Investigator says Gemini told a victim a fake TRON energy-rental site was safe; a screenshot he posted shows Google AI Mode calling it the official domain
On 4 October 2026 a crypto investigator who posts on X as JP (@rugpullfinder) said a fake TRON energy-rental site, tronify.rent, took $69,651 from about 80 people in September and that, according to a victim report, Google's Gemini had confirmed it was a safe website. His post carries two screenshots. The Crypto Times, which inspected them, reports that the first shows Google Search's AI Mode answering a user who asked whether it was safe to connect a wallet and which domain was correct: 'The official, correct web domain is tronify.rent', supported by a statement that Trust Wallet had natively integrated Tronify. In the same answer, under a heading on avoiding scams, it tells users never to approve unlimited token allowances. The Crypto Times reports that Trust Wallet's October 2025 announcement of the integration does not name tronify.rent and that a December 2024 Trust Wallet post links to Tronify's market at tronify.io. The second screenshot shows Trust Wallet notifications dated Monday, 28 September: an unlimited USDT approval to an address on the investigator's list, then 1,419.699184 USDT sent to another listed address. The Crypto Times has not verified the loss total or the victim count. No inspected source publishes the victim's own account or says the screenshots come from that victim.
- AI system
- Google AI Mode
- Occurred
- Sept 2026
- Reported
- 4 October 2026
- Event location
- Unknown
- What the AI did
- Communicated with the person
- Reported harm
- Financial Loss
- Whose AI use
- Their own AI use
- Setting
- Finance
- Evidence
- AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account
- 5 claims: 5 reported. 4 open questions
- People reported harmed
- 1 person
AI system as recorded: Google Search AI Mode, a conversational search feature Google has said runs on a custom version of its Gemini models; the investigator's post attributes the answer to Gemini
What Happened
The post. JP (@rugpullfinder) wrote on X on 4 October 2026: 'About 80 people fell victim to Tronify dot rent last month. According to a victim report, Gemini even confirmed that it was a safe website!' He put the total at $69,651.
The AI answer. The Crypto Times describes the first screenshot: 'The screenshot JP shared shows a google.com page with the “AI Mode” tab selected.' 'In the screenshot, the user asks whether it is safe to connect a wallet “to them” and which domain is correct. The AI answer states: “The official, correct web domain is tronify.rent.”' The answer cites Trust Wallet's integration of Tronify as support and, under a heading on avoiding scams, warns against approving unlimited token allowances.
The domain. The Crypto Times reports that Trust Wallet announced an integration with Tronify, an energy provider, in October 2025 without naming tronify.rent, and that a December 2024 Trust Wallet post links to tronify.io.
The wallet. The second screenshot shows Trust Wallet notifications dated Monday, 28 September: 15 TRX received from an address on the investigator's list, an 'Approved unlimited USDT' notice naming that address as spender, and 1,419.699184 USDT sent to a second listed address. An unlimited approval lets the approved address move the wallet's entire balance of the token.
Limits. The record rests on one investigator's post and one outlet's inspection of its screenshots. The victim is not identified, the victim's own account is not published, and the post does not say that both screenshots come from the same person, although it presents them together with the victim report. The loss total and victim count are unverified. Google has made no reported statement.
Reported harm
A crypto investigator says a victim reported that Google's Gemini confirmed a fake TRON energy-rental site was safe; screenshots he posted, which no source attributes to that victim, show an AI Mode answer naming the site as the official domain and wallet notifications of an unlimited USDT approval and a 1,419.70 USDT transfer to addresses he links to the site (investigator's post, as inspected by The Crypto Times).
Outcome
OngoingThe investigator published 12 TRON addresses he links to the site. No police report, recovery of funds or response from Google is reported in the inspected sources.
What remains unknown
- The victim's identity, location and own account, and whether both screenshots come from that victim.
- The amount this victim lost in total and whether any funds were recovered.
- Whether the AI Mode answer was reproducible and whether Google has responded.
- Whether the loss total and the count of about 80 victims are accurate.
What the evidence supports
AI involvement: reported. The Crypto Times describes the screenshot the investigator posted: Google's AI Mode, asked whether it was safe to connect a wallet and which domain was correct, answered that the official, correct web domain was tronify.rent, citing a Trust Wallet integration that Trust Wallet's own posts tie to a different domain. The investigator says a victim reported that Gemini confirmed the site was safe, and posted wallet notifications showing an unlimited USDT approval and a transfer to addresses he links to the site. No inspected source says the AI Mode screenshot or the wallet notifications come from the victim whose report the investigator relays.
5 claims: 5 reported. What the statuses mean
Reported A crypto investigator posting as JP (@rugpullfinder) said on 4 October 2026 that about 80 people lost $69,651 to tronify.rent in September and that, according to a victim report, Gemini had confirmed it was a safe website.
