> ## Content Index > Fetch the complete content index at: https://www.spotedcrypto.com/llms.txt > Use this file to discover other available public pages before exploring further. # start-exodus.com was flagged as phishing within a week of registration - URL: https://www.spotedcrypto.com/start-exodus-com-phishing-domain-explained/ - Published: 2026-11-09T02:52:51.000Z - Updated: 2026-11-09T02:55:47.000Z - Description: start-exodus.com is a lookalike phishing site, not Exodus. - Author: Cris - Tags: Wallets & Security, Guides, hash-en, phishing, exodus wallet, wallet security, scam-alert, self-custody, English A domain called start-exodus.com was registered on October 31, 2026\. About five days later, on November 5, a urlscan.io scan tagged it as phishing (source: [urlscan.io, 2026-11](https://urlscan.io/result/01a1acd9-fd53-72ce-bca8-5fd2d89dfbb3/?ref=spotedcrypto.com)), and by November 6 it was already on MetaMask's phishing blocklist (source: [MetaMask eth-phishing-detect, 2026-11](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com)). If a search result, ad or direct message sent you there to "start" or download Exodus, stop: the site is not run by Exodus. ## Is start-exodus.com the official Exodus website? No. start-exodus.com is a phishing domain built to look like Exodus, and it has no connection to the wallet. The official Exodus website is exodus.com, and the official desktop download page is [exodus.com/download](https://www.exodus.com/download?ref=spotedcrypto.com) . A report filed on MetaMask's eth-phishing-detect repository on November 6, 2026 lists start-exodus.com as a wallet-drainer site that "impersonates Exodus (exodus.com)" (source: [MetaMask eth-phishing-detect, 2026-11](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com)) . Treat the domain as a scam to avoid, not as somewhere to download a wallet. **Quick Answer:** No. start-exodus.com is a phishing domain posing as the Exodus wallet. It was registered on 2026-10-31, and a report filed on MetaMask's eth-phishing-detect repository on 2026-11-06 recorded 11 VirusTotal detections. Download Exodus only from exodus.com or the official app-store listing from Exodus Movement, Inc. The dates are the giveaway. The domain was registered at 16:03:57 UTC on October 31, 2026, through the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED. The report on MetaMask's eth-phishing-detect repository, filed by an outside GitHub user rather than by MetaMask itself, was posted at 05:37 UTC on November 6, 2026, about six days later . By then, 11 security vendors on VirusTotal had flagged it, the Spamhaus Domain Block List had listed it, and it was hosted at 154.86.119.115 in the Netherlands . MetaMask closed the issue as completed at 14:37 UTC the same day. "start-exodus.com" now appears in its live blocklist file (source: [MetaMask config.json](https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json?ref=spotedcrypto.com)) . Exodus itself, by contrast, has a long and public record. Exodus Movement, Inc. launched the wallet in 2015 and incorporated in Delaware in 2016\. Its Class A common stock trades on NYSE American under the ticker EXOD, according to the company's FY2025 [Form 10-K filed with the SEC](https://www.sec.gov/Archives/edgar/data/1821534/000182153426000009/exod-20251231.htm?ref=spotedcrypto.com) . A company of that size does not move its download portal to a hyphenated domain that is less than a week old. Whether the site is live right now is unclear. A urlscan.io scan submitted on November 5, 2026 was tagged "phishing" but returned "We could not scan this website!" with a connection-closed error (source: [urlscan.io, 2026-11](https://urlscan.io/result/01a1acd9-fd53-72ce-bca8-5fd2d89dfbb3/?ref=spotedcrypto.com)) . A page that won't load is not a safe page. The phishing report says the sites in its 25-domain batch use cloaking: requests that do not match the operator's targeting rules (such as expected referrer, geography, device or browser) are served a decoy, for example an HTTP error or a redirect to a legitimate site . The report does not say which decoy, if any, start-exodus.com showed this scanner. Here is what that means for you: - **Do not** download an installer, connect a wallet or type a recovery phrase on start-exodus.com or any similar domain. - **Do** type exodus.com yourself or use the official app-store listing from Exodus Movement, Inc. - **If you already interacted with the site**, treat that wallet as possibly compromised and read the recovery steps later in this guide. ## How did a week-old domain end up flagged? start-exodus.com was flagged as phishing within a week of registration. The domain was created on 2026-10-31 at 16:03:57 UTC. A urlscan.io scan submitted on 2026-11-05 at 17:55 UTC, about five days