Michael Bodley

As if a prolonged bankruptcy wasn’t enough, court documents show the story of defunct crypto lender Celsius has a new wrinkle: scammers impersonating lawyers involved in its Chapter 11 proceedings.



The attempted scams are the latest headache for Celsius, which halted withdrawals and related customer activities in July, <a href="https://celsiusnetwork.medium.com/a-memo-to-the-celsius-community-59532a06ecc6" target="_blank" rel="noreferrer noopener">citing</a> “extreme market conditions.”&nbsp;



“Our ultimate objective is stabilizing liquidity and restoring withdrawals, [swaps], and transfers between accounts as quickly as possible,” the company wrote in a blog post at the time. “There is a lot of work ahead as we consider various options, this process will take time, and there may be delays.”



In its latest setback, attorneys for Celsius said in court filings earlier this week that a number of unidentified would-be nefarious actors have been reaching out to its creditors, posing as Kirkland &amp; Ellis attorneys. The attempts, largely carried out over email, seem to have been intended to persuade customers — whose accounts have been frozen for months — to hand over sensitive information in a bid to gain access to their accounts.&nbsp;&nbsp;



The emails included links to shared spreadsheets, where recipients were told to share their personal information. The industry publication Law360 first <a href="https://www.law360.com/articles/1554186" target="_blank" rel="noreferrer noopener">reported</a> the news of the attempted scams. It’s not clear if any of those efforts were successful, at least in the eyes of the hackers.



<h3 class="wp-block-heading">Prime Trust settlement moves ahead — with a twist</h3>



But it’s not all doom and gloom for Celsius. A proposed settlement with Prime Trust — the crypto custodian that agreed to give back to the bankrupt company about $17 million of its assets — is moving along.&nbsp;



That was just a start, according to court records reviewed by Blockworks. An amended settlement proposal found that Prime Trust also owes Celsius 7.4 bitcoins, 1,145.5 CEL tokens, 248.5 ether and about $364,000 of the stablecoin USDC.



The assets, which should be incoming if both parties agree to the settlement along with the bankruptcy court, would not fill the role Celsius is in — hundreds of millions of dollars deep. But every bit moves the needle incrementally in terms of recouping funds for customers-turned-creditors — whom Celsius has always maintained are its top priority.&nbsp;



A spokesperson for Celsius did not return a request for comment, and a spokesperson for Prime Trust declined to comment, citing the unsettled litigation.



In the meantime, visitors to Celsius’ website receive a pop-up informing them of the pending bankruptcy — and pointing out the obvious: It’s no longer business as usual — with a link to another site set up specifically to disseminate information about the proceedings.&nbsp;



The defunct digital asset lenders’ <a href="https://celsius.network/careers" target="_blank" rel="noreferrer noopener">careers page</a>, however, still says Celsius has “open positions in every department” and is “growing rapidly.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

bankruptcy

Celsius Gets Cash Infusion From Prime Trust as Scammers Target Customers

Shalini Nagarajan

<div id="highlights-block_631effca203df" class="highlights">
 <ul>
 <li>Elizabeth Warren, Bernie Sanders call Meta “breeding ground” for crypto fraud</li>
 <li>Social media users can accidentally end up downloading harmful bots via malicious links</li>
 </ul>
 
</div>



Facebook parent Meta isn’t doing enough to get rid of crypto-related scammers on its platforms, according to several US Democrats.



They questioned CEO Mark Zuckerberg last week over its efforts to fight related scams on platforms including Facebook, Instagram and WhatsApp.&nbsp;



Sens. Robert Menendez, Elizabeth Warren and Bernie Sanders, among others, wrote in a <a href="https://www.menendez.senate.gov/imo/media/doc/letter_to_meta_on_cryptocurrency_scams.pdf" target="_blank" rel="noreferrer noopener">letter</a> on Sept. 8 that they were concerned the Facebook parent is a “breeding ground” for crypto fraud that results in significant harm to consumers.



Data from the Federal Trade Commission shows over 46,000 people collectively <a href="https://cms.blockworks.co/frauds-and-scams-top-1b-since-2021-ftc-says/" target="_blank" rel="noreferrer noopener">lost more than $1 billion</a> in crypto-related scams between 2021 and the first quarter of 2022. That figure includes scams where the crypto connection consists of its use as a payment method.



Non-crypto-related scams accounted for about $4.16 billion, or <a href="https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/06/reports-show-scammers-cashing-crypto-craze#crypto2" target="_blank" rel="noreferrer noopener">76% of losses</a>, the FTC said.



The report states that, among customers who were scammed, roughly half were perpetrated via social media, leading to consumer losses worth $417 million: 32% reported being conned on Instagram, 26% on Facebook, 9% on WhatsApp and 7% on Telegram.


