Protocol Terms misprint the docs address, there is even a typo domain with an official-looking pedigree. This guide lists the real addresses, shows what the fakes look like, and covers what to do if you clicked something you should not have.

The official Arcus addresses

Bookmark these and use the bookmarks. Search ads and social replies are where lookalikes live.

The app also calls back-end services on the same domain, such as api.arcus.xyz, router.spot.arcus.xyz and api.vaults.arcus.xyz. You never need to visit those in a browser.

Official channels, as listed in the Help Center: X @arcus_xyz, Telegram announcements t.me/Arcus_xyz, Telegram community t.me/Arcus_Official, Discord and TikTok @arcus.xyz. The iOS app "Arcus Mobile" is in pre-order under the seller Pocket Protector Labs Inc. (App Store id 6771858426), and the Android listing uses the package xyz.arcus.app. A "live" Arcus app from any other developer is not official.

That matters because the real mobile apps are not out yet. On October 2, 2026, the US App Store listing showed "Expected Jan 12, 2027" (Apple pre-order dates can be placeholders), and the Play Store listing offered only "Add to wishlist." An APK file shared in a Telegram group, or an "Arcus Pro" app from an unknown developer, is not the Arcus app.

Search ads deserve the same suspicion. Arcus's affiliate terms (Annex B of the Protocol Terms) ban affiliates from buying paid search ads on Arcus brand keywords, so a sponsored result for "Arcus" that is not Arcus itself is breaking the rules at best. Scroll past ads and use your bookmark.

One detail worth knowing: the X account @arcus_xyz is the former @dYdX account, renamed, so older dYdX posts now display under the Arcus name. That is genuine. Accounts with names like "Arcus Support" or "Arcus Airdrop" are not.

54 Arcus-themed domains on MetaMask's blocklist

MetaMask maintains a public blocklist, eth-phishing-detect, which wallets use to warn you before you connect. I compared the list as of June 24, 2026 with the current version on October 2. The older version held four entries containing "arcus", all of them since removed. The current version holds 55, and 54 of them were added since June 25. The 55th, marcus-exchange.info, predates Arcus and is unrelated.

The new entries fall into clear themes:

The pattern tells you what the scams sell: early access, a token that does not exist, points you have not earned, and a bridge that drains your wallet. Every one of them needs you to connect a wallet and sign.

How to read an address. Look at the part right before the first single slash, then read from the right. app.arcus.xyz ends in arcus.xyz, so Arcus controls it. app-arcus.xyz is one word with a hyphen, a completely different domain anyone can buy. arcus.docs.xyz ends in docs.xyz. Hosting platforms such as vercel.app, pages.dev and web.app let anyone put "arcus" in a subdomain for free.

Fake ARCUS tokens

Arcus has no token. So every "ARCUS" you see is unofficial, and the riskiest ones sit on Robinhood Chain right next to real Arcus products:

More tokens named Arcus trade on Base and other chains. On CoinGecko, the ARCUS ticker belongs to Arcus Network, a separate AI-payments project. The only official Arcus tokens are its pTokens, such as pBTC3x and pHOOD3x, and you can confirm any pToken's contract on the Vaults page of the app; the pTokens guide lists them. The token question in full is in Arcus points, token and airdrop.

Robinhood Chain has its own history of token scams, including tokens that vanished after purchase in July and a rug-pull ring across 53 launches reported in September. A familiar name on a token is not evidence of anything.

Invite-code sellers and DM scammers

Perps on Arcus need an invite code or a waitlist slot, which creates a market for fake ones. Arcus's invite codes post is direct: "Codes can't be transferred, sold, or reassigned... Arcus does not recognise secondary sales." Codes are earned at one per $1M of qualifying perps volume, they are single-use, and a used code is gone "even if the person never trades." A paid code may already be spent, or may never have existed.

A related mix-up is not a scam but causes real losses of time: a referral link (app.arcus.xyz/ref/CODE) is not an invite code. It binds you to a referrer for fee-share purposes and does not unlock perps. People who join through a referral link and then send their wallet address to a stranger's Telegram, hoping to be "added," are giving out information for nothing. Invite codes and the waitlist explains how access really works.

Common DM scripts to ignore:

• "Your wallet is flagged, verify here." Arcus describes no identity check for trading; access is a wallet signature.
• "Support here, share your screen / seed phrase so I can fix your deposit." Deposit problems go through Arcus's deposit provider and the Help Center, never through a DM.
• "Whitelisted allocation available, pay a small fee." Allocations do not exist.
• "Season 0 points revealed, connect to view." Arcus says Season 0 amounts will be revealed "towards the end of the points program," on its own dashboard at app.arcus.xyz.

Real support routes, from the Help Center: the chat bubble on help.arcus.xyz, and support@arcus.xyz for liquidation disputes and referral questions.

Airdrop and "claim" sites

There is no Arcus token, so there is nothing to claim. Annex C of Arcus's Protocol Terms says points do not guarantee "a later token generation event, token migration, reward airdrop, or similar event." A page offering to "claim," "unlock," "check eligibility" or "convert points" is a drainer. These pages usually ask for a signature that looks harmless (a permit, a "login" message, a token approval) and grants the site the right to move your tokens.

Self-custody basics

Arcus is self-custodial: your Stock Tokens sit in your wallet, and perps collateral sits in Arcus's on-chain Bridge Vault contract, tied to your wallet. That means the security of the wallet is yours to manage.

If you signed up with email or Apple, your wallet is a Privy embedded wallet. The Help Center says it "recovers through your sign-in rather than a seed phrase," which moves the risk to your email account. Give that account a strong, unique password and two-factor login, because whoever gets into it gets into the wallet.

If you use MetaMask or another extension wallet, the seed phrase is the master key. Write it on paper, keep it offline, and never type it into a website, a form or a chat window. No legitimate service needs it, including Arcus support.

The Help Center confirms that Ledger and Trezor hardware wallets connect to Arcus through MetaMask. With one, every signature needs a physical button press on the device, so malware on your computer cannot sign for you. It will not stop you from approving a bad request yourself, so read what the device screen says before you press.

The simplest habit of all is to split wallets: one for long-term holdings that never connects to anything new, and a second, lightly funded one for trying apps and links.

Approvals hygiene

The first time you trade a given Stock Token, Arcus asks for a one-time authorization for that token, then a signature per trade. That is normal and documented in the Help Center. What is not normal is a site you reached from a DM asking for an approval on a token you hold.

Three habits:

1. Read before you sign. Your wallet shows which contract and token a signature touches. If it says "unlimited," ask why.
2. Review approvals now and then. Some wallets, Rabby among them, show and revoke token approvals inside the wallet. A block explorer for Robinhood Chain (chain ID 4663) also shows which contracts can spend your tokens.
3. Revoke what you do not use. Old approvals to apps you have abandoned are an open door.

If you clicked a bad link

Move quickly, in this order:

After a loss, expect a second wave: "recovery experts," "blockchain investigators" or fake Arcus staff who promise to get the funds back for an upfront fee. That is the same scam with a new script.

Before you trade

The safest path into Arcus is the boring one: type or bookmark app.arcus.xyz, check the address bar every time, and ignore anything that arrives by DM. How to trade on Arcus walks through the first session, how to deposit covers funding through the official flow, and which Arcus is which untangles the many unrelated companies and coins sharing the name. If the app shows a regional banner, read Arcus not available in your country.

ArcusGuide earns a share of the trading fees paid by accounts that join with code ARCUSGUIDE, at no extra cost to you. Nothing here is legal or financial advice.