later, carried the tag "phishing" (source: [urlscan.io, 2026-11](https://urlscan.io/result/01a1acd9-fd53-72ce-bca8-5fd2d89dfbb3/?ref=spotedcrypto.com)) . On 2026-11-06 it was reported to MetaMask's public eth-phishing-detect repository as a wallet-drainer site impersonating Exodus. By the time that report was filed, the domain was already on MetaMask's list: its entry reads "Already listed by: MetaMask" (source: [MetaMask eth-phishing-detect issue #309719, 2026-11](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com)) . So the report recorded a block that was already in place rather than triggering it. MetaMask closed the report as "completed" the same day, and the domain still sits on MetaMask's live blocklist . Each step left a public record, so you can follow the timeline yourself. The full sequence appears in [MetaMask eth-phishing-detect issue #309719 (2026-11)](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com) and the related scan records: | Date and time (UTC) | Event | Public record | | ------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | 2026-10-31 16:03:57 | start-exodus.com registered through NICENIC INTERNATIONAL GROUP CO., LIMITED | Registration data quoted in issue #309719 | | 2026-10-31 16:04:09 | download-exodus.com registered with the same registrar, 12 seconds later | Issue #309719 | | 2026-11-05 | urlscan.io scan submitted and tagged "phishing"; the scanner reported "We could not scan this website!" | [urlscan.io result](https://urlscan.io/result/01a1acd9-fd53-72ce-bca8-5fd2d89dfbb3/?ref=spotedcrypto.com) | | 2026-11-06 05:37 | Issue #309719 filed, covering 25 wallet-drainer domains | GitHub issue | | 2026-11-06 14:37 | MetaMask closed the issue as "completed", nine hours after it was filed | GitHub issue | | Current | "start-exodus.com" listed in MetaMask's blocklist file | [src/config.json](https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json?ref=spotedcrypto.com) | ### The detection signals behind the report The report did not rest on a single complaint. Its entry for start-exodus.com lists several separate signals: - **11 VirusTotal detections** from security vendors, including alphaMountain.ai, BitDefender, CRDF, CyRadar and Forcepoint ThreatSeeker . - **A Spamhaus DBL listing.** The report marks the domain as "Listed on Spamhaus DBL" and links to Spamhaus's own lookup page for it . - **Hosting at 154.86.119.115 in the Netherlands.** Other Exodus lookalikes in the same batch use the same IP address . These figures are the ones recorded in the issue on 2026-11-06\. Vendor counts on VirusTotal change as engines re-scan, so a lookup today may show a different number. The direction of the evidence is clear, though: several unrelated security vendors and a major reputation list put the domain in the malicious category within days of its creation. ### What the MetaMask blocklist actually does MetaMask's eth-phishing-detect repository describes itself as a "List of malicious domains targeting Web3 users," and its blocking policy says MetaMask will "be quick and decisive to block websites" that impersonate known and established sites (source: [MetaMask eth-phishing-detect README, checked 2026-11-09](https://github.com/MetaMask/eth-phishing-detect?ref=spotedcrypto.com)). The live [config.json file](https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json?ref=spotedcrypto.com) contains "start-exodus.com", plus related lookalikes such as start-exodus.gr.com, download-exodus.com and exodus-waflet.com . This protection has limits. A blocklist only helps where the wallet or browser in use checks it. On the day of the report, the batch's detection-coverage chart showed Google Safe Browsing and Microsoft SmartScreen flagging none of the 25 domains . ### Why a brand-new domain is itself a red flag Domain age is one of the cheapest checks you can run. Exodus says it launched its wallet in 2015 . Its official site would not live on a domain created a week ago. In this batch, the Exodus lookalikes that have a registration date in the report were created between 2026-09-15 and 2026-10-31, and two of them were registered 12 seconds apart through the same registrar . For a trader, the rule is simple. If a "wallet," "download" or "airdrop" domain using a well-known brand name was registered within the past few weeks, treat it as hostile until you can prove otherwise. A WHOIS or RDAP lookup takes seconds. For start-exodus.com, the registry's RDAP record shows a registration date of 2026-10-31T16:03:57Z, the same timestamp quoted in the phishing report (source: [Verisign RDAP, checked 2026-11-09](https://rdap.verisign.com/com/v1/domain/start-exodus.com?ref=spotedcrypto.com)). ## What else was in the same 25-domain phishing batch? start-exodus.com was not a one-off. The