Security Warning: Fraudulent Document in Circulation

If you arrived here from a Google Doc presented as "Dragonfly — Investment Thesis 2026" or similar, that document is fraudulent. It was not authored or distributed by Dragonfly Capital, and continued interaction with it puts your accounts and assets at risk.

This page is the only legitimate Dragonfly resource the document links to. Everything else inside it — the "Protected Document" panel, the access key field, the "LP Only" banner, the blurred preview content — is a phishing lure.

How to recognize the lure

The fraudulent document typically presents:

A Dragonfly logo and letterhead, sometimes paired with a fabricated San Francisco mailing address. Dragonfly's offices are in New York and Singapore.
A red CONFIDENTIAL — LP ONLY banner above the title.
A side panel titled "Protected Document" requesting an access key formatted like DFL-XXXX-XXXX-XXXX and a free-text "access purpose" field.
A Decrypt Document button.
Blurred placeholder content suggesting redacted investment data.
An embedded hyperlink labeled "confidential investment information" — the link that brought you here.

None of this is a Google Docs feature. Google Docs has no native document-decryption capability and never asks visitors to enter access keys. The "Protected Document" panel is a flat image designed to imitate a Google Workspace UI element.

What to do now

If you only viewed the document

Close it and do not return. Do not enter any text into the access key or access purpose fields. Do not click any other link or button inside the document.

If you typed information into the form fields

Anything entered into the document was transmitted to the attacker. If you used credentials, identifiers, or details that match accounts you use elsewhere, treat those accounts as compromised. Rotate passwords, verify MFA is enabled, and review recent login activity on the affected accounts.

If you installed an add-on, browser extension, or downloaded a file at the document's prompting

Uninstall the add-on or extension immediately. Review and revoke OAuth grants at myaccount.google.com/permissions. Run an endpoint scan, or consult your IT or security team.

If you connected a wallet or signed a transaction

This is the highest-impact path of this attack. Act immediately.

Move all assets from the affected wallet to a new wallet generated on a clean device.
Revoke outstanding token approvals at revoke.cash (or the equivalent tool for the chain involved).
Treat any seed phrase that was exposed or entered as permanently compromised. Do not reuse the wallet.

How to verify legitimate Dragonfly communication

All authentic Dragonfly communications come from @dragonfly.xyz email addresses, and our official website is dragonfly.xyz. Lookalike domains observed in fraudulent campaigns include dragonflycapital.xyz — these are not affiliated with Dragonfly.

We do not:

Ask LPs, founders, or partners to enter access keys into documents
Require browser extensions or add-ons to view materials
Distribute investment thesis documents through unsolicited Google Docs share notifications
Request seed phrases, private keys, or wallet signatures to access content

If you receive a Dragonfly-branded document or message and want to confirm its authenticity, contact a known Dragonfly team member through a channel you have used before, or email the address below.

Reporting

To report receipt of the fraudulent document, or if you suspect you may have been affected: security@dragonfly.xyz

Forwarding the original Google Docs share notification email with full headers, or the message you received the link in, is the most useful evidence we can act on.

Looking for Dragonfly's terms of service? They are located at www.dragonfly.xyz/legal/terms.