<div class="wp-block-image">
<figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="491" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png" alt="" class="wp-image-30807" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=1536 1536w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/09/2022-09-12-FTC-1024x491.png?w=1980 1980w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Figures based on fraud reports to the FTC&#8217;s Consumer Sentinel network indicating cryptocurrency as the payment method. The investment related fraud category includes the following fraud subcategories: art, gems and rare coin investments, investment seminars and advice, stocks and commodity futures trading, and miscellaneous investments. Reports provided by Sentinel data contributors are excluded; Source: FTC</figcaption></figure></div>


The senators have now asked Meta to respond to questions including detailed current policies and practices to remove crypto scammers and steps to assist victims. A deadline for responses has been set for Oct. 24.&nbsp;&nbsp;



Social networking service (SNS) hacks or scams can occur via fake administrator accounts or administrator accounts that are infected with malicious bots, explained Jasper Lee, audit head at smart contract auditing firm <a href="http://sooho.io" target="_blank" rel="noreferrer noopener">Sooho.io</a>.



Harmful bots can be installed if users click on a specific link attached via a direct message. This way, attackers then install malicious bots with administrative authority on the account and lure investors to a fraudulent minting site.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“There are an increasing number of fake sites disguised as official NFT minting sites and impersonating SNS accounts, even with the same photos and descriptions of official accounts used for real announcements,” Lee told Blockworks.</blockquote>



Meta didn’t respond to Blockworks’ request for comment by press time. According to its website, the company’s current <a href="https://www.facebook.com/business/help/438252513416690?id=595195347635322" target="_blank" rel="noreferrer noopener">crypto ads policy</a> states that most products require to be licensed or registered with a recognized regulator.



<h3 class="wp-block-heading">What Meta could do to tackle scammers</h3>



In April 2022, Meta launched a <a href="https://about.fb.com/news/2022/04/helping-to-stop-online-scams/" target="_blank" rel="noreferrer noopener">campaign</a> on Facebook and Instagram featuring educational videos to help people spot and avoid scams online. It included prevalent methods, including romance, investment, cash flipping, money mule, and friend-in-need scams. 



It also partnered with a banking and online industry network called Stop Scams UK in 2022 to proactively help stop scams.



But Aarti Dhapte, senior research analyst at Market Research Future, said Meta must indulge in an increasing number of campaigns in every country.&nbsp;



“These campaigns should be customized per the prevalent crypto scams/frauds in that country/area,” she told Blockworks.



Meta should also use its recently launched Next-Gen AI supercomputers to prevent fraudsters from registering under fake, offline identities, she added.



<h3 class="wp-block-heading">Sued by Australian watchdog for fake endorsements</h3>



Earlier this year, Meta was sued by Australia’s competition watchdog for allegedly promoting fake ads that endorsed crypto investments. The lawsuit claimed Meta “aided and abetted or was knowingly concerned in false or misleading conduct and representations by the advertisers.”



One individual lost more than A$650,000 ($443,992) through such a scam, the <a href="https://www.accc.gov.au/media-release/accc-takes-action-over-alleged-misleading-conduct-by-meta-for-publishing-scam-celebrity-crypto-ads-on-facebook" target="_blank" rel="noreferrer noopener">complaint</a> said.



The watchdog said Facebook’s ads would likely mislead customers into believing they were associated with prominent personalities, when in fact they weren’t. The people featured had never approved them.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Facebook

Scammers Use of Meta Platforms Draws US Political Ire

<div id="highlights-block_629ddabf61cad" class="highlights">
 <ul>
 <li>Scammers used fake investment opportunities and romance-linked fraud to trick people into crypto transfers</li>
 <li>Nearly half of the victims were targeted on Instagram, Facebook, WhatsApp and Telegram</li>
 </ul>
 
</div>



Smart contract <a href="https://cms.blockworks.co/?s=exploit" target="_blank" rel="noreferrer noopener">exploits</a> and rug pulls may be exotic, but unsuspecting crypto users are at risk of more run-of-the-mill fraud too. Since 2021, investment-related fraud and romance scams were the top two methods of defrauding individuals on social media, according to a new <a href="https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/06/reports-show-scammers-cashing-crypto-craze#crypto1" target="_blank" rel="noreferrer noopener">report</a> by the Federal Trade Commission.



More than 46,000 people have collectively reported more than $1 billion in losses in crypto-related scams between the start of 2021 and the first quarter of 2022. That’s more than any other payment method — and nearly 60 times the crypto losses reported in 2018, according to the regulator.



The losses are not the result of any failure of cryptography or errant smart contracts, but old-fashioned social engineering that’s not unique to crypto. Last year, 59 million people in the US alone lost nearly $30 billion <a href="https://www.cnbc.com/2021/06/29/americans-lost-billions-of-dollars-to-phone-scams-over-the-past-year.html" target="_blank" rel="noreferrer noopener">to phone scams</a>.



