# Arcus Scams, Fake Sites and Fake Tokens: How to Stay Safe

> Official Arcus domains, 54 Arcus-themed phishing sites on MetaMask's blocklist, fake ARCUS tokens, invite-code sellers and what to do if you clicked a bad link.

*Source: https://arcusguide.com/privacy/arcus-scams-and-fake-sites*

Arcus is new, popular and has a points program, which is the exact profile scammers target. Since June 25, 2026, 54 domains containing "arcus" have been added to MetaMask's open-source phishing blocklist. Fake ARCUS tokens trade on the same chain as the real exchange. And because Arcus's own Protocol Terms misprint the docs address, there is even a typo domain with an official-looking pedigree. This guide lists the real addresses, shows what the fakes look like, and covers what to do if you clicked something you should not have.

![How to read an Arcus web address: app.arcus.xyz, docs.arcus.xyz and help.arcus.xyz end in arcus.xyz and are official; app-arcus.xyz, arcus-app.xyz, arcusxyz.top and unlock.genesis-arcus.xyz are fakes on MetaMask's blocklist; arcus.docs.xyz is a typo domain that belongs to docs.xyz](/images/privacy/arcus-scams-and-fake-sites/arcus-official-vs-fake-domains.svg)

> **Key takeaway:** **The five rules:** (1) every official Arcus web address ends in **arcus.xyz**; anything with a hyphen, an extra word or a different ending is not Arcus. (2) Arcus has no token, so there is no airdrop to claim. (3) Invite codes cannot be sold. (4) Nobody legitimate DMs you first or asks for your seed phrase. (5) This site cannot access accounts or recover funds, and neither can anyone who messages you claiming they can.

## The official Arcus addresses

Bookmark these and use the bookmarks. Search ads and social replies are where lookalikes live.

| Address | What it is |
|---|---|
| `arcus.xyz` | Marketing site and blog |
| `app.arcus.xyz` | The trading app (spot, perps, vaults, rewards) |
| `docs.arcus.xyz` | API and developer docs |
| `help.arcus.xyz` | Help Center |
| `waitlist.arcus.xyz` | Perps waitlist |
| `testnet.arcus.xyz` | Testnet with paper USDG |

The app also calls back-end services on the same domain, such as `api.arcus.xyz`, `router.spot.arcus.xyz` and `api.vaults.arcus.xyz`. You never need to visit those in a browser.

Official channels, as listed in the Help Center: X [@arcus_xyz](https://x.com/arcus_xyz), Telegram announcements [t.me/Arcus_xyz](https://t.me/Arcus_xyz), Telegram community [t.me/Arcus_Official](https://t.me/Arcus_Official), [Discord](https://discord.gg/arcus) and TikTok @arcus.xyz. The iOS app "Arcus Mobile" is in pre-order under the seller Pocket Protector Labs Inc. (App Store id 6771858426), and the Android listing uses the package `xyz.arcus.app`. A "live" Arcus app from any other developer is not official.

That matters because the real mobile apps are not out yet. On October 2, 2026, the US App Store listing showed "Expected Jan 12, 2027" (Apple pre-order dates can be placeholders), and the Play Store listing offered only "Add to wishlist." An APK file shared in a Telegram group, or an "Arcus Pro" app from an unknown developer, is not the Arcus app.

Search ads deserve the same suspicion. Arcus's affiliate terms (Annex B of the Protocol Terms) ban affiliates from buying paid search ads on Arcus brand keywords, so a sponsored result for "Arcus" that is not Arcus itself is breaking the rules at best. Scroll past ads and use your bookmark.

One detail worth knowing: the X account @arcus_xyz is the former @dYdX account, renamed, so older dYdX posts now display under the Arcus name. That is genuine. Accounts with names like "Arcus Support" or "Arcus Airdrop" are not.

> **Warning:** Section 3 of Arcus's Protocol Terms says "More information about the Protocol is available at: arcus.docs.xyz." That is a typo. The registered domain there is docs.xyz, which Arcus does not use. The real docs are at docs.arcus.xyz. A misprinted address in an official document is exactly what a phisher would register, so never type it.

## 54 Arcus-themed domains on MetaMask's blocklist

MetaMask maintains a public blocklist, [eth-phishing-detect](https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json), which wallets use to warn you before you connect. I compared the list as of June 24, 2026 with the current version on October 2. The older version held four entries containing "arcus", all of them since removed. The current version holds 55, and **54 of them were added since June 25**. The 55th, marcus-exchange.info, predates Arcus and is unrelated.

