Sep 24, 2025, 8:03 AM

There seems to be a phishing attack that impersonates ycombinator, and is sent via Github tickets. It was sitting in my inbox this morning.

At a first glance, it looks like YC is reaching out to open source contributors, at least from their messaging.

But soon enough the oddities pile up: The amount suggested is not what YC usually invests. Their instructions indicate that a "wallet" must be verified via a reimbursable transfer.

Finally none of the links is legit. The one visible in the picture below is sent by "ycoombinator". Another apply link (not visible in screenshot) points to: "https://y-comblnator [dot] com/apply".

Phishing attempt with this message: Y Combinator | $15M Y-Combinator W2026 with GitHub
### Dear community,

The Y Combinator W2026 Program is now open for applications. This world-renowned accelerator supports ambitious builders and early-stage teams, helping them transform projects into scalable companies.

As a GitHub contributor, your open-source activity positions you to benefit from this opportunity. Whether you are shipping code, maintaining repositories, or prototyping new ideas, your work drives innovation and could qualify for YC’s support.

Program Benefits
----------------

- Funding: $15,000,000 USD investment on standard YC terms
- Growth Allocation: Helping founders accelerate traction and align community growth with long-term success.
- Mentorship: Access to experienced founders and YC partners
- Community: A global network of alumni, investors, and experts

Next step:
To confirm your preliminary registration and secure eligibility, please verify your wallet through Y Combinator. This step ensures fairness, safeguards against Sybil attacks, and does not require personal information. The process takes less than a minute: simply connect your wallet and sign a verification message.

Important:
A refundable deposit is required for authorization. The full amount will be returned once verification is complete.