The regulatory agency warned that using a social media platform while holding cryptocurrencies can be a particularly explosive mix.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“Nearly half the people who reported losing crypto to a scam since 2021 said it started with an ad, post, or message on a social media platform,” the report said.</blockquote>



The top social media platforms identified in these online deceptions were Instagram (32%), Facebook (26%), WhatsApp (9%) and Telegram (7%).



An investment opportunity or offer that seems too good to be true usually is, and more than half of the losses reported to the FTC — $575 million — were related to <a href="https://consumer.ftc.gov/jobs-and-making-money/money-making-opportunities-and-investments" target="_blank" rel="noreferrer noopener">fake investment opportunities</a>.



“Investment scammers claim they can quickly and easily get huge returns for investors,” the report said. “But those crypto ‘investments’ go straight to a scammer’s wallet.”



Some people get convinced about the legitimacy of these schemes as they’re initially able to track the performance of their cryptocurrency and are able to make a small “test” withdrawal.


<div class="wp-block-image">
<figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="487" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png" alt="" class="wp-image-22473" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=1480 1480w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Figures based on fraud reports to the FTC&#8217;s Consumer Sentinel Network indicating cryptocurrency as the payment method. The investment related fraud category includes subcategories for art, gems and rare coin investments, investment seminars and advice, stocks and commodity futures trading and miscellaneous investments. Source: <a href="https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/06/reports-show-scammers-cashing-crypto-craze#crypto1" target="_blank" rel="noreferrer noopener">FTC</a></figcaption></figure></div>


According to the FTC, <a href="https://consumer.ftc.gov/articles/what-you-need-know-about-romance-scams" target="_blank" rel="noreferrer noopener">romance scams</a> are the next most common type of crypto-related fraud. Nearly one in every three dollars of the reported losses, or $185 million, was lost to such a scam since 2021.



The regulator said sophisticated “keyboard Casanovas” allegedly entice people by laying claims to made-up wealth. They seem to offer spontaneous tips on how to get started in crypto investing before trapping the victim into sending money to a scam account.



Victims of romance scams reported a median individual loss of $10,000, the report found.



If a victim parts with cryptocurrency on fraudulent exchange platforms, imposter websites, or peer-to-peer transfers, recovery is likely to prove difficult, because transactions cannot be reversed.



People in their 30s were the most significant hit by fraud-related cryptocurrency losses. But older victims lost bigger sums, with the median amount for victims in their 70s being just under $12,000. Earlier this year, the UK’s Financial Conduct Authority <a href="https://cms.blockworks.co/fca-finds-increased-scam-reports-linked-to-crypto/" target="_blank" rel="noreferrer noopener">highlighted</a> about 3,000 reports of possible crypto-linked scams between April and September of 2021.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Federal Trade Commission

Frauds and Scams Top $1B Since 2021, FTC Says

Jacquelyn Melinek

<div id="highlights-block_6213d0e566244" class="highlights">
 <ul>
 <li>“This attack did not originate on [OpenSea],” the company’s CEO and co-founder said</li>
 <li>Last week, OpenSea launched a customer service server to mitigate risk of fraudsters pretending to be members of the company’s staff</li>
 </ul>
 
</div>



NFT traders Monday were parsing the aftermath of an OpenSea phishing attack that resulted in hundreds of NFTs being stolen over the weekend.



The attack appears to be over, with <a href="https://twitter.com/opensea/status/1495625884514066433?s=20&amp;t=3LoWYvs8qkWE6oZipLav4A" target="_blank" rel="noreferrer noopener">17</a> victims, a revision from the 32 people originally thought to be affected, according to OpenSea.



“This attack did not originate on [OpenSea],” Devin Finzer, CEO and co-founder, wrote in a series of <a href="https://twitter.com/dfinzer/status/1495302786811981825?s=20&amp;t=3LoWYvs8qkWE6oZipLav4A" target="_blank" rel="noreferrer noopener">tweets</a>. The company is working with users as it aims to uncover who is responsible, Finzer said.



Finzer dismissed <a href="https://twitter.com/pluggedinn/status/1495246939838840840?s=20&amp;t=r49pa9TRVJvVvxZOZOOxMQ" target="_blank" rel="noreferrer noopener">reports</a> of the attack being worth over $200 million and said the hacker had <a href="https://etherscan.io/address/0x3E0DeFb880cd8e163baD68ABe66437f99A7A8A74#internaltx" target="_blank" rel="noreferrer noopener">$1.7 million of ether</a> in their wallet, confirmed by Etherscan records.



