BaFin Warnings 2026: 24 Crypto Platform Series With 639 Domains, and How to Check Your Provider

Germany's Federal Financial Supervisory Authority issued another warning on August 7, 2026 about a group of websites that resemble one another right down to the wording. It was the twenty-fourth warning of its kind this year. Notices like these usually pass unnoticed in the news flow: three or five addresses, a sober two-liner from the regulator, no losses quantified.

Taken together they paint a different picture. We therefore counted BaFin's entire stock of warnings. This analysis was compiled by cryptoticker.io on August 11, 2026. Method: using BaFin's expert search, all 34 results pages of the notice format were retrieved, the consumer notices on unauthorised business were extracted, deduplicated and counted by year, series membership and domains named. That produced 2,194 warnings from the years 2022 to 2026, plus the full text of the 24 series notices published this year.

The finding is of immediate practical use to crypto investors: the number of warnings is no longer growing, but their design is changing. Fraudulent offerings increasingly appear as a series rather than as a single website.

What BaFin calls a platform series and how to spot one

The regulator has coined its own term for the phenomenon. Its consumer notices refer to a „platform series“ or a „series of near-identical websites“: sites so similar in structure, design and advertising copy that BaFin covers them in a single notice.

The core of these notices is always the same sentence, in variants: according to BaFin's findings, the operators are offering banking business, financial services or crypto-asset services there without authorisation. The regulator has granted them no licence.

For you as a user, the series format is more dangerous than the individual case. Anyone who googles an address and finds nothing negative often reads that as reassurance. With a series, that is precisely what you would expect: the domain is new, without history, without reviews, without complaints. The template behind it is old, the specific address is not.

An analysis of 2,194 BaFin warnings: 397 notices in 2026 alone

By our count, the stock of warnings breaks down by year as follows:

The low figures for 2022 and 2023 say nothing about conditions at the time; it is more likely that older notices were removed from the stock. Only the two most recent years are therefore reliably comparable.

And there, something emerges that contradicts the widespread impression of a fraud wave growing ever faster. 397 notices in 223 days works out at an annual rate of roughly 650, against 709 in 2025. The number of warnings is stagnating rather than exploding. Within the year it fluctuates markedly: April was strikingly quiet at 33 notices, while July was the strongest month at 69.

24 series notices with 639 domains: the figures from our own count

The design is where it gets interesting. We counted every notice whose title identifies it as a platform series or a series of near-identical websites.

While the total number of warnings is edging down, the share of series notices has more than quintupled within two years. Extrapolated, 2026 is heading for around 39 series warnings.

The 24 series notices published this year list 639 domains individually between them. None of them appears in two different notices. The remaining 373 warnings of the year, by contrast, overwhelmingly concern a single provider each.

In at least eight of the 24 series, BaFin explicitly names crypto-asset services in the decisive sentence. In six further cases the sentence could not be assigned automatically because the regulator words it differently. The number of crypto series is therefore higher than eight; exactly how much higher, we were unable to establish.

204 of the 639 domains end in .de: why the suffix says nothing about a licence

By our count, the domain endings of the 639 addresses break down as follows: 239 end in .com, 204 in .de, 109 in .net and 69 in .org. The rest are spread across smaller endings such as .pro, .app or .io.

Almost every third address warned about therefore carries the German country suffix. That is the single most important practical finding of this analysis, because many investors read the suffix as an indication of supervision and legal recourse. A .de domain can be had from any registrar; it presupposes neither a German business address nor a BaFin licence. The same applies to a legal notice, a phone number and a euro account.

Licensing requirements for crypto-asset services: what MiCA and the German Crypto Markets Supervision Act demand

Since the European MiCA regulation took full effect and Germany embedded it through the Crypto Markets Supervision Act, the legal position is unambiguous. Anyone offering crypto-asset services commercially in Germany, meaning trading, exchange, custody or intermediation, needs a BaFin licence and then appears in public registers.

That has simplified the check for you. It used to be contested whether an offering fell under German supervision at all. Today the rule is this: a provider targeting German customers that appears in no official register is very probably operating without authorisation. Which providers have actually been through the licensing process is set out in our overview of regulated crypto exchanges.

The licence is not a verdict on fees or usability. The entry says that a company exists, has been vetted and answers to a supervisor you can turn to. What the licensing requirement means for individual products is something we described in detail using the example of staking under MiCA.

