Loop is non-custodial, which is the point of it: your wallet is yours and nobody else can move what is in it. The other side of that is real. Nobody can undo it for you either, so the defence has to happen before, not after.

Almost every loss we see starts the same way. Someone is helpful, urgent and convincing, and asks for one small thing.

Nobody from Loop will ever ask you for your private key, seed phrase, password, passkey, verification code, authentication code, API secret or session data. Not part of it, not to verify you, not in a screenshot, not on a screen share.

Loop does not use a seed phrase at all. There are no recovery words, and you were never given any. So if somebody asks you for your Loop seed phrase, that on its own tells you they are not from Loop.

Nobody from Loop will ever ask you to send funds to verify, unlock, restore or recover a wallet, to transfer assets to a support wallet, to install wallet software or an extension, or to sign something we have not explained.

If any message asks for one of those, it is a scam. There is no exception, and it does not matter who it appears to come from.

Your wallet is at wallet.looptech.io. That is the address to use, and the only place you should ever enter your private key. Nowhere else, ever.

The older address, cantonloop.com, is also ours. It is where wallets that have not moved yet still sign in, and it stays online while people move across. It is not a second home for your wallet: once you have moved, use wallet.looptech.io and nothing else. The move is covered in Moving your wallet to the new address.

Our other addresses:

Anything else is fake, however close it looks. Expect copies with a dash added, a letter swapped, or a different ending. A padlock in the address bar only means the connection is encrypted. It does not mean the site is ours.

Type the address yourself rather than following a link from an email, a post or a message. We will never send you a migration link, by email, by direct message or in a post. Moving your wallet to the new address starts inside your own wallet after you log in yourself, and that is the only way in.

More than one phishing campaign is using our name. Two have been confirmed running in October 2026, and both arrive by email.

The reward claim. The email copies our current branding closely and invites you to claim rewards for your activity. The button takes you to a site that asks you to connect your wallet. Neither the sender nor the site belongs to us, and anyone who connects a wallet there can lose everything in it. The addresses change often, so do not rely on recognising a particular one.

The security setting. The email claims something on your account has been switched off and needs to be turned back on, with a button to do it. Wording we have seen includes a claim that two-step verification was paused and can be re-enabled with one click.

Three things give these away.

First, we do not send emails like that. We will never write to you asking you to click through and re-enable a security setting.

Second, we will never email you a link to connect your wallet, and we do not run reward or airdrop claims that work that way. Connecting your wallet is something you start yourself, inside your own wallet, after you have typed the address in.

Third, look at the sender address rather than the display name. These come from domains that have nothing to do with us. The name in your inbox can say anything at all, and it proves nothing.

Do not click the button. If you want to check something about your account, open wallet.looptech.io yourself in a new tab, typed in by you. Forward the email to [email protected] with the full sender address if you can, because that helps us get the domain taken down.

If you have already connected your wallet to one of these sites, treat that wallet as compromised. Move what is left to a new wallet now, and write to us at [email protected].

Impersonators copy profile pictures, names, badges and roles. They message first, privately, often right after you have posted a problem in public. Real support does not do that.

Reach support yourself, through one of these and nothing else:

Do not trust an unsolicited direct message, even from what looks like a moderator or a team member.

These come up again and again:

All of them are the same scam wearing different clothes. Loop never asks for any of them, and invitation codes are not for sale by anyone.

A signing request can be dangerous even when it shows no transfer. A signature can grant permissions.

Do not approve requests from apps you do not know, messages you do not understand, unexpected delegations, requests whose details differ from what you intended to do, anything opened through a link someone sent you, or anything presented to you by "support".

If you cannot explain what a request does, do not sign it. Nothing is lost by refusing and checking first.

Act now, and do not be embarrassed. This happens to careful people.

Stop using that credential. Do not send it to us, and do not send us part of it. Message us straight away, from this page or at [email protected], and tell us what was shared and where.

We will be honest with you about what follows: we cannot freeze assets or reverse anything on the network. What we can do is look at what has happened and help you protect whatever you still control.

Message us immediately, from this page or at [email protected]. Do not sign, approve or cancel anything else while you wait.

Send us:

Again, honestly: we cannot freeze, cancel, reverse or recover a network transaction, and we will not tell you otherwise. We can read the record and tell you what happened, and that is often the difference between stopping the bleeding and losing more.

Do not click further links, do not reply, do not send funds, do not sign anything, and do not delete the messages.

Send us the URL, the username, screenshots and roughly when it happened, at [email protected]. Reporting it protects the next person as much as you.