Causal attribution. The investigator's account of a victim report; unverified.
- x.com(opens in new tab) supports · English
'About 80 people fell victim to Tronify dot rent last month. According to a victim report, Gemini even confirmed that it was a safe website!'; 'steal $69,651 - IN ONE MONTH!'
- cryptotimes.io(opens in new tab) context · English
'A crypto investigator who posts on X as JP says tronify.rent took $69,651 from about 80 people in September.'; 'The Crypto Times has not independently verified the loss total or the victim count.'
Reported A screenshot in the post shows Google Search's AI Mode answering a user who asked whether it was safe to connect a wallet and which domain was correct, stating that the official, correct web domain is tronify.rent and citing Trust Wallet's integration of Tronify.
Causal attribution. The Crypto Times' description of the investigator's screenshot.
- cryptotimes.io(opens in new tab) supports · English
'The screenshot JP shared shows a google.com page with the “AI Mode” tab selected.'; 'In the screenshot, the user asks whether it is safe to connect a wallet “to them” and which domain is correct. The AI answer states: “The official, correct web domain is tronify.rent.”'; 'The answer supports this by saying Trust Wallet natively integrated Tronify.'
Reported AI Mode is a conversational search feature that Google has said runs on a custom version of its Gemini models; the investigator's post attributes the answer to Gemini.
Causal attribution. The Crypto Times.
- cryptotimes.io(opens in new tab) supports · English
'AI Mode is a conversational search feature that Google has said runs on a custom version of its Gemini models. JP’s post attributes the answer to Gemini.'
Reported Trust Wallet's October 2025 announcement of its Tronify integration does not name tronify.rent, and a December 2024 Trust Wallet post links to Tronify's market at tronify.io.
Causal attribution. The Crypto Times' own check of Trust Wallet's posts.
- cryptotimes.io(opens in new tab) supports · English
'Trust Wallet announced in October 2025 that it was integrating Tronify, an energy provider'; 'The announcement does not name tronify.rent.'; 'An earlier Trust Wallet blog post, from December 2024, links to Tronify’s energy rental market at tronify.io.'
Reported A second screenshot in the post shows Trust Wallet notifications dated Monday, 28 September: an unlimited USDT approval to an address on the investigator's list and 1,419.699184 USDT sent to another address on the list.
Causal attribution. The Crypto Times' description of the investigator's screenshot; whose wallet it is is not stated.
- cryptotimes.io(opens in new tab) supports · English
'The lock-screen screenshot JP published shows Trust Wallet notifications dated Monday, September 28. The newest notification reads “Approved unlimited USDT.”'; 'A third notification, marked “now,” shows 1,419.699184 USDT sent to an address'; 'also on JP’s list.'
Sources
2 sources inspected, from 1 underlying account. Sources that repeat one account do not corroborate each other.
- JP (@rugpullfinder) on X, 4 October 2026: post on the Tronify.rent losses with screenshots(opens in new tab)
s1 · x.com · Social media post · English · Inspected · 4 October 2026 · Shares an underlying account with another listed source
- The Crypto Times, 5 October 2026: Google AI Search's 'Official' Tronify.rent Label Raises Questions After $69,651 Losses(opens in new tab)
s2 · cryptotimes.io · News report · English · Inspected · 5 October 2026 · Shares an underlying account with another listed source · Primary
How the sources were read, and where the events happened
Read in English through X's public syndication endpoint (HTTP 200); the two attached images were downloaded and viewed by the research agent. Applies to s1.
Read in English in full (HTTP 200). Its account of the screenshots and losses derives from s1; its checks of Trust Wallet's announcements are its own. Applies to s2.
Event countries: Unknown. Affected-person countries: Unknown. Court countries: Unknown.
No source states where the victim or the operators were; the site's claim to be a Florida company is the site's own statement and is not used.
Reviewed for publication 2026-10-06: Published as a concrete, attributed account: an investigator relays a victim report that Google's Gemini called a fake crypto site safe, and an outlet that inspected his screenshots describes the AI answer naming the site as the official domain and wallet notifications of the approval and transfer. The victim is unidentified and the claims are unverified.
People described
An unidentified cryptocurrency wallet user whose report the investigator relays; one of about 80 people he says lost funds to the site
People reported harmed in this case
1 person
1 AI participant · 0 other people harmed
One person: the victim whose report, per the investigator, said Gemini confirmed the site was safe. The investigator's figure of about 80 victims is unverified and is not tied to the AI answer, so the other victims are not counted in this case.
Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.
Cite this case
Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.
