3 innovative crypto scams that shocked the community

Two of the most shocking crypto scams Bankless Times has encountered involve address poisoning and DeFi mining. The third was standard, but what made it shocking was that the attacker had a vast network of completely legitimate partners.

These scams are unique and the first, but not the last, of their kind. DeFi mining scams are pig butchering scams with a twist, and they are expected to continue to increase because they are easier to package for sale and distribution to other cybercriminals, and because existing romance scammers can adopt them easily.

1. It’s so simple it’s brilliant: fighting poisoning

An Indian cryptocurrency user lost a wrapped Bitcoin worth $68 million after falling victim to an address poisoning attack. A security company, Cyvers Alerts, confirmed the incident and shared it on X.

Address poisoning is where the scammer copies the first and last six characters of a real wallet address. They hope that the victim will not verify the accuracy of the full number and send an amount of crypto that goes to the wrong address. An address can contain up to 42 characters.

2. A scam wrapped in legitimacy

A Reddit user has alerted the crypto community that they have been duped into a very complex scam involving a network of fully legitimate companies. The user had a friend who was a professional real estate investor and had recently invested in luxury properties in Texas, through which she and her husband made a lot of money. She had sold a billion homes. The friend had met another investor through mutual friends, started a joint investment with her, and asked the user to try it.

The other investor ran a women’s investing group on Facebook. She worked for RGB Capital and helped the women in the group. The user deposited money in ether on their website, VTProTrade.com, through Gemini. She also sent Bitcoin on CashApp. The investor promised about three to five times the initial deposit per month. Its platform also had rules about how often you could opt out.

The user followed the instructions, received an activation code and sent it to the support team to activate their account for mirror trading. Some time later, she discovered that the profile on Facebook was fake. It had been copied from a German woman with the same first name but a different last name. The German woman speaks and posted videos. The fake account was created to impersonate the American investor and was linked to the investor group.

VTProTrade.com is registered with the Australian Securities and Investment Commission (ASIC). Its license number is linked to a legitimate company called Novus Capital. The site has customer support with live chat, which the user contacted, and everything seems normal. She saw her balance and her profit (quite impressive).

The Women’s Investing Group on Facebook has about 900 members, many of whom say the site is legitimate. They were able to exchange their crypto for cash and transfer it to Gemini, Binance, or another legitimate exchange.

However, the user cannot withdraw their funds from VTProTrade.

According to Scam Adviser, the rating of this website is very low. The owner’s identity is hidden on WHOIS, the traffic ranking is also rather low, the website registrar is popular among scammers, and the site is young and has not let Scam Adviser analyze its content. Another Reddit user suspects that the victim’s real estate investor friend’s Facebook account was compromised and convinced the victim that she was “investing.”

3. DeFi mining meets pig butchering

Pig butchery scams are not new, but we are seeing a new, more sophisticated version that uses blockchain capability to bypass many of the defenses that mobile devices have. Fraudsters then gain direct control over victims’ funds.

The new scams use fraudulent DeFi apps and represent the next stage of “liquidity mining” scams of 2022. Basically, they combine mobile crypto wallets and smart contracts with false promises of love and friendship, the very essence of pig butchery.

These scams are an “improvement” over more rudimentary pig butchery scams because the victim does not need to install a custom app on their mobile device. In the past, this was a deterrent because the scammer had to convince the victim to follow complicated steps to install an app or try to slip the app out of the attention of Google and the App Store.

DeFi scams use trustworthy apps from reputable developers

The victim only needs to load a web page from the application. They don’t need to deposit crypto into the scammer’s wallet or transfer a deposit. They think they have complete control of their funds. They can see their crypto balances until the scammer sets the trap for them. The scammer may even add cryptocurrencies to their accounts to make it appear that the victim is taking advantage.

The scammer hides the wallet network that launders stolen funds behind a so-called contract wallet, an address that controls victims’ wallets.

Recent technological advancements include the use of third-party APIs such as WalletConnect to hide the contract wallet and agent detection scripts to redirect or block mobile and desktop browsers not connected to cryptocurrency wallets in order to escape detection. Connections to vulnerable mobile wallet apps are restricted. Positive wallet balances are detected to prevent empty Ethereum wallets from binding and identifying the contract wallet.