TokenWorks Voting Rewards Scam: The Fake TPF Allocation and Wallet Trap

A TokenWorks page invites holders to choose a rewards date. Voting appears to come with an extra benefit, an early allocation from a treasury pool.

It sounds like a small community decision rather than a financial transaction. That difference is exactly why the next screen deserves your attention.

Overview

A rewards-date vote becomes the reason to involve your wallet

The TokenWorks Voting Rewards scam uses a community-governance pretext. Holders are invited to vote on an upcoming rewards date and supposedly receive an allocation for participating.

The page identifies the promised pool as TPF, meaning Treasury Pool Funds. A prominent Vote button makes the offer look like an ordinary project update.

The image above is our original capture of the suspicious page. It shows the advertised benefit, not proof that any genuine treasury distribution exists.

The imitation lives outside the project’s established domain

The reported page uses vote-tokensworks-net.pages[.]dev. Its spelling also adds an extra “s” to the TokenWorks name, a detail easy to miss when scanning quickly.

The real TokenWorks website is token.works. Its public project page describes an onchain creative studio and links to selected works and established social profiles.

• The lookalike offers an early allocation in exchange for a seemingly simple vote.
• Its domain is different from the studio’s established address.
• The original page’s visual language helps the imitation feel familiar.
• Wallet requests must be judged by their actual permissions, not the word Vote.

The reported objective is cryptocurrency theft

The campaign has been identified as a wallet-draining scheme. We captured the public page without connecting a wallet or approving a request.

The exact contract, signature, and transfer sequence were not reproduced. Do not confuse the site’s visible invitation with an independently tested transaction flow.

TokenWorks is the platform being impersonated. This warning does not accuse the genuine studio or the companies whose wallet names appear in a connection dialog.

The Real Studio and the Extra Rewards Banner

The imitation does not need to invent an entire business identity. It can reuse a distinctive name, familiar wording, and a recognizable page structure.

On the official TokenWorks site, selected projects sit alongside links to the studio’s existing public channels. Those are useful starting points for checking an announcement independently.

The capture below shows that genuine page for comparison. It is not the fraudulent voting offer shown at the start of this article.

The suspicious page places its rewards invitation ahead of the familiar studio presentation. That added task is the part requiring scrutiny.

Knowing the studio exists does not answer whether a treasury program was announced. Nor does finding a similar-looking page establish who controls its Vote button.

A project may use external services legitimately. The correct question is whether the actual project identifies that particular service and explains the requested interaction.

A hyperlink supplied only by the rewards page cannot provide independent confirmation. It is still the same unverified source sending you to the next step.

If you ask the real project about the offer, send the suspicious address and a screenshot. There is no reason to provide your seed phrase for an authenticity check.

A reply demanding that phrase should end the conversation, even if the account uses the studio’s name and profile image.

How the TokenWorks Voting Rewards Scam Works

Step 1: Familiar project styling gives the invitation a head start

Crypto communities see frequent updates about launches, experiments, proposals, and allocations. A rewards announcement can fit naturally among genuine project communications.

The page takes advantage of that environment. Its presentation encourages visitors to recognize a project first and evaluate the new task second.

Some readers will arrive through a forwarded link or public post. A friend sharing it does not prove that the friend verified the domain or transaction.

Others may recognize the studio’s existing work and assume the banner is another experiment. Familiarity with one project should not authenticate an unrelated rewards route.

Start with the established project address, not the new voting page. Check whether the same announcement and destination appear through a channel you independently trust.

Step 2: An early allocation turns a preference into an opportunity

The proposed activity is modest: help decide when rewards arrive. The extra allocation makes participation feel worthwhile without initially resembling a purchase.

This is more persuasive than a bare demand for money. The reader believes they are contributing to a community and receiving something for that contribution.

The treasury terminology adds an administrative layer. A pool with an acronym can sound established even when the visitor has seen no governance document or distribution terms.

Ask what the allocation actually represents. Which asset, account, eligibility rule, and announcement support it? A slogan cannot answer those questions.

The offer should survive a pause for verification. Do not let the possibility of being early push you past questions you would ask before an ordinary transaction.

Step 3: The vote leads toward a wallet interaction

The reported flow introduces wallet connection after the voting control. That is where a community task can become a request involving a financial account.

Wallet connection can be normal for legitimate applications. Its presence alone does not establish fraud, but neither does familiarity with the popup establish safety.

A connection request typically identifies an account to the application. An approval, transaction, or signed authorization can grant something more.

Those are separate decisions. The website’s invitation to vote does not preauthorize every request its interface sends afterward.

If the wallet shows an unexpected network or account, stop. Do not switch accounts or chains simply because the page says that will make the allocation appear.

Step 4: The wording on the page can disguise the requested permission

A button marked Vote can initiate something other than recording a preference. The meaningful information is in the wallet request and the transaction it represents.

For compatible tokens, a spending approval can give another address permission to move an asset. That is not the same as selecting a date.

An off-chain signature also deserves attention. Some signed messages authenticate a session, while others can support financial authorization. Being gasless does not make every signature harmless.

The original vote dialog and authorization were not tested for this article. These are distinctions to apply to your actual exposure, not invented details of a reproduced drain.

If you cannot explain why the requested permission is necessary, decline it. A legitimate community activity does not require surrendering your ability to make an informed decision.

Step 5: A successful-looking vote can hide unresolved wallet access

The user may focus on whether participation was recorded or whether an allocation appears. An imitation page can display either without establishing a legitimate transaction.

Meanwhile, an authorization can remain relevant after the browser closes. Disconnecting a website and removing an on-chain spending permission are different operations.

