The domain of the once privacy-focused Bitcoin wallet Samourai Wallet has reportedly been taken over by malicious actors and is now being used to host phishing infrastructure targeting crypto users.
According to blockchain security firm SlowMist, the domain, previously seized by the Federal Bureau of Investigation in August 2025, was likely allowed to lapse or auctioned earlier this month, enabling attackers to gain control.
The development marks a concerning turn for users familiar with the original project, which had ceased operations in 2024.
Security researchers warn that the compromised domain is no longer associated with the original Samourai Wallet team and is actively being used to target Bitcoin holders through phishing campaigns.
The attackers are believed to be attempting to trick users into revealing sensitive wallet credentials or private keys.
Further analysis has revealed suspicious activity across several subdomains, including one previously used to host malicious files such as trojanized PDFs. One such file, disguised as educational material titled “Cryptocurrency Mining For Dummies,” was likely designed to deliver malware to unsuspecting users.
Investigators also noted that the domain is currently registered under privacy protection, making it difficult to identify the new owner.
Despite multiple reports submitted to domain registrar Namecheap, no immediate action has been taken to suspend or remove the malicious infrastructure.
The incident highlights the growing risks associated with abandoned or seized crypto-related domains, which can later be repurposed by threat actors to exploit user trust.
Experts advise users to avoid interacting with any websites associated with the Samourai Wallet domain and to verify sources before downloading files or entering sensitive information.
As phishing attacks in the crypto space continue to rise, this case underscores the importance of vigilance and proper domain management following enforcement actions or project shutdowns.
