How to Recognize Fake dYdX Sites and Protect Your Wallet

This isn’t a hypothetical risk: a documented fake dYdX site at the domain dydx[.]click has already been used to drain connected wallets, and dYdX’s own now-retired v3 website was at one point compromised to redirect visitors to a phishing page.

This guide is part of TradeOnDEX’s dYdX how-to series within Perpetual Futures.

Disclosure: TradeOnDEX may earn a commission from links to dYdX on this page, at no extra cost to you. Full details at the end of this article.

Documented incidents worth knowing about specifically

A fake dYdX trading platform. A close visual copy of the dYdX interface has been documented at the domain dydx[.]click, users who connected their wallet to this fake page exposed themselves to a crypto wallet drainer. The same scam pattern could plausibly be hosted on other, similarly convincing domains, not just this one specific address.

A compromised official channel. At one point, dYdX’s own website associated with the now-retired v3 platform was itself compromised and used to redirect visitors to a phishing site, a reminder that even a genuinely official domain can be temporarily compromised, not just impersonated by a separate look-alike.

A supply-chain malware incident. In January 2026, dYdX acknowledged that compromised npm and PyPI packages were being used to deliver wallet-stealing malware and remote-access trojans, a risk aimed specifically at developers building on or integrating with dYdX, distinct from the consumer-facing fake-website pattern above.

What to actually do about each of these patterns

For fake site clones: verify the exact domain character by character before connecting a wallet, and bookmark the official address after verifying it once rather than searching or clicking a shared link each time.

For the possibility that even an official-looking domain is compromised: treat any unexpected prompt or unusual wallet-approval request as suspicious, regardless of how legitimate the surrounding site appears, a compromised official page can still look completely normal aside from the malicious request itself.

For the developer-targeted malware incident: if you’ve installed dYdX-related npm or PyPI packages, verify you’re using an untampered, current version from the official source, and if you have any doubt about a package’s integrity, isolate the affected machine, move funds to a new wallet from a clean system, and rotate any API keys or credentials, following the same remediation dYdX itself recommended when this incident was disclosed.

Risk: what makes these patterns specifically dangerous

A convincing site clone doesn’t need to fool an expert, it needs to look right for the few seconds it takes to connect a wallet. The documented dydx[.]click case shows this isn’t a theoretical concern; a functioning, wallet-draining clone of dYdX has genuinely existed and been used against real users.

“Check if it’s the official site” isn’t a complete defense, since even official infrastructure has been compromised before. The v3 site compromise specifically illustrates that domain-checking alone isn’t foolproof, scrutinizing what a wallet-approval request is actually asking for matters even on a domain you’ve verified.

Developer-facing supply-chain attacks target a different audience than consumer-facing phishing sites, but with potentially more severe consequences. If you’re building bots or integrations using dYdX’s official packages, as covered in the API trading guide, verify package integrity specifically, a compromised dependency can affect infrastructure you’ve built and trusted for some time, not just a single risky click.

Recovery after a successful wallet-drainer interaction is generally not possible. As with phishing risk on any platform in this series, blockchain transactions are typically irreversible, prevention through careful domain verification and transaction scrutiny is the effective control, not recovery after the fact.

Quick reference: documented incident patterns

See it for yourself

Bookmark the official dYdX address after verifying it directly, and if you build with dYdX’s developer packages, double-check package sources and versions against dYdX’s own official documentation rather than assuming a familiar-looking package name is automatically safe.

Frequently asked questions

Is there a real, documented example of a fake dYdX site?

Yes, a close visual copy has been documented at the domain dydx[.]click, used to drain wallets that connected to it; similarly convincing clones could exist on other domains too.

Can even the official dYdX site be compromised?

It has happened before, dYdX’s now-retired v3 site was at one point compromised to redirect visitors to a phishing page, which is why scrutinizing transaction requests matters even on a domain you’ve verified.

What was the January 2026 npm/PyPI incident?

Compromised packages related to dYdX were found delivering wallet-stealing malware and remote-access trojans, specifically targeting developers integrating with or building on dYdX.

What should I do if I suspect I’ve interacted with a fake dYdX site or compromised package?

Isolate the affected device, move funds to a new wallet from a clean system, and rotate any API keys or credentials, the same remediation steps dYdX itself recommended following the disclosed malware incident.

Affiliate disclosure

TradeOnDEX may earn a commission if you sign up or trade through a link on this page, at no extra cost to you. dYdX’s own affiliate/referral terms are still being confirmed for this site, so links here are direct and untracked for now. This article is educational and is not financial advice. See our disclaimer for the full risk warning.