The new entries fall into clear themes:

| Theme | Examples from the blocklist |
|---|---|
| Fake app or exchange | `app-arcus.xyz`, `arcus-app.xyz`, `apps-arcus.xyz`, `arcusdex.com`, `arcus-trade.xyz`, `arcustrade.com` |
| Fake waitlist or perps access | `waitlist-arcus.xyz`, `waitlist-arcus.com`, `waitlist-arcus.net`, `join.perps-arcus.xyz` |
| Fake token launch or "genesis" claim | `tge-arcus.xyz`, `unlock.genesis-arcus.xyz`, `genesis.arcusfoundation.xyz` |
| Fake points or multipliers | `arcus-point.xyz`, `multiplier-arcus.xyz`, `multi-arcus.xyz` |
| Fake bridge | `arcusbridge.xyz`, `arcusbridge.co` |
| Fake vote or event | `vote-arcus.xyz`, `arcus-gate-vote.vercel.app`, `arcus.mega-event.xyz`, `arcus.trade-event.xyz` |
| Borrowing the dYdX name | `dydx-arcus.com` |
| Typos and swapped endings | `arcuss.xyz`, `arcusxyz.top`, `arcusxyz.site`, `arcusxyz.online`, `arcusxyz.shop`, `arcus.money` |

The pattern tells you what the scams sell: early access, a token that does not exist, points you have not earned, and a bridge that drains your wallet. Every one of them needs you to connect a wallet and sign.

**How to read an address.** Look at the part right before the first single slash, then read from the right. `app.arcus.xyz` ends in `arcus.xyz`, so Arcus controls it. `app-arcus.xyz` is one word with a hyphen, a completely different domain anyone can buy. `arcus.docs.xyz` ends in `docs.xyz`. Hosting platforms such as `vercel.app`, `pages.dev` and `web.app` let anyone put "arcus" in a subdomain for free.

## Fake ARCUS tokens

Arcus has no token. So every "ARCUS" you see is unofficial, and the riskiest ones sit on Robinhood Chain right next to real Arcus products:

| Name | Contract on Robinhood Chain | Status |
|---|---|---|
| Arcus (ARCUS) | `0x904043F5442EcCcf998Fa898FdA4785d2b5F7777` | Not official |
| Arcus (ARCUS) | `0x94FFA58c0BC366FEEfDCBD64B5004a9d6475A3C6` | Not official |
| Arcus Pons (ARCUS) | `0x6e4db65dB8758D943F61d2F9Abcb26449B93082D` | Not official |

More tokens named Arcus trade on Base and other chains. On CoinGecko, the ARCUS ticker belongs to Arcus Network, a separate AI-payments project. The only official Arcus tokens are its **pTokens**, such as pBTC3x and pHOOD3x, and you can confirm any pToken's contract on the Vaults page of the app; [the pTokens guide](/ecosystem/arcus-ptokens) lists them. The token question in full is in [Arcus points, token and airdrop](/ecosystem/arcus-points-airdrop).

Robinhood Chain has its own history of token scams, including [tokens that vanished after purchase](https://www.kucoin.com/news/flash/robinhood-chain-users-report-vanishing-tokens-scam-after-purchase) in July and a [rug-pull ring across 53 launches](https://en.cryptonomist.ch/2026/09/27/robinhood-chain-rug-pull/) reported in September. A familiar name on a token is not evidence of anything.

## Invite-code sellers and DM scammers

Perps on Arcus need an invite code or a waitlist slot, which creates a market for fake ones. Arcus's [invite codes post](https://arcus.xyz/blog/arcus-invite-codes-are-live) is direct: "Codes can't be transferred, sold, or reassigned... Arcus does not recognise secondary sales." Codes are earned at one per $1M of qualifying perps volume, they are single-use, and a used code is gone "even if the person never trades." A paid code may already be spent, or may never have existed.

![Arcus blog post announcing that invite codes are live, explaining that codes are earned through trading volume and replace the manual whitelist](/images/arcus/arcus-invite-codes-post.webp)

A related mix-up is not a scam but causes real losses of time: a **referral link** (`app.arcus.xyz/ref/CODE`) is not an invite code. It binds you to a referrer for fee-share purposes and does not unlock perps. People who join through a referral link and then send their wallet address to a stranger's Telegram, hoping to be "added," are giving out information for nothing. [Invite codes and the waitlist](/guides/getting-started/arcus-invite-code-and-waitlist) explains how access really works.