An OpenSea spokesperson declined to comment further and referred Blockworks to the company’s <a href="https://twitter.com/opensea/status/1495625768713469954?s=20&amp;t=py7J05HKKzaP4ZwDCWhPZA" target="_blank" rel="noreferrer noopener">tweets</a>.



OpenSea is the largest NFT (non-fungible token) marketplace by trading volume and has over 80 million NFTs across two million collections. The platform had $70.78 million in Ethereum-based volume on Monday, down 58% from $169.26 million a month ago, according to <a href="https://dune.xyz/queries/11385/22601" target="_blank" rel="noreferrer noopener">data</a> by Dune Analytics user rchen8.



The hacker made off with 254 NFTs during the attack, including a few Bored Ape Yacht Club NFTs, according to a <a href="https://docs.google.com/spreadsheets/d/1XQNIXuAl2E1XO_cP8pm_vbzskI_Pka4E5sizfcrLITM/edit#gid=0" target="_blank" rel="noreferrer noopener">spreadsheet</a> by blockchain security firm PeckShield. The most NFTs stolen during the phishing attack were 37 <a href="https://opensea.io/collection/azuki" target="_blank" rel="noreferrer noopener">Azukis</a>, according to <a href="https://dune.xyz/Jelilat/Opensea-Phishing-Attack-Stolen-NFTs" target="_blank" rel="noreferrer noopener">data</a> by Dune Analytics user Jelilat.



The users authorized the “migration” as instructed in the phishing email, and the authorization allowed the hacker to steal the NFTs, PeckShield <a href="https://twitter.com/peckshield/status/1495211650860785665?s=20&amp;t=r49pa9TRVJvVvxZOZOOxMQ" target="_blank" rel="noreferrer noopener">tweeted</a>.



As such, the malicious orders were all backed by valid signatures from users who fell for the phishing scam, Nadav Hollander, OpenSea’s chief technology officer <a href="https://twitter.com/NadavAHollander/status/1495509513167908864?s=20&amp;t=r49pa9TRVJvVvxZOZOOxMQ" target="_blank" rel="noreferrer noopener">tweeted</a> Sunday.



The attacker had users connect their crypto wallets to a fraudulent site, according to reports, where they signed approvals with Wyvern Exchange to give the attacker control of their NFTs.&nbsp;



Wyvern Exchange is a decentralized crypto exchange on the Wyvern Protocol that interacts with the Ethereum blockchain.



“The attacker appears to have exploited users by having them sign a fraudulent signature to approve a private sale of [their] NFT at 0 ETH to the attacker’s wallet,” The OpenDAO wrote in a <a href="https://theopendao.medium.com/opensea-phishing-attack-19-february-2022-and-the-opendaos-response-4f71aa80578c" target="_blank" rel="noreferrer noopener">post</a>. “Unfortunately nobody ever reads what they signed.”



Phishing scams often occur through text messages or emails with deceptive messages, ads or sites that look legitimate. While scams happen across industries, some community members call it a mistake for OpenSea to use email in general.



The co-founder of Pixel Vault, who goes by the pseudonym Beanie, called email “an archaic way to communicate” that “opens up even sophisticated users to risk of being exploited through phishing scams.



“The OpenSea email alert system never really worked anyhow, as it was overrun with spam,” Beanie <a href="https://twitter.com/beaniemaxi/status/1495764293484269573?s=20&amp;t=r49pa9TRVJvVvxZOZOOxMQ" target="_blank" rel="noreferrer noopener">tweeted</a>.



While messaging platforms such as Discord or Blockscan Chat allow users to log in with Ethereum addresses to message wallet-to-wallet, there are limited new avenues for companies to communicate with their users.



Last week, OpenSea launched a customer service server with Web3 communications platform Metalink to mitigate the risk of fraudsters pretending to be members of the company’s staff, Blockworks <a href="https://cms.blockworks.co/opensea-looks-to-improve-customer-support-and-fight-fraud/" target="_blank" rel="noreferrer noopener">reported</a>.



“Our goal is to create a direct channel for you to interact with OpenSea to get support, offer feedback, receive updates, and to share any other information that will help us better serve you,” Stevey Tromberg, OpenSea’s head of community, said in a <a href="https://mirror.xyz/metajake.eth/baLwh3UUzhvbDt0n_V9xmxaTsiaoGCb6gOR6KIW-CuA" target="_blank" rel="noreferrer noopener">statement</a>. 



The partnership was created after alleged scammers previously impersonated OpenSea’s employees to <a href="https://cms.blockworks.co/opensea-responds-to-nft-loophole/" target="_blank" rel="noreferrer noopener">deceive</a> other NFT owners in its Discord chat, which resulted in them losing millions of dollars.



“NFT communities deserve a safe and secure place where they can connect and thrive,” Jake Udell, the founder of Metalink, said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Scammers

Newsletter

Blockworks Research