report filed on MetaMask's eth-phishing-detect repository on 2026-11-06 listed 25 malicious domains . It described every one of them as a "wallet-drainer site" copying a well-known crypto wallet, with Exodus, Ledger, Trezor and Electrum all on the list (source: [MetaMask eth-phishing-detect, 2026-11](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com)). If you check one wallet brand and stop there, you will miss most of the threat. Protection was also uneven on the day of the report. The report's own detection-coverage chart, published with the report on November 6, shows that MetaMask's list already covered 76% of the 25 domains (19 of them), Spamhaus 72% (18) and Phantom's list 40%, while Google Safe Browsing and Microsoft SmartScreen covered none (source: [MetaMask eth-phishing-detect issue #309719, 2026-11](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com)). By that chart's count at filing time, someone relying only on Google Safe Browsing or SmartScreen warnings would have seen none for any domain in the batch. Wallet-specific lists were ahead of the general browser filters on this campaign. Exodus had six lookalikes in the batch, second only to Ledger's eight (source: [MetaMask eth-phishing-detect issue #309719, 2026-11](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com)). Several of them pointed to the same server as start-exodus.com, 154.86.119.115 in the Netherlands : - **download-exodus.com**: 4 VirusTotal detections, registered through NICENIC on 2026-10-31 . - **exodus-eng.com**: 17 detections, listed by Spamhaus, registered through NICENIC on 2026-09-30 . - **exodus-waflet.com** (13 detections) and **www.exodus-waflet.com** (10 detections), both registered through NameSilo on 2026-09-15 (source: [MetaMask eth-phishing-detect issue #309719, 2026-11](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com)). "Waflet" is a deliberate misspelling meant to slip past a quick glance . - **en-exodus.co.im**: 14 detections, using the Isle of Man country-code domain . The registration dates run from mid-September to the end of October 2026\. That suggests the operator adds new Exodus domains over several weeks rather than registering them all at once. The other names in the report follow the same naming habits, applied to other wallets : - **Ledger:** st-ledger.org - **Trezor:** setup-trezor.com and trezor-suite.im - **Monero:** getmonero-en.com - **Other wallets:** lookalikes of Electrum, SafePal and Phantom Most of these names attach a helpful-sounding word to the brand, like "start-," "setup-," "download-," "get-," "-eng" or "en-." Those words fit what a new user would search for right before installing a wallet. The report says that on these sites, a victim who connects a wallet or signs the requested transaction has their assets transferred to attacker-controlled addresses . A blocklist entry does not end a campaign. Once a domain is flagged, the operator can move the same drainer kit to a new name. MetaMask's blocklist also contains similarly named domains such as start-exodus.gr.com and start-exodus-web.webflow.io . One is a .gr.com subdomain and the other sits on a free website-builder subdomain, and both reuse the "start-exodus" name. The list does not say when they were added or whether the same operator runs them (source: [MetaMask config.json, 2026-11](https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json?ref=spotedcrypto.com)). Because the report says the sites in this batch serve decoys such as HTTP errors to visitors outside their targeting, an error page on a lookalike does not prove it is gone . Expect the next version to look almost the same under a different ending. ## How do you verify the real Exodus vs a lookalike? Check three things to tell the real Exodus from a lookalike: the domain, where the download comes from, and who published the app. The genuine wallet comes from exodus.com. Desktop installers come from the official exodus.com download page . On iOS, the only genuine listing is "Exodus: Crypto & Payments" from the developer Exodus Movement, Inc. . A different domain, a mirror download or another publisher name means you are not dealing with Exodus. Prefixes such as "start-", "download-" or "en-" are the usual giveaway. Start with the address bar. A real Exodus page sits on exodus.com itself. A brand name inside a longer domain does not count. start-exodus.com, download-exodus.com and exodus-eng.com all have "exodus" in them, and none of them is exodus.com. According to [MetaMask's eth-phishing-detect blocklist](https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json?ref=spotedcrypto.com), all three are flagged as phishing . The surest habit is to type exodus.com yourself or use a bookmark you saved earlier. Don't trust a search ad, a