Review what your wallet actually recorded. The permission’s scope, the affected asset, and the network matter more than a confirmation message on the rewards page.

Do not reconnect repeatedly to repair a failed-looking vote. Repeated prompts can create more opportunities to authorize something you did not intend.

If somebody offers to fix the claim through a direct message, verify them independently. The same rewards story can be followed by a separate support impersonation.

What a Treasury-Reward Claim Should Explain

You do not need to read smart-contract code to notice missing basics. Start with the proposed program rather than the wallet popup.

Who announced the treasury allocation? Which published proposal defines it? Where are the dates, eligibility conditions, and exact asset identified?

A real answer should be available outside the page asking you to participate. Repeating the same banner on another lookalike address is not independent verification.

Likewise, comments saying someone received tokens are not transaction validation. A screenshot of a balance can be fabricated or show an unrelated asset with a similar name.

Even an authentic transaction hash needs interpretation. It identifies a transaction, not a promise that the sender is the project or that your request is identical.

Be especially cautious when checking eligibility suddenly requires broad spending access. A limited community preference should have a clear explanation for any financial permission involved.

Read the Hostname Before Trusting the Interface

A pages[.]dev address indicates a site hosted through Cloudflare Pages. It is not, by itself, a TokenWorks-controlled address or an endorsement by Cloudflare.

Legitimate developers also use hosted pages. The problem is the impersonated project relationship and unsafe reward flow, not every website sharing the hosting suffix.

Read the complete hostname rather than recognizing one familiar word. In this example, the extra letter and hyphenated construction can disappear into an otherwise plausible-looking address.

A browser padlock does not settle the question. An encrypted connection can still deliver your information and approvals to an operator you should not trust.

If the page is gone when you check, do not search for a replacement claim mirror. An inactive link is not an instruction to find another way in.

What to Do if You Have Fallen Victim to This Scam

It helps to separate the event into what you saw, what you connected, and what you authorized. You do not need perfect recall to start protecting yourself.

1. Reject anything still waiting for approval. Close the rewards page and cancel pending wallet requests. Do not complete another vote to test whether the first one worked.

   Save the suspicious address and the approximate time. Avoid sharing a live claim link publicly when a defanged address or screenshot will explain the incident.

2. Check the wallet’s own activity records. Identify the account and network involved, then look for signed requests, new permissions, and outgoing transfers around that time.

   A normal connection without another authorization is different from a confirmed transfer. Give support the facts you can establish rather than assuming every connected account was emptied.

3. Remove suspicious spending access where applicable. Use built-in wallet controls or a tool reached through the provider’s verified documentation. Inspect the actual contract and asset.

   MetaMask explains token approvals and revocation. That guidance concerns compatible account and token models, not every blockchain or wallet arrangement.

   Disconnecting the page alone may leave an approval active. Revoking an approval does not restore assets already transferred or invalidate every possible signature.

4. Act differently if a recovery phrase was entered. Treat the keys as exposed, even if you later changed the wallet application’s password.

   Follow your provider’s genuine compromised-wallet guidance from a trustworthy device. Do not reuse the same phrase for a supposedly new wallet or give it to a helper.

5. Preserve the details needed for financial reporting. Keep transaction hashes, recipient addresses, affected token contracts, dates, amounts, and screenshots of relevant requests.

   These records can help a wallet provider, exchange, or investigator. They do not require disclosing the private keys that authorize future transactions.

6. Report the project impersonation through established channels. Start from the real TokenWorks website and its linked profiles, not a support account introduced by the voting page.

   If funds reached an identifiable custodial service, notify that service quickly. US residents can also report through IC3; other readers should use their local cybercrime reporting route.

7. Check software only if there was a software exposure. An installed extension, downloaded application, or unexpected remote session creates a concern separate from an unsafe wallet permission.

   Malwarebytes may help investigate those additions. AdGuard can reduce some unwanted advertising during browsing. Neither tool cancels a blockchain authorization or guarantees stolen assets will return.

8. Warn anyone you sent the offer to. Explain which domain and voting claim were involved, without accusing a friend or the real project of operating the scam.

   Reject follow-up offers promising guaranteed recovery for an advance payment. A public transaction record can give a stranger convincing details without giving them recovery powers.

Frequently Asked Questions

Is TokenWorks itself being called a scam?

No. The warning concerns the lookalike voting-rewards page. The genuine studio’s existence and projects do not authenticate that separate offer.

What is the TPF allocation promised by the page?

The imitation calls it Treasury Pool Funds and links early allocation to voting. Those words are claims inside the lure, not confirmation of a genuine distribution.

Why can a simple vote involve a dangerous wallet request?

The website controls which request it sends to your wallet. A vote label can hide a request for spending access or another authorization unrelated to choosing a date.

Does a familiar wallet popup mean the project is verified?

No. Your wallet can display a request from an untrusted site. Verify the destination and the requested operation instead of relying on recognizable wallet branding.

Do I need a new wallet after connecting but signing nothing?

A connection alone does not ordinarily disclose private keys or authorize spending. End the session and check activity before assuming the exposure requires replacement of every account.

Can the vote page refund an unauthorized transfer?

Do not trust its refund instructions. Report the incident through genuine wallet, exchange, project, and law-enforcement channels, while understanding that settled transfers have no guaranteed reversal.

The Bottom Line

Do not vote through the TokenWorks rewards lookalike. Its early-allocation promise does not establish an authorized treasury program or justify unsafe wallet permissions.

If you participated, inspect the actual requests and transactions rather than the page’s success message. Remove relevant unauthorized access and report any loss without paying recovery impostors.