How to tell a crypto card's real site from a wallet-drainer clone

The two sites

The genuine product lives at app.offgrid.cash (the bare offgrid.cash redirects there). It is an invite-only, no-KYC virtual card funded with crypto. To get in you need a code in the format OG-XXXX, which the project hands out free in replies under its own posts. The claim page shows a card, three lines of copy, and one button.

The lookalike lives at offgridcash.com. It copies the genuine landing page closely, then changes the parts that matter. Where the original says "Up to $4,000/month," the copy says "Up to $20,000/month." It adds a "$10 Bonus on your first Visa card" and an "Apple Pay & Google Pay Ready" badge the real product cannot honor, because OffGrid does not support Apple Pay. It drops the code, too. No invite needed, and the card is issued on the spot.

The copy is close enough that it left fingerprints. The clone's fonts are the same files as the real site's build, down to a trial version of a paid typeface. Its privacy policy still says "when you use our website offgrid.cash." The footer of the original reads "© 2025 Off Grid LLC"; the copy dropped the "LLC." Whoever built it saved someone else's page and edited the visible text.

The company said it isn't theirs

You do not have to take our word for which site is real. On 2026-05-17 the OffGrid account posted, in full:

Fake OffGrid sites are circulating. One site to remember: app.offgrid.cash. That's it. Nothing else is us. We will never ask you to connect your wallet. Our product is invite only.

Three months later, on 2026-08-17, a user replied to the account asking "This one is a scam? https://offgridcash.com". The account answered: "Yes. Our only site is app.offgrid.cash".

One honest note on that exchange: the word "scam" was the user's, not the company's. What the company confirmed, answering a direct question, was that the domain is not theirs. The stronger statement is the one they wrote in May, unprompted: we will never ask you to connect your wallet. That sentence, from the company itself, is the test the rest of this piece just applies.

Five checks that catch a clone in a minute

None of these needs a wallet, a developer, or a single transaction. Run them before you type anything.

1. Match the domain to the product's own social profile, not to search. Search results and ads are bought; the link in the product's own bio is not. OffGrid's bio links to offgrid.cash, and only that. If the site in front of you is not the site the project links to itself, stop.

2. Ask why a card would want your wallet. A card needs a deposit address, which means you send to it. Connecting a wallet and signing an approval is the opposite direction. A prepaid card has no reason to ask for spend permission on your tokens. If it does, the "card" is not the product.

3. Treat a crypto "activation fee" as a red flag by itself. Real issuers take their fee out of the balance you load. They do not ask you to sign a transaction before the card exists. A one-time $2 activation fee that you pay by connecting your wallet is not a fee. It is the hook.

4. Log in with a wrong password on purpose. If a made-up email and any password let you in, the site has no backend. On the clone, the login form runs no network call at all: it waits two seconds and forwards you to a dashboard. A site that cannot tell a real account from a fake one is not running accounts.

5. Compare the promises to what the real product publishes. A clone is almost always more generous than the thing it copies, because it has no costs to cover. Higher limits, a bonus that appeared from nowhere, a payment method the original doesn't offer: each gap is a copy that was "improved" to close the sale.

The clone can outrank the real site

When we searched Google for "offgrid card" on 2026-08-25, the top result was the clone, sitting above the genuine app.offgrid.cash and above the project's own X account. We ran it twice, from a US-English search and a Russian-language one. Same order both times.

A top ranking is not a safety check. These were the ordinary results, not ads: search rewards pages that are built to be found, and a clone whose whole site is a public marketing page can be built for exactly that. The real OffGrid barely exists for a search engine, an invite-gated app with almost nothing to crawl. On its own brand name, it lost the top spot to the copy. This is why the first check sends you to the link in the product's own profile, not to the first thing a search returns.

What the clone actually does

Reading the funnel screen by screen shows why those checks land. You do not need to understand the code to see the shape of it, only to notice that a card is never issued this way.

The dashboard is where a clone stops looking like a card. On offgridcash.com, it opens without any login and walks you through "Get Your Virtual Crypto Card in 2 Minutes," gated behind a one-time $2 fee. The steps are numbered: Link Your Wallet → Approve Our Payment Layer → Set Your Card Limits.