social post or a link someone sent you. Next, check the installer. Exodus's [help center](https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic?ref=spotedcrypto.com) tells users to download only from the official download page. It also tells them to compare desktop installers against the Release Hashes Exodus publishes . A release hash is a fingerprint of the file. If the hash of the file you downloaded doesn't match the published value, the file was changed or didn't come from Exodus. Don't run it. On mobile, look at the publisher name, not only the icon. As of November 9, 2026, the genuine iOS listing had a 4.6 rating from 37,937 ratings (source: [Apple App Store, 2026-11](https://apps.apple.com/us/app/exodus-crypto-payments/id1414384820?ref=spotedcrypto.com)). It describes self-custody, swaps across 50+ networks, staking and a debit card . Store review doesn't catch every fake. Exodus's own FY2025 Form 10-K says that in December 2025 the company "became aware of a fraudulent application listed on the App Store that falsely claimed to be our Exodus wallet and resulted in user losses." Exodus got that app removed . Knowing who the real company is helps too. Exodus Movement, Inc. files with the SEC, and its Class A common stock trades on NYSE American under the ticker EXOD. Its [10-K filed on 2026-03-11](https://www.sec.gov/Archives/edgar/data/1821534/000182153426000009/exod-20251231.htm?ref=spotedcrypto.com) says the company "launched Exodus in 2015 and incorporated in Delaware in 2016" . A wallet that has been around for about a decade and has a public listing doesn't need a "start-" landing page registered a week ago. start-exodus.com was registered on 2026-10-31 through NICENIC . | Signal | Official Exodus | Lookalike (e.g. start-exodus.com) | | ---------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | Domain | exodus.com | Brand name plus a prefix or suffix: start-exodus.com, download-exodus.com, exodus-waflet.com | | Download source | exodus.com/download, checked against published Release Hashes | Separate "download" or "start" page with no published hashes | | iOS publisher | Exodus Movement, Inc., "Exodus: Crypto & Payments" | Different developer name, or a fake listing like the one Exodus reported in December 2025 | | Domain age | Wallet launched in 2015 | start-exodus.com registered 2026-10-31 | | Security vendor status | Not on phishing blocklists | 11 VirusTotal detections, Spamhaus DBL listing, MetaMask blocklist entry | | Recovery phrase | Keys are encrypted on your own device. Exodus does not keep private key data | Fake wallet-connection prompts, airdrop claims or swap interfaces, per the report on the batch; connecting or signing sends assets to the attacker | The last row of the table matters most. The 10-K says Exodus works by "encrypting the private keys locally on our users' personal devices (private key data is not retained by Exodus)" . The [report filed on MetaMask's eth-phishing-detect repository](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com) says the wallet-drainer sites in the batch present "fake Web3 wallet-connection prompts, airdrop claims or swap interfaces" . That description covers the batch as a whole. No public capture shows which of those screens start-exodus.com itself displayed. Any website that wants your wallet's recovery phrase or keys is a lookalike, however close the logo or layout looks. ## What does a legitimate Exodus setup never ask for? A genuine Exodus setup never asks you to type an existing 12-word recovery phrase into a website. The real wallet works the other way around. A new install either creates a fresh phrase on your device or restores one inside the installed app. Exodus Movement's FY2025 Form 10-K refers to Exodus's 12-word recovery phrase and says private keys are encrypted on the user's device and private-key data is not retained by the company . So any web page that asks for those 12 words is asking for something Exodus itself never holds. The phrase matters because it is the wallet. Exodus's help center calls the 12-word recovery phrase "your all-access key to your wallet and all your crypto," says you can restore the wallet on another device by entering it into a new wallet, and warns that "anyone who has it can access your funds" (source: [Exodus Support, 2026-11](https://www.exodus.com/support/en/articles/8598627-everything-you-need-to-know-about-your-12-word-secret-key?ref=spotedcrypto.com)) . The same page says the recovery phrase of an existing wallet cannot be changed. Getting a new one means creating a brand-new wallet. If you hand the phrase over, you are handing over the money, whatever the page around the form looks like. The 12-word phrase and the app's local lock are two different things. On mobile, Exodus's