Quick Take
  • The scheme exploits the network’s payment request feature and the inherent transparency of blockchain data.
  • It prompts the Pi Core Team to temporarily disable payment requests as losses mount.
  • Once a wallet with a sizable balance is identified, the attacker sends a payment request directly to the holder.
  • If the recipient clicks “approve,” the Pi is transferred instantly to the scammer’s wallet and cannot be recovered.

What Happened

The scheme exploits the network’s payment request feature and the inherent transparency of blockchain data. It prompts the Pi Core Team to temporarily disable payment requests as losses mount.

However, the suspension is described as a stopgap measure rather than a permanent fix. The feature may be re-enabled once additional safeguards or user protections are assessed.

Market Context

Members of the Pi Network community are raising alarms over a growing scam method that has already resulted in millions of Pi tokens being drained from user wallets.

Pioneers Warn of Scam Method Leading to Pi Being Drained from Wallets

Why It Matters

The same message emphasized that the threat lies in social engineering rather than protocol failure. Scammers may disguise requests to appear legitimate or impersonate trusted contacts, increasing the likelihood that users approve transfers without verifying them.

The figures suggest a coordinated and sustained operation rather than isolated incidents, with December’s spike indicating accelerating activity.

The scale of the theft has heightened concern among Pioneers, many of whom are new to on-chain transactions. As such, they may be unfamiliar with the risks of approving unsolicited requests.

Details

According to multiple community alerts circulated on X (formerly Twitter), scammers can scan the Pi blockchain to identify wallet addresses and view their Pi balances.

Once a wallet with a sizable balance is identified, the attacker sends a payment request directly to the holder. If the recipient clicks “approve,” the Pi is transferred instantly to the scammer’s wallet and cannot be recovered.

Community account Pi OpenMainnet 2025 warned that the mechanism is often misunderstood as a technical flaw.

“Previously, people called this a ‘system vulnerability,’ but honestly, it’s not a vulnerability at all,” the post stated. “This is exactly how the wallet is designed to work. The only way you will lose your Pi coins is if you personally approve the transaction.”

A Scam at Scale

Blockchain tracking shared by the community points to a single wallet address as a major hub for the activity.

The address—GCD3SZ3TFJAESWFZFROZZHNRM5KWFO25TVNR6EMLWNYL47V5A72HBWXP—has been accused of stealing between 700,000 and 800,000 Pi per month. According to reports, cumulative losses now exceed 4.4 million Pi.

Data shared by Pi Network Update shows consistent monthly inflows to the address:

Roughly 877,900 Pi in July 2025

743,000 Pi in August

757,000 Pi in September

563,000 Pi in October

622,700 Pi in November, and

Over 838,000 Pi in December.

Pi Team Disables Payment Requests

In response, the Pi Team has temporarily suspended the “send payment request” feature. Community notices indicate the move was taken after scam activity intensified.

“Currently, the Pi team has suspended these types of requests (possibly because the scams have gotten out of control),” said Pi Network Alerts in a post.