![\"Original](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/11\/capture-tokenworks.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nA rewards-date vote becomes the reason to involve your wallet<\/h3>\n
The TokenWorks Voting Rewards scam uses a community-governance pretext. Holders are invited to vote on an upcoming rewards date and supposedly receive an allocation for participating.<\/p>\n
The page identifies the promised pool as TPF, meaning Treasury Pool Funds. A prominent Vote button makes the offer look like an ordinary project update.<\/p>\n
The image above is our original capture of the suspicious page. It shows the advertised benefit, not proof that any genuine treasury distribution exists.<\/p>\n
The imitation lives outside the project’s established domain<\/h3>\n
The reported page uses vote-tokensworks-net.pages[.]dev. Its spelling also adds an extra \u201cs\u201d to the TokenWorks name, a detail easy to miss when scanning quickly.<\/p>\n
The real TokenWorks website is token.works. Its public project page describes an onchain creative studio and links to selected works and established social profiles.<\/p>\n
- \n
- The lookalike offers an early allocation in exchange for a seemingly simple vote.<\/li>\n
- Its domain is different from the studio’s established address.<\/li>\n
- The original page’s visual language helps the imitation feel familiar.<\/li>\n
- Wallet requests must be judged by their actual permissions, not the word Vote.<\/li>\n<\/ul>\n
The reported objective is cryptocurrency theft<\/h3>\n
The campaign has been identified as a wallet-draining scheme. We captured the public page without connecting a wallet or approving a request.<\/p>\n
The exact contract, signature, and transfer sequence were not reproduced. Do not confuse the site’s visible invitation with an independently tested transaction flow.<\/p>\n
TokenWorks is the platform being impersonated. This warning does not accuse the genuine studio or the companies whose wallet names appear in a connection dialog.<\/p>\n
The Real Studio and the Extra Rewards Banner<\/h2>\n
The imitation does not need to invent an entire business identity. It can reuse a distinctive name, familiar wording, and a recognizable page structure.<\/p>\n
On the official TokenWorks site<\/a>, selected projects sit alongside links to the studio’s existing public channels. Those are useful starting points for checking an announcement independently.<\/p>\n
The capture below shows that genuine page for comparison. It is not the fraudulent voting offer shown at the start of this article.<\/p>\n
![\"Original](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/11\/capture-tokenworks-official.png\" "\\"\\"")
<\/figure>\nThe suspicious page places its rewards invitation ahead of the familiar studio presentation. That added task is the part requiring scrutiny.<\/p>\n
Knowing the studio exists does not answer whether a treasury program was announced. Nor does finding a similar-looking page establish who controls its Vote button.<\/p>\n
A project may use external services legitimately. The correct question is whether the actual project identifies that particular service and explains the requested interaction.<\/p>\n
A hyperlink supplied only by the rewards page cannot provide independent confirmation. It is still the same unverified source sending you to the next step.<\/p>\n
If you ask the real project about the offer, send the suspicious address and a screenshot. There is no reason to provide your seed phrase for an authenticity check.<\/p>\n
A reply demanding that phrase should end the conversation, even if the account uses the studio’s name and profile image.<\/p>\n
How the TokenWorks Voting Rewards Scam Works<\/h2>\n
Step 1: Familiar project styling gives the invitation a head start<\/h3>\n
Crypto communities see frequent updates about launches, experiments, proposals, and allocations. A rewards announcement can fit naturally among genuine project communications.<\/p>\n
The page takes advantage of that environment. Its presentation encourages visitors to recognize a project first and evaluate the new task second.<\/p>\n
Some readers will arrive through a forwarded link or public post. A friend sharing it does not prove that the friend verified the domain or transaction.<\/p>\n
Others may recognize the studio’s existing work and assume the banner is another experiment. Familiarity with one project should not authenticate an unrelated rewards route.<\/p>\n
Start with the established project address, not the new voting page. Check whether the same announcement and destination appear through a channel you independently trust.<\/p>\n
Step 2: An early allocation turns a preference into an opportunity<\/h3>\n
The proposed activity is modest: help decide when rewards arrive. The extra allocation makes participation feel worthwhile without initially resembling a purchase.<\/p>\n
This is more persuasive than a bare demand for money. The reader believes they are contributing to a community and receiving something for that contribution.<\/p>\n
The treasury terminology adds an administrative layer. A pool with an acronym can sound established even when the visitor has seen no governance document or distribution terms.<\/p>\n
Ask what the allocation actually represents. Which asset, account, eligibility rule, and announcement support it? A slogan cannot answer those questions.<\/p>\n
The offer should survive a pause for verification. Do not let the possibility of being early push you past questions you would ask before an ordinary transaction.<\/p>\n
Step 3: The vote leads toward a wallet interaction<\/h3>\n
The reported flow introduces wallet connection after the voting control. That is where a community task can become a request involving a financial account.<\/p>\n
Wallet connection can be normal for legitimate applications. Its presence alone does not establish fraud, but neither does familiarity with the popup establish safety.<\/p>\n
A connection request typically identifies an account to the application. An approval, transaction, or signed authorization can grant something more.<\/p>\n
Those are separate decisions. The website’s invitation to vote does not preauthorize every request its interface sends afterward.<\/p>\n