help center says the app unlocks with your device's built-in security, such as Face ID, a fingerprint or the device passcode. If you forget a password or passcode, you regain access by restoring the wallet with the 12-word recovery phrase or a passkey backup (source: [Exodus Support, 2026-10](https://www.exodus.com/support/en/articles/8598654-how-do-i-access-my-wallet-if-i-forget-my-password?ref=spotedcrypto.com)) . The lock protects the app on that one device and does not stand in for the recovery phrase. A legitimate prompt for a passcode or password happens inside the installed app on your own device. It never happens on a browser page you reached through a search ad, a direct message or an "airdrop" link. ### Where genuine Exodus actually runs Exodus ships in a small number of known forms. Its help center lists Exodus on iOS, Android, Windows, Mac, Linux and Chrome-based browsers, and says the same wallet can be added to another device by pairing it or by restoring the 12-word recovery phrase into an empty wallet (source: [Exodus Support, 2026-11](https://www.exodus.com/support/en/articles/8598619-how-do-i-sync-my-exodus-wallet-to-a-different-device?ref=spotedcrypto.com)) : - **Desktop app**: downloaded from the official [exodus.com download page](https://www.exodus.com/download?ref=spotedcrypto.com). The help center advises checking installers against published release hashes (source: [Exodus Support](https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic?ref=spotedcrypto.com)). - **Mobile apps**: iOS and Android, through the App Store and Google Play links on the official [exodus.com download page](https://www.exodus.com/download?ref=spotedcrypto.com) (checked 2026-11-09). On Google Play the app is published by Exodus Movement, Inc. (source: [Google Play, 2026-11](https://play.google.com/store/apps/details?id=exodusmovement.exodus&ref=spotedcrypto.com)). The iOS listing is "Exodus: Crypto & Payments" from the developer Exodus Movement, Inc. (source: [Apple App Store](https://apps.apple.com/us/app/exodus-crypto-payments/id1414384820?ref=spotedcrypto.com)). - **Browser extension**: "Exodus Web3 Wallet" on the Chrome Web Store, published by Exodus Movement, Inc. with exodus.com as its website. As of November 9, 2026, the listing says it supports Web3 networks such as Ethereum, Solana and Cardano and shows 100,000 users (source: [Chrome Web Store, 2026-11](https://chromewebstore.google.com/detail/exodus-web3-wallet/aholpfdialjgjfhomihkjbmgjidlcdno?ref=spotedcrypto.com)). The 10-K also names a browser extension alongside the desktop and mobile apps . - **Hardware-wallet connection**: the 10-K lists "the option to connect to a hardware wallet" among Exodus's self-custody products . Pair a device such as a Trezor only through an installed Exodus app, never through a website. This list is short on purpose. Every form on it is installed software: a desktop app from exodus.com, or a mobile app or browser extension from an official store listing published by Exodus Movement, Inc. None of them asks you to type your recovery phrase into a website. If a web page asks you to "validate", "sync" or "unlock" a wallet with your phrase, it is not on that list, so treat it as a warning sign. ### The download rule Any "Exodus download" served from a domain other than exodus.com, or from outside the official app-store listings, should be treated as phishing. MetaMask's blocklist shows how close the fakes get. Next to start-exodus.com it lists download-exodus.com, start-exodus-web.webflow.io and exodus-waflet.com (source: [MetaMask eth-phishing-detect](https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json?ref=spotedcrypto.com)). Words like "download", "start" or "web" in front of the brand name are a common way to make these domains look official. Type exodus.com into the address bar yourself, or open the store listing directly, and ignore links that arrive by message or ad. ## Why does impersonation of Exodus keep happening? Exodus keeps getting impersonated because a recognizable self-custody brand is profitable to fake, and a drained wallet usually can't be recovered. The company says so itself. Exodus Movement, Inc.'s FY2025 Form 10-K, filed with the SEC on March 11, 2026, lists impersonation by criminals as a business risk . Domains like start-exodus.com are one recent example of that pattern. They are not a one-off. > "Our platform and brand may be impersonated and exploited by third-party criminal actors seeking to defraud users," — Exodus Movement, Inc., FY2025 Annual Report on Form 10-K (source: [SEC EDGAR, 2026-03](https://www.sec.gov/Archives/edgar/data/1821534/000182153426000009/exod-20251231.htm?ref=spotedcrypto.com)) This isn't only a hypothetical in a legal filing. The same 10-K says that in December 2025 the company "became aware of a fraudulent application listed on the App Store that falsely claimed to be our Exodus wallet and resulted in user losses" . Exodus says the app came down only after "sustained and proactive efforts." So a fake got through a curated app store and stayed up long enough to cost people money before anyone removed it. A standalone website has no review step at all. start-exodus.com was registered on October 31, 2026, and needed no one's approval to go live . Three things make Exodus a steady target: - **Brand recognition.