"Approve Our Payment Layer" is the line to read twice. In an EVM wallet, an approval grants another address permission to move your tokens. Check Point Research, documenting this exact family of scams, describes the mechanism plainly: the approve method "grants permission to another address to spend a certain amount of tokens," and the theft then runs as two transactions. You approve, and afterward the attacker calls transferFrom and pulls the balance. The $2 is there so the wallet approval looks like a routine setup step. The approval is the part that costs you.

Everything around that screen fits the same reading. The wallet connector is set to work across dozens of chains at once, and a card that only ever needs one network does not shop across dozens. The page loads a full transaction library, a fingerprinting script that tags your device, and a call that records your IP before reporting to a remote endpoint. The connect-wallet button is hidden and clicks itself half a second after the page loads. A card gets issued without any of this. What you are looking at is the opening move of a drainer, which wants standing permission over the wallet rather than a single payment.

There is one limit we hold to. We did not connect a wallet, so we did not watch money leave. The "drainer" label here rests on behavior: the auto-connect, the approval step dressed as a fee, the multi-chain reach, the obfuscated code and the reporting endpoint. We think that behavior is enough to keep your wallet in your pocket, but it is not a court finding.

We are not the only ones reading it this way. ScamSniffer, an independent wallet-security tool, lists offgridcash.com in its public blocklist. Anyone who visits with its extension installed gets a "Deceptive site ahead" page that flags a phishing attempt on wallet credentials and transactions ending in stolen assets. That is a separate party, on its own signals, landing where we did. A blocklist is a heuristic, not a court ruling. But when a dedicated anti-scam tool and a plain read of the funnel agree, keeping your wallet closed is the easy call.

If you already connected a wallet there

Move quickly, in this order.

1. Cancel the permissions you granted. Open a tool like revoke.cash, connect the wallet, and cancel every approval you do not recognize. Do it on each network the site touched, not only the one you started on. An approval stays live until you cancel it.
2. Move your money to a new wallet. Create a fresh wallet on a device you trust, and send anything valuable to it before the approval can be used.
3. If you ever typed your recovery phrase (the 12 or 24 words) into that site, the wallet is compromised for good. Canceling approvals will not help, because the keys themselves are exposed. Move everything out and stop using it.
4. Have the less obvious permissions checked too (Permit2 allowances, account delegations). These can leave standing access even after a plain approval is cancelled, so it is worth a second look from someone who knows the tools.

A note on the real card, so this isn't mistaken for an endorsement

This piece says the clone is dangerous. It does not say the genuine OffGrid is safe to fund. Those are different claims, and only the first one is settled.

The real product discloses very little about who stands behind it. Its terms name the card issuer only as "a licensed card issuing partner," never a company; there is no legal entity, no ascertainable jurisdiction, and no governing-law clause in the document. Its own terms also say money loaded onto the card "cannot be withdrawn and must be spent," and that a closed account's card balance "will be forfeited." Independent evidence that the card works in the wild is thin. Whether the real OffGrid deserves your money is a question this article does not try to settle. The fake one is easier to judge. Do not connect a wallet to it.

How we checked this, and what we can't claim

• All checks were run on 2026-08-25. The clone's pages were opened in an isolated browser window; no wallet was connected, no form submitted, no invite code used.
• The "drainer" label is based on observed behavior, not on a theft we recorded. The malicious transaction only forms after a wallet connects, which we did not do.
• In the disavowal exchange, "scam" is the questioner's word. The company confirmed the domain is not theirs; it did not itself publish the word.
• Both domains hide their owners behind private registration. We have not tied the clone to any named person or company.
• The genuine offgrid.cash domain was registered 2025-07-07 per the registry record; a 2024 date that appears in some scanners did not check out.
• The Google ranking was captured on 2026-08-25 from two setups (a US-English search and a Russian-language one). Search results are personalized and change constantly, so treat that screenshot as a dated snapshot, not a fixed state.
• Clones move. If the funnel described here is gone by the time you read this, the tells have not changed. Run the five checks on whatever site is in front of you.

Frequently asked questions