DefiBank.online: a case study of a rug-pull

Recently, the brand name ‘DefiBank.online’ has been appearing with increasing frequency on crypto forums and Telegram groups, presented as a ‘new decentralised bank’ capable of offering triple-digit returns via the $BANK token.

Recently, the brand name ‘DefiBank.online’ has been appearing with increasing frequency on crypto forums and Telegram groups, presented as a ‘new decentralised bank’ capable of offering triple-digit returns via the $BANK token. A preliminary analysis, however, reveals a number of inconsistencies: a domain registered only a few weeks ago, a front-end lacking white-papers and audits, references to a DAO LLC that do not appear in official records, social profiles with minimal engagement, and an immediate invitation to connect the wallet by granting unlimited authorisations.

The following reconstructs, point by point, the anatomy of the DefiBank.online case-from the WHOIS data to the source code to the on-chain clues suggesting its potentially fraudulent nature-and provides an operational checklist to help recognise similar schemes in the DeFi landscape.

Decripto offers a support and advisory service via on-chain analysis and forensic reports to claim the recovery of funds lost in cryptocurrency scams. For more information CLICK HERE. For the official Telegram group link below (LINK).

The domain defibank.online

The domain defibank.online was only registered on 11 November 2024 and extended for only one year, with the only update on 20 December 2024. The choice of a one-year horizon – combined with a mass registrar such as Go Daddy – suggests a hit-and-run strategy: it is unlikely that an entity aspiring to operate as a decentralised bank would establish such a short life window from the outset.

The infrastructure rests entirely on DigitalOcean name-servers. It is a perfectly legitimate cloud but designed for quick and inexpensive deployments, and thus easily dismantled or moved elsewhere should the project become problematic. It also lacks minimal DNS hardening components: DNSSEC has not been activated, nor are there any SPF or DMARC records, indications of very little attention to domain reputation and integrity.

The picture is complicated by looking at the homepage markup: the code delivered to the browser is a React shell devoid of static content, which only downloads obfuscated JavaScript bundles after loading. Even the URL app.ray.sx, remnant of a template reused by another application, appears within the meta-tags. This structure prevents crawlers and anti-phishing tools from inspecting the site without executing code – a recurring pattern in front-ends used as bait for wallet-drain operations.

The VirusTotal analysis returns an even more compromising picture. Two reputation engines – alphaMountain.ai and Forcepoint ThreatSeeker – classify defibank.online as ‘Suspicious’ and even ‘hacking’ respectively.

alphaMountain.ai: Suspicious – Forcepoint: Hacking/tool

These are not isolated false positives: the site was first sent to VirusTotal on 8 March 2024 and re-examined until 19 March 2025, a sign that the domain or IP had been on the blacklist radar for a long time.

The HTTP response confirms that the host (65.109.173.253) serves a simple Nginx on Ubuntu; the body of the home page weighs a mere 9 KB, a further indication of a front-end reduced to the bone that refers all logic to external JavaScript bundles. Most striking is the Open Graph section: the og:url tag points to app.ray.sx, a domain unrelated to the alleged banking project and already identified in the site’s markup. The preview image, the title (‘Buy $BANK…’) and the bombastic description confirm the purely promotional nature of the landing page, in stark contrast to the claim of institutional seriousness.

Finally, five tracking platforms emerge in the traffic – Google Analytics, Google Tag Manager, Facebook Pixel, Yandex Metrica and Facebook Custom Audience – an abnormal density for a product that proclaims itself ‘decentralised’ and attentive to user privacy. In summary, VirusTotal does not detect executable malware, but it does gather a number of risk signals (hacking classification, inconsistent meta-tags, massive tracking) that reinforce what has already been observed at the domain and site structure level: DefiBank.online acts more like an advertising funnel than a reliable financial platform.

The rebus of the $BANK token

Once past the front of the site, one discovers that the entire project revolves around a utility token called $BANK. It is here that the inconsistencies become macroscopic.

The token is presented with a pre-mining phase, then an Angel fund-raising round (with a price of $0.04), followed by a Pre-Seed round at $0.07 and a Seed round at $0.1. According to the project’s statements, the token will be launched on two chains (ETH and BNB) and will be listed on tier-one exchanges by the third quarter of 2025. In total, $BANK will have a supply of 1 billion units, to be released over a period of 18