As the indispensable trading platforms of the ecosystem, hundreds of cryptocurrency exchanges are emerging to facilitate the trading of digital assets. While, it also attracts the attentions of attackers. A number of scam attacks were reported targeting cryptocurrency exchanges, leading to a huge mount of financial loss. However, no previous work in our research community has systematically studied this problem. In this paper, we make the first effort to identify and characterize the cryptocurrency exchange scams. We first identify over 1,500 scam domains and over 300 fake apps, by collecting existing reports and using typosquatting generation techniques. Then we investigate the relationship between them, and identify 94 scam domain families and 30 fake app families. We further characterize the impacts of such scams, and reveal that these scams have incurred financial loss of 520k US dollars at least. We further observe that the fake apps have been sneaked to major app markets (including Google Play) to infect unsuspicious users. Our findings demonstrate the urgency to identify and prevent cryptocurrency exchange scams. To facilitate future research, we have publicly released all the identified scam domains and fake apps to the community.

中文翻译：

---

表征加密货币交易骗局

作为生态系统不可或缺的交易平台，数以百计的加密货币交易所不断涌现，以促进数字资产的交易。同时，它也引起了攻击者的注意。据报道，许多针对加密货币交易所的诈骗攻击导致了巨大的经济损失。然而，我们研究界以前的工作都没有系统地研究过这个问题。在本文中，我们首先努力识别和描述加密货币交易骗局。我们首先通过收集现有报告并使用域名抢注生成技术，识别出 1,500 多个诈骗域和 300 多个虚假应用程序。然后我们调查它们之间的关系，并确定了 94 个诈骗域家族和 30 个虚假应用家族。我们进一步描述了此类骗局的影响，并透露这些骗局至少造成了52万美元的经济损失。我们进一步观察到，假冒应用已潜入主要应用市场（包括 Google Play）以感染不可疑的用户。我们的研究结果表明识别和预防加密货币交易诈骗的紧迫性。为了促进未来的研究，我们已向社区公开发布了所有已识别的诈骗域和虚假应用程序。