Common DM scripts to ignore:

- "Your wallet is flagged, verify here." Arcus describes no identity check for trading; access is a wallet signature.
- "Support here, share your screen / seed phrase so I can fix your deposit." Deposit problems go through Arcus's deposit provider and the Help Center, never through a DM.
- "Whitelisted allocation available, pay a small fee." Allocations do not exist.
- "Season 0 points revealed, connect to view." Arcus says Season 0 amounts will be revealed "towards the end of the points program," on its own dashboard at app.arcus.xyz.

Real support routes, from the Help Center: the chat bubble on [help.arcus.xyz](https://help.arcus.xyz), and support@arcus.xyz for liquidation disputes and referral questions.

## Airdrop and "claim" sites

There is no Arcus token, so there is nothing to claim. Annex C of Arcus's [Protocol Terms](https://arcus.xyz/legal/protocol-terms) says points do not guarantee "a later token generation event, token migration, reward airdrop, or similar event." A page offering to "claim," "unlock," "check eligibility" or "convert points" is a drainer. These pages usually ask for a signature that looks harmless (a permit, a "login" message, a token approval) and grants the site the right to move your tokens.

**Open the real Arcus app**: Use a link you trust. Our link goes straight to app.arcus.xyz with code ARCUSGUIDE, and Arcus applies its 5% referral discount on trading fees. [Go to app.arcus.xyz](https://app.arcus.xyz/ref/ARCUSGUIDE)

## Self-custody basics

Arcus is self-custodial: your Stock Tokens sit in your wallet, and perps collateral sits in Arcus's on-chain Bridge Vault contract, tied to your wallet. That means the security of the wallet is yours to manage.

If you signed up with email or Apple, your wallet is a Privy embedded wallet. The Help Center says it "recovers through your sign-in rather than a seed phrase," which moves the risk to your email account. Give that account a strong, unique password and two-factor login, because whoever gets into it gets into the wallet.

If you use MetaMask or another extension wallet, the seed phrase is the master key. Write it on paper, keep it offline, and never type it into a website, a form or a chat window. No legitimate service needs it, including Arcus support.

The Help Center confirms that Ledger and Trezor hardware wallets connect to Arcus through MetaMask. With one, every signature needs a physical button press on the device, so malware on your computer cannot sign for you. It will not stop you from approving a bad request yourself, so read what the device screen says before you press.

The simplest habit of all is to split wallets: one for long-term holdings that never connects to anything new, and a second, lightly funded one for trying apps and links.

## Approvals hygiene

The first time you trade a given Stock Token, Arcus asks for a one-time authorization for that token, then a signature per trade. That is normal and documented in the Help Center. What is not normal is a site you reached from a DM asking for an approval on a token you hold.

Three habits:

1. **Read before you sign.** Your wallet shows which contract and token a signature touches. If it says "unlimited," ask why.
2. **Review approvals now and then.** Some wallets, Rabby among them, show and revoke token approvals inside the wallet. A block explorer for Robinhood Chain (chain ID 4663) also shows which contracts can spend your tokens.
3. **Revoke what you do not use.** Old approvals to apps you have abandoned are an open door.

## If you clicked a bad link

Move quickly, in this order:

After a loss, expect a second wave: "recovery experts," "blockchain investigators" or fake Arcus staff who promise to get the funds back for an upfront fee. That is the same scam with a new script.

> **Warning:** ArcusGuide is an independent guide. It has no access to your Arcus account, your wallet or Arcus's systems, and it cannot freeze, reverse or recover any transaction. Anyone who DMs you claiming to be from ArcusGuide, or offering to recover funds for you, is a scammer. For account issues, use the official Help Center at help.arcus.xyz.

---

## Before you trade

The safest path into Arcus is the boring one: type or bookmark `app.arcus.xyz`, check the address bar every time, and ignore anything that arrives by DM. [How to trade on Arcus](/guides/getting-started/how-to-trade-on-arcus) walks through the first session, [how to deposit](/guides/getting-started/how-to-deposit-on-arcus) covers funding through the official flow, and [which Arcus is which](/ecosystem/which-arcus) untangles the many unrelated companies and coins sharing the name. If the app shows a regional banner, read [Arcus not available in your country](/troubleshooting/arcus-not-available-in-my-country).

[Get 5% Off Arcus Fees](https://app.arcus.xyz/ref/ARCUSGUIDE)

ArcusGuide earns a share of the trading fees paid by accounts that join with code ARCUSGUIDE, at no extra cost to you. Nothing here is legal or financial advice.