Our guide to RPC endpoints explains that your wallet does not talk to Base directly. It sends every balance check and every transaction through an RPC endpoint, a web address run by a node operator that relays your request to the real network and hands back the answer. That article notes that getting an RPC URL wrong is usually just inconvenient, since a broken endpoint simply fails to connect. There is one case where it is more than inconvenient: when the endpoint is not broken, but fake, and built specifically to show you something that is not true.
The scam in outline
Security teams and wallet support pages have documented a consistent pattern, often described as RPC node tampering or a fake RPC scam. It usually starts with a conversation rather than a technical attack. Someone, often posing as a new contact, a support agent, or a source of a below market crypto deal, builds some trust first. A small real transaction is sometimes involved early on, to make everything that follows look legitimate.
The pitch then asks you to add a custom network or a custom node to your wallet, giving you a specific RPC URL to enter by hand. Once your wallet is pointed at that address instead of a real Base or Ethereum endpoint, every balance your wallet shows for that network is whatever that fake endpoint decides to return, not what is actually on-chain. Reports describe victims being shown a large token balance that simply does not exist anywhere on the real blockchain. When they try to withdraw or sell it, they are told they first need to pay a fee, in real crypto, to unlock the transfer. The fee is the actual theft. The balance itself was never real to begin with.
Why this is possible at all
This works because of a detail covered in the RPC endpoint guide: your wallet trusts whatever endpoint it is configured to talk to. A legitimate endpoint relays real answers from real nodes. A custom RPC URL controlled by a scammer can be built using blockchain development and testing tools, such as fork or simulation features meant for developers to test code against a safe, private copy of a network's state. Those tools are legitimate on their own. The misuse is pointing an ordinary wallet at one and presenting the result as if it were the live network. Your wallet has no built in way to tell a simulated fork from the real thing. It only knows the address it was told to query.
Some fake RPC URLs reported in these cases contain hints like "virtual," "fork," or a testing platform's name buried in the address, which is one sign something is off if you look closely before entering it. But the more reliable protection has nothing to do with spotting a suspicious string.
What a fake RPC endpoint cannot do
It is worth being precise here, since the scam depends on confusion about what is actually at risk. A malicious RPC endpoint cannot see your private key or your recovery phrase, and it cannot move real funds out of your wallet on its own. Those protections, covered in our guide on how your wallet stores your private key, do not depend on which RPC endpoint you are using. What a fake endpoint can do is lie to you about what is true on the real network, which is a different kind of risk, closer to being shown a forged bank statement than to having your vault cracked.
The actual loss in these scams happens at a separate, ordinary step: when you send real crypto, from a real balance, to pay a "fee" the scammer invented to unlock a balance that was never real. That transaction is genuine, and it goes to the scammer's address, regardless of what the fake endpoint displayed beforehand.
How to avoid it
- Never add a custom network or custom node at the request of someone you are chatting with, whether they reached out first or you found them through a deal that seemed too good to pass up. Legitimate services do not require you to manually add their infrastructure to unlock funds.
- Stick to the networks your wallet already has built in, or add a network only by typing in details from a project's own official documentation, the way our RPC endpoint guide recommends for Base specifically.
- Treat "pay a fee to unlock your balance" as a hard stop. This phrasing shows up across many unrelated scams, not just this one, and legitimate withdrawals never require sending funds first to release other funds.
- If a balance only appears after adding a network someone else told you to add, assume it does not exist anywhere else, including on a public block explorer, until you have checked independently through your wallet's default, trusted network settings.
- A real balance is confirmable in more than one place. If you cannot see the same balance by checking the address on a public block explorer using the real network, not the one you were told to add, that is the clearest sign something is wrong.
The calm summary
The RPC layer is ordinary, invisible infrastructure that your wallet relies on constantly, and nearly all of the time it works exactly as it should. The fake RPC scam is not a flaw in Base or in wallet software. It is a social engineering trick that uses a technical detail most users never examine closely, swapping a trusted endpoint for one built to lie, and then asking for a real payment to "release" a balance that was fabricated from the start. The fix is simple and does not require understanding node infrastructure: do not add custom networks or nodes on someone else's instruction, and treat any balance that appears only after doing so as fake until proven otherwise on the real chain.
Sources: Unveiling a New Scam: Malicious Modification of RPC Node Links to Steal Assets, SlowMist, Beware of custom RPC node scams, TokenPocket, Scammers leverage malicious ETH RPC nodes to target imToken wallet, crypto.news