APA
NOPE. (2026). Investigator says Gemini told a victim a fake TRON energy-rental site was safe; a screenshot he posted shows Google AI Mode calling it the official domain. AI incidents. https://nope.net/incidents/2026-investigator-says-gemini-called-fake-tron-energy-rental-site-safe
BibTeX
@misc{2026_investigator_says_gemini_called_fake_tron_energy_rental_site_safe,
title = {Investigator says Gemini told a victim a fake TRON energy-rental site was safe; a screenshot he posted shows Google AI Mode calling it the official domain},
author = {NOPE},
year = {2026},
howpublished = {AI incidents},
url = {https://nope.net/incidents/2026-investigator-says-gemini-called-fake-tron-energy-rental-site-safe}
} Related cases
Bhopal: a security guard lost about Rs 35,000 to a caller whose voice sounded like a friend, reported as a suspected AI voice-cloning fraud
Free Press Journal reported on 4 October 2026 that a 50-year-old security guard from the TT Nagar area of Bhopal, Madhya Pradesh, was cheated of nearly Rs 35,000 after a caller impersonated a friend by mimicking the friend's voice. According to the report, the call came on 30 September from an unidentified person who claimed to need money urgently and sent a QR code. The guard made three transfers (Rs 5,000, Rs 10,000 and Rs 20,000), then reached the friend on the friend's own number and learned that the friend had not called. The outlet calls it a suspected case of AI-enabled fraud with a suspected AI-cloned voice. TT Nagar police registered a case and opened an investigation. No source confirms that the voice was AI-generated.
Bengaluru: a security guard says a WhatsApp video call in which an alleged deepfake 'Chief Minister Vijay' offered him financial aid led to fake 'processing' charges and a fake CBI fine, and he lost more than Rs 1.04 lakh; Byappanahalli police register an IT Act case (September 2026)
A security guard in Bengaluru, originally from Odisha, told the Times of India that on 9 September 2026 he answered a WhatsApp video call in which a face and voice presented as Tamil Nadu Chief Minister C. Joseph Vijay introduced himself in Hindi, asked his name, work and where he lived and pressed him to accept financial help. A 'manager' then promised Rs 11 lakh, said Rs 5 lakh had been allotted to him and asked for a Rs 5,000 exchange charge, then Rs 18,000 to unlock a supposedly locked PIN; a caller posing as a CBI officer demanded more than Rs 50,000 as a fine. The fraudsters sent a fake allotment letter and a purported CBI officer's identity proof. He paid more than Rs 1.04 lakh through a digital payment app before refusing a further Rs 50,000 demand, called the 1930 cybercrime helpline and went to Byappanahalli police, who registered a case under the Information Technology Act. The Times of India says the fraudster allegedly used a deepfake AI-generated video and calls it the first such case reported in the city. No arrest is reported, and no link to the Tamil Nadu CB-CID deepfake case or its Alwar arrest has been established.
India: AI deepfake videos of Tamil Nadu Chief Minister Vijay offering 'financial assistance' were used to defraud people in Madhya Pradesh and other states; a Rajasthan man was arrested
In 2026 AI-generated videos showing a simulated Tamil Nadu Chief Minister C. Joseph Vijay speaking in a fabricated Hindi voice circulated on Facebook and other platforms, urging viewers to contact a WhatsApp number to receive money for education, medical treatment and other needs. The Tamil Nadu Crime Branch-CID detected the videos during routine monitoring, registered a case on 1 September 2026 under the Bharatiya Nyaya Sanhita and the Information Technology Act, and traced the scheme to Rajasthan and Madhya Pradesh. On 12 September a 28-year-old man from Alwar district was arrested with Rajasthan Police, brought to Tamil Nadu on a transit warrant and remanded in judicial custody; a phone, SIM cards and a CPU were seized. Investigators traced a man in Madhya Pradesh who had lost money, and said people in several states were cheated. The CB-CID is also examining similar videos posted from Facebook accounts suspected to be run from Pakistan.
Rennes administrative court fines a claimant 500 euros for an abusive tax appeal it found manifestly written with an AI tool and too imprecise to assess
According to Gossement Avocats, which quotes the order, and the court's vice-president on France Inter, an order of 19 August 2026 (n°2508168) of the tribunal administratif de Rennes rejected a claimant’s application contesting a VAT reassessment and fined the claimant 500 euros for an abusive application. As quoted by Gossement Avocats, the order says the application had manifestly been written with an artificial intelligence tool and that its grounds lacked the most elementary details needed to assess them. The court also found it inadmissible because no prior complaint to the tax service was shown, and noted that it repeated a request with substantially the same object rejected in October 2025. The court’s vice-president cited the case on France Inter; commentators stress that AI use alone was not the basis for the fine.
If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.