** Exodus launched in 2015, and its Class A stock trades on NYSE American as EXOD . A known name makes a fake download page more believable. - **Nothing can be reversed.** Self-custody means the wallet encrypts private keys on the user's own device. The 10-K states that "private key data is not retained by Exodus" . The company can't freeze, roll back or recover funds that someone else moved with a stolen phrase. - **No liability.** The filing says Exodus "does not accept liability" for losses caused by criminals it isn't affiliated with . The loss stays with the victim. That trade-off is what self-custody means. Exodus never holds your keys, so it can't lose them in a company breach. It also means nobody can step in after you hand them to a phishing site. For an attacker, one convincing page that collects a 12-word recovery phrase is enough. Once they have it, they can rebuild the wallet on their own device and empty it. No support ticket and no chargeback can undo that. Setting up a lookalike is also cheap and fast. In the report filed on MetaMask's eth-phishing-detect repository, start-exodus.com and download-exodus.com were registered 12 seconds apart through the same registrar . Getting a domain blocklisted takes days, but registering a new one takes seconds. Whenever a domain is flagged, expect the operator to have another one ready. Your own habits will protect you more reliably than any single blocklist: check the URL, use only the official store listing, and never type your phrase into a website. ## What should you do if you used start-exodus.com? What you should do depends on what you did on the site. If you only opened the page and entered nothing, your risk is low. If you downloaded software, approved a wallet connection or typed your 12-word recovery phrase, treat that wallet as compromised. Create a new wallet in a genuine Exodus install and move your funds to it. The site was reported as a wallet drainer impersonating Exodus on November 6, 2026 . The only public scan of the domain failed to load the page (source: [urlscan.io, 2026-11](https://urlscan.io/result/01a1acd9-fd53-72ce-bca8-5fd2d89dfbb3/?ref=spotedcrypto.com)), so no public capture shows which of the batch's screens (fake wallet-connection prompts, airdrop claims or swap interfaces) start-exodus.com displayed . Anything beyond simply looking at the page should be handled as the worst case. The main reason a typed phrase is so serious: Exodus encrypts private keys on your own device and does not keep them . Exodus's help center says the 12-word recovery phrase restores the wallet on another device when it is entered into a new wallet (source: [Exodus Support, 2026-11](https://www.exodus.com/support/en/articles/8598627-everything-you-need-to-know-about-your-12-word-secret-key?ref=spotedcrypto.com)) . Anyone who has your phrase has your wallet. Changing your passcode or reinstalling the app does nothing to them. The same page says an existing wallet's recovery phrase cannot be changed, so the only fix is a new wallet with a new phrase. | Exposure level | Recommended action | Urgency | | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------- | --------------------- | | Only visited the page, entered nothing, installed nothing | Close the tab, clear the bookmark, and from now on get Exodus only from exodus.com or the official store listing | Low | | Approved a "wallet connection," airdrop claim or swap prompt | Stop using that wallet. Create a new one in a genuine install and move the remaining funds to it | High: same day | | Downloaded and ran an installer from the site | Uninstall it, don't open any wallet on that machine until it's been cleaned, and treat any phrase used on it as exposed | High: same day | | Typed or pasted your 12-word recovery phrase | Assume the wallet is compromised. Move whatever is left to a new wallet with a new phrase right away | Critical: immediately | If you're in one of the higher-risk rows, take these steps in order: 1. **Get a clean install.