The BaFin company database: how to check a licence in minutes

BaFin maintains a public company database listing every supervised institution with its name, registered office and type of licence. The comparison takes less than five minutes and is the only step that reliably separates a legitimate platform from a series copy.

What matters in the comparison

Search for the company name from the legal notice, not for the website's brand name; with unauthorised offerings the two frequently diverge. No result is itself a result. Where there is a hit, compare the registered office and legal form against the legal notice. If anything differs, the register entry prevails.

Pay attention as well to what the database records as the licence. A licence for payment services does not cover crypto trading. That very blurriness is what many questionable offerings work with, invoking a licence that does exist but was granted for something else entirely. The database is available directly from the BaFin company database.

The ESMA register of CASPs: the second check for providers based elsewhere in the EU

Many providers with German customers are licensed in another member state and operate from there under a European passport. These firms do not necessarily appear in the BaFin database, but they do appear in the register of the European Securities and Markets Authority, which lists the licensed crypto service providers of all member states.

In practice that means a miss in the BaFin database is not yet proof. Only when a provider is absent from both registers is the matter settled. Conversely, an entry in the ESMA register confirms the licence alone and says nothing about how your holdings are kept.

The series of March 11, 2026: 248 domains in a single warning

How industrially these offerings are produced is clear from one notice. On March 11, 2026, BaFin warned about a series of near-identical websites and, by our count, listed 248 domains in it. In the decisive sentence the regulator names financial and crypto-asset services said to be offered there without authorisation.

Three further notices this year run to 92, 59 and 48 domains. At the other end are series with only two or three addresses; the median is five. An uncomfortable conclusion follows: putting another copy online costs the operators almost nothing, while every single warning requires investigation, documentation and publication on the regulator's side.

Why a BaFin warning is never complete, and what follows for your own check

BaFin itself points out that its warnings can never be complete, because there are many dubious providers and their methods change constantly. That qualification matters more than it sounds.

It means the absence of a warning proves nothing. Anyone who looks for an address on the warning list and fails to find it has established only that the regulator has not so far commented on that address. With a series platform registered three weeks ago, that is exactly what you would expect.

The check therefore has to run the other way round. The question that holds up is whether a provider appears in a licensing register. The warning list collects individual cases, the register is exhaustive; only the second source allows a firm no. A practical guide to recognising forged payment demands issued in an exchange's name can be found in our article on phishing after the MiCA deadline.

Features that recur in the notices analysed

• An advertising promise in the header that reappears in slightly modified form on other domains.
• A legal notice without a commercial register number, or with a number that cannot be found in the register.
• A sign-up process that demands a deposit before the platform even becomes fully visible.
• An account that displays profits but ties withdrawals to additional payments.

If money has already changed hands: police report, bank and the top-up demand

If you have already paid in, one thing counts above all: make no further payment. Being asked to transfer taxes, fees or a deposit first in order to release a supposed withdrawal is part of the standard repertoire. BaFin explicitly advises consumers to exercise great caution with online investments and to research thoroughly before the first transfer.

Three parallel steps make sense: a report to the police, an immediate notification to your own bank or payment service provider, and a tip-off to BaFin, which feeds such reports into its investigations. With card payments and direct debits there are recovery options that deteriorate by the day. With an international transfer or a payment in cryptocurrency the prospects are slim, but the documentation remains important for investigations and tax questions.

This analysis rests on the regulator's publications, not on loss figures. How much money flowed through the 639 domains, how many people are affected and how many of the addresses are still reachable today does not emerge from the notices and we were unable to verify it. Nor can it be established whether the same operators are behind several of the series.

What to take away

1. Check the register, not the warning list. Search for the company name from the legal notice in the BaFin company database and, if the provider is based elsewhere in the EU, in the ESMA register. A provider missing from both is out of the question. Which exchanges pass this check is shown in our overview of regulated crypto exchanges.
2. Do not let the suffix or the language reassure you. 204 of the 639 domains warned about this year end in .de. Compare the fees, custody arrangements and registered offices of licensed providers instead, for example in our crypto exchange comparison.
3. Separate trading from custody. Keep only what you need in the short term on the trading platform and store the rest yourself. Which devices are suitable and what they cost is set out in our hardware wallet comparison.

You can inspect the basis of this analysis yourself at any time: at the BaFin warning notices.

(As of August 11, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)