If the wallet shows an unexpected network or account, stop. Do not switch accounts or chains simply because the page says that will make the allocation appear.<\/p>\n
Step 4: The wording on the page can disguise the requested permission<\/h3>\n
A button marked Vote can initiate something other than recording a preference. The meaningful information is in the wallet request and the transaction it represents.<\/p>\n
For compatible tokens, a spending approval can give another address permission to move an asset. That is not the same as selecting a date.<\/p>\n
An off-chain signature also deserves attention. Some signed messages authenticate a session, while others can support financial authorization. Being gasless does not make every signature harmless.<\/p>\n
The original vote dialog and authorization were not tested for this article. These are distinctions to apply to your actual exposure, not invented details of a reproduced drain.<\/p>\n
If you cannot explain why the requested permission is necessary, decline it. A legitimate community activity does not require surrendering your ability to make an informed decision.<\/p>\n
Step 5: A successful-looking vote can hide unresolved wallet access<\/h3>\n
The user may focus on whether participation was recorded or whether an allocation appears. An imitation page can display either without establishing a legitimate transaction.<\/p>\n
Meanwhile, an authorization can remain relevant after the browser closes. Disconnecting a website and removing an on-chain spending permission are different operations.<\/p>\n
Review what your wallet actually recorded. The permission’s scope, the affected asset, and the network matter more than a confirmation message on the rewards page.<\/p>\n
Do not reconnect repeatedly to repair a failed-looking vote. Repeated prompts can create more opportunities to authorize something you did not intend.<\/p>\n
If somebody offers to fix the claim through a direct message, verify them independently. The same rewards story can be followed by a separate support impersonation.<\/p>\n
What a Treasury-Reward Claim Should Explain<\/h2>\n
You do not need to read smart-contract code to notice missing basics. Start with the proposed program rather than the wallet popup.<\/p>\n
Who announced the treasury allocation? Which published proposal defines it? Where are the dates, eligibility conditions, and exact asset identified?<\/p>\n
A real answer should be available outside the page asking you to participate. Repeating the same banner on another lookalike address is not independent verification.<\/p>\n
Likewise, comments saying someone received tokens are not transaction validation. A screenshot of a balance can be fabricated or show an unrelated asset with a similar name.<\/p>\n
Even an authentic transaction hash needs interpretation. It identifies a transaction, not a promise that the sender is the project or that your request is identical.<\/p>\n
Be especially cautious when checking eligibility suddenly requires broad spending access. A limited community preference should have a clear explanation for any financial permission involved.<\/p>\n
Read the Hostname Before Trusting the Interface<\/h2>\n
A pages[.]dev address indicates a site hosted through Cloudflare Pages. It is not, by itself, a TokenWorks-controlled address or an endorsement by Cloudflare.<\/p>\n
Legitimate developers also use hosted pages. The problem is the impersonated project relationship and unsafe reward flow, not every website sharing the hosting suffix.<\/p>\n
Read the complete hostname rather than recognizing one familiar word. In this example, the extra letter and hyphenated construction can disappear into an otherwise plausible-looking address.<\/p>\n
A browser padlock does not settle the question. An encrypted connection can still deliver your information and approvals to an operator you should not trust.<\/p>\n
If the page is gone when you check, do not search for a replacement claim mirror. An inactive link is not an instruction to find another way in.<\/p>\n
What to Do if You Have Fallen Victim to This Scam<\/h2>\n
It helps to separate the event into what you saw, what you connected, and what you authorized. You do not need perfect recall to start protecting yourself.<\/p>\n
- \n
- \n
Reject anything still waiting for approval.<\/strong> Close the rewards page and cancel pending wallet requests. Do not complete another vote to test whether the first one worked.<\/p>\n
Save the suspicious address and the approximate time. Avoid sharing a live claim link publicly when a defanged address or screenshot will explain the incident.<\/p>\n<\/li>\n
- \n
Check the wallet’s own activity records.<\/strong> Identify the account and network involved, then look for signed requests, new permissions, and outgoing transfers around that time.<\/p>\n
A normal connection without another authorization is different from a confirmed transfer. Give support the facts you can establish rather than assuming every connected account was emptied.<\/p>\n<\/li>\n
- \n
Remove suspicious spending access where applicable.<\/strong> Use built-in wallet controls or a tool reached through the provider’s verified documentation. Inspect the actual contract and asset.<\/p>\n
MetaMask explains token approvals and revocation<\/a>. That guidance concerns compatible account and token models, not every blockchain or wallet arrangement.<\/p>\n
Disconnecting the page alone may leave an approval active. Revoking an approval does not restore assets already transferred or invalidate every possible signature.<\/p>\n<\/li>\n
- \n
Act differently if a recovery phrase was entered.<\/strong> Treat the keys as exposed, even if you later changed the wallet application’s password.<\/p>\n
Follow your provider’s genuine compromised-wallet guidance from a trustworthy device. Do not reuse the same phrase for a supposedly new wallet or give it to a helper.<\/p>\n<\/li>\n
- \n
Preserve the details needed for financial reporting.<\/strong> Keep transaction hashes, recipient addresses, affected token contracts, dates, amounts, and screenshots of relevant requests.<\/p>\n
These records can help a wallet provider, exchange, or investigator. They do not require disclosing the private keys that authorize future transactions.<\/p>\n<\/li>\n
- \n
- \n
- \n