PayHole

Scam links stop loading, and drainers stop before your wallet opens. Every site and every wallet request is checked.

PayHole stops crypto scams in two places: the page and the wallet. Every site you open is checked against the PayHole resolver, the same answer the PayHole app gives on a phone. A known wallet drainer, phishing page, or counterfeit token site never loads. In its place you see what the name is and who says so, with Go back or Open once. A name the browser has already seen blocked is stopped inside the browser before a single request leaves. Before MetaMask, Rabby, or any wallet opens, PayHole reads what the page asked for: a send, an approval, a permit, a signature. Every address in it is checked against the network's list of drainer contracts and the wallets behind them. A known one is stopped with a warning you can override; an unlimited approval to an address nobody knows gets a heads-up, once per spender: Continue and it does not ask about that spender again. It works with every wallet, on every EVM chain, and never touches a seed. What it does - Checks each site as it loads and walls off listed names: drainers, phishing, counterfeit token sites. - Drops requests inside pages to names on the PayHole list, the scripts and frames a page pulls in, not only the page itself. - Reads wallet requests before the wallet sees them and stops sends, approvals, and permits to known drainer addresses. Optional warning on unlimited approvals. - Shows a badge on blocked tabs; the popup gives the verdict for any site, a box to check any link or address, and a report button. - Right-click any link: Check this link with PayHole. - Reports are signed by a key that lives in the extension. Name a rewards wallet and confirmed first reports pay in USDG. Link the key to a tier holder's wallet on payhole.org and reports count as that wallet's flags. - Point it at your own PayHole resolver on your network if you run one. What it does not do - No account, no sign-up, no analytics, no telemetry. The only thing that leaves the browser is the hostname of a site or the addresses in a wallet request, sent to the resolver you chose, which answers from memory and keeps no log. - No wallet, no keys to your funds, no custody. The guard only reads requests. An optional x402 spending pocket for Robinhood Chain is included, off by default, for sites that charge per page. - No rewards in a token, ever. Bounties are paid in USDG by the project. What it cannot see - Wallets that speak to a phone over a QR code (WalletConnect) never pass through the browser, so the guard does not see them. Non-EVM chains are not covered. Getting started 1. Pin the icon. Everything is on from the first page. 2. Open the dashboard from the popup for the session log, the switches, and your reporter key. 3. To earn bounties, add a rewards wallet in the Reports tab. Open source under the MIT license. Privacy policy at payhole.org/privacy.html.