** Download only from the [official Exodus download page](https://www.exodus.com/download?ref=spotedcrypto.com), or on iOS from the "Exodus: Crypto & Payments" listing by developer Exodus Movement, Inc. ([App Store](https://apps.apple.com/us/app/exodus-crypto-payments/id1414384820?ref=spotedcrypto.com)). For desktop installers, check the file against the Release Hashes Exodus publishes, as its [help center](https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic?ref=spotedcrypto.com) recommends. 2. **Create a new wallet.** Do not restore the old phrase. A new wallet generates a fresh 12-word phrase. Exodus tells users to write it down and "store it safely, privately, and offline" (source: [Exodus Support, 2026-11](https://www.exodus.com/support/en/articles/8598627-everything-you-need-to-know-about-your-12-word-secret-key?ref=spotedcrypto.com)). Never keep it in a browser form or a cloud note. 3. **Move your remaining funds.** Send everything left in the exposed wallet to the new wallet's addresses. Do this before anything else, including reporting. 4. **Report it.** Contact Exodus through its [official support site](https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic?ref=spotedcrypto.com) and keep the URL, the date and any transaction IDs. Exodus says it does not accept liability for losses caused by unaffiliated criminals , so don't count on getting your money back. A report still helps get lookalike domains taken down. Be careful with anyone who contacts you first after a loss, on Telegram, by direct message or by phone, offering to trace or freeze stolen crypto for a fee or asking for your new phrase. Exodus's help center says Exodus Support will never ask for your recovery phrase or private keys (source: [Exodus Support, checked 2026-11-09](https://www.exodus.com/support/en/articles/8598632-how-do-i-keep-my-money-safe-how-to-store-cryptocurrency-safely?ref=spotedcrypto.com)). Anyone who asks for it is not Exodus. ## What is still unknown about start-exodus.com? We know that start-exodus.com is not an Exodus property and that MetaMask blocks it. We do not know how many people visited it, how much money was lost through it or which company hosts it. The phishing report gives only an IP address, 154.86.119.115, located in the Netherlands, and does not name a hosting provider . No public victim count or loss total has been tied to this domain as of November 9, 2026. The page itself is also unconfirmed. A urlscan.io scan submitted on November 5, 2026 was tagged "phishing" but could not load the site and returned a closed connection instead of a screenshot (source: [urlscan.io, 2026-11](https://urlscan.io/result/01a1acd9-fd53-72ce-bca8-5fd2d89dfbb3/?ref=spotedcrypto.com)) . The report describes all 25 sites in the batch as wallet-drainer sites that present fake Web3 wallet-connection prompts, airdrop claims or swap interfaces , but no public capture shows which of those start-exodus.com itself displayed. Two more caveats apply to the detection data: - **Vendor counts come from the report.** The 11 VirusTotal detections and the Spamhaus DBL listing are the figures given in the [MetaMask eth-phishing-detect report](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com) filed on November 6, 2026 . Detection counts change as vendors rescan, so today's numbers may be different. - **The official Exodus pages block automated access.** The [Exodus help-center article on verifying downloads](https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic?ref=spotedcrypto.com) and the [exodus.com download page](https://www.exodus.com/download?ref=spotedcrypto.com) reject automated tools. The guidance summarized here comes from their indexed text, so check the current wording and release hashes yourself in a browser. No Exodus statement naming start-exodus.com has been published. The closest is the company's general warning in its FY2025 10-K that its brand "may be impersonated and exploited by third-party criminal actors" (source: [SEC Form 10-K, 2026-03](https://www.sec.gov/Archives/edgar/data/1821534/000182153426000009/exod-20251231.htm?ref=spotedcrypto.com)) . The details of this domain may never be fully known, but the operator's methods will be used again under new names. Use this checklist the next time an "Exodus" link reaches you: 1. **Check the registration date.** A wallet domain only a few days old is a red flag. start-exodus.com was registered on October 31, 2026 and tagged as phishing on urlscan.io about five days later, on November 5 (source: [urlscan.io, 2026-11](https://urlscan.io/result/01a1acd9-fd53-72ce-bca8-5fd2d89dfbb3/?ref=spotedcrypto.com)) . 2. **Bookmark exodus.com** and go there only through the bookmark or the official app-store listing, never from search ads, direct messages or airdrop posts. 3. **Never paste your 12-word phrase into any website.** Exodus keeps private keys only on your device, so no legitimate page will ever ask for the phrase . Takeaway: treat any Exodus-branded domain other than exodus.com as hostile until proven otherwise, and keep your recovery phrase off the internet. ## Frequently asked questions ### Is start-exodus.com safe? No. start-exodus.com is not an Exodus property. It is a phishing lookalike that pretends to be the Exodus wallet at exodus.com. A report filed on 2026-11-06 on [MetaMask's eth-phishing-detect repository](https://github.com/MetaMask/eth-phishing-detect/issues/309719?ref=spotedcrypto.com) calls it a wallet-drainer site. The same report says 11 VirusTotal vendors flag it and that it is on the Spamhaus DBL . The domain is also in [MetaMask's live blocklist](https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json?ref=spotedcrypto.com) . The official site is exodus.com. ### Where is the only official place to download Exodus? Download Exodus only from the official [exodus.com download page](https://www.exodus.com/download?ref=spotedcrypto.com) or from the official app-store listings published by Exodus Movement, Inc. On iOS, the real app is "Exodus: Crypto & Payments" from developer Exodus Movement, Inc. As of November 9, 2026, it showed a 4.6 rating from 37,937 ratings (source: [Apple App Store](https://apps.apple.com/us/app/exodus-crypto-payments/id1414384820?ref=spotedcrypto.com)). Exodus's [help center](https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic?ref=spotedcrypto.com) also tells desktop users to check installers against its published Release Hashes before running them. ### I entered my recovery phrase on start-exodus.com. What now? Treat that wallet as compromised. Whoever has your 12-word phrase can restore your wallet and move the funds. First, install Exodus again from exodus.com or the official app-store listing. Then create a brand-new wallet with a new recovery phrase and move any remaining assets into it right away. Do not reuse the old phrase. Exodus says in its [FY2025 Form 10-K](https://www.sec.gov/Archives/edgar/data/1821534/000182153426000009/exod-20251231.htm?ref=spotedcrypto.com) that private keys are encrypted locally on the user's device and are not kept by the company . That means Exodus cannot freeze or reverse transfers made with a stolen phrase. The same filing says the company "does not accept liability" for losses caused by unaffiliated criminals . ### Does Exodus offer phone or Telegram support? Only use support channels linked from the official [exodus.com help center](https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic?ref=spotedcrypto.com). Treat any phone number, Telegram account or direct message you didn't find there as impersonation. In its [10-K](https://www.sec.gov/Archives/edgar/data/1821534/000182153426000009/exod-20251231.htm?ref=spotedcrypto.com), Exodus warns that its platform and brand "may be impersonated and exploited by third-party criminal actors seeking to defraud users." It also describes a fake App Store app in December 2025 that caused user losses . Exodus's help center says Exodus Support will never ask for your recovery phrase or private keys (source: [Exodus Support, checked 2026-11-09](https://www.exodus.com/support/en/articles/8598632-how-do-i-keep-my-money-safe-how-to-store-cryptocurrency-safely?ref=spotedcrypto.com)). ### Why can't I open start-exodus.com now? The site may not load for several reasons. start-exodus.com is on MetaMask's phishing blocklist, so tools that check that list may block it . The phishing report also says the sites in this batch use cloaking: visitors who don't match the operator's targeting rules are served a decoy, such as an HTTP error or a redirect to a legitimate site. It does not say which decoy start-exodus.com used . A [urlscan.io scan](https://urlscan.io/result/01a1acd9-fd53-72ce-bca8-5fd2d89dfbb3/?ref=spotedcrypto.com) submitted 2026-11-05 also failed with a closed connection . A dead page doesn't mean the scam is over. The same campaign already used other lookalikes, such as download-exodus.com and exodus-eng.com . --- ### Related Articles - [Abstract burned tens of millions, then set a Dec 15 deadline](https://www.spotedcrypto.com/abstract-l2-shutdown-december-15-bridge-out/) - [$6.36B left Binance in one night. Your wallet wasn't the target](https://www.spotedcrypto.com/binance-hack-protect-crypto-funds-self-custody/) - [50 signed authorizations, one Binance wallet takeover](https://www.spotedcrypto.com/binance-exploit-signed-authorizations-explained/) - [An Exodus-like name isn't proof of an Exodus connection](https://www.spotedcrypto.com/exodus-domain-affiliation-download-check/) - [Four matching characters hid an Electrum payment switch](https://www.spotedcrypto.com/electrum-exploit-address-lookalikes/) Enjoyed this article? Subscribe to get new stories by email whenever they're published. [Subscribe](#/portal/signup)