Jack Kubinec

Last year was a lean one for crypto, but that didn’t put an end to rug pulls.



A report from Chainalysis today found that of all Ethereum ERC-20 tokens listed on DEXs in 2023, more than half met criteria for possible pump and dump schemes.&nbsp;



In a pump and dump, some illicit actor convinces investors to buy a token before selling a major share of the supply, collapsing the value and leaving those not in on the scheme holding the bag. In these schemes, scammers will sometimes wash trade, or buy and sell the same token, to create misleadingly high trading activity without any real change in ownership. This tactic artificially boosts the asset&#8217;s trading volume, giving the false impression that it is more in demand and potentially more valuable than it actually is.



Last year’s 90,408 possible ERC-20 pump and dumps identified by Chainalysis netted $241.6 million in profit for those draining the liquidity, amounting to a pretty paltry take rate for rug pullers — $2,672 per token dump.&nbsp;



Read more: <a href="https://blockworks.co/news/for-first-time-cftc-cracks-down-on-cryptos-pump-and-dump-schemes">For first time, CFTC cracks down on crypto’s ‘pump-and-dump’ schemes</a>



To identify pump and dumps, Chainalysis found tokens that were traded at least five times by <a href="https://blockworks.co/tag/dexs">DEX</a> users before a single address removed at least 70% of its <a href="https://blockworks.co/tag/liquidity">liquidity</a>, leaving the token with less than $300 in its liquidity pool. Put more simply, tokens investors traded before a whale sold their entire share, leaving holders with tokens they couldn’t sell.&nbsp;



Of note, <a href="https://blockworks.co/tag/chainalysis">Chainalysis</a> analyzed cases that met these criteria but couldn’t prove that every instance was in fact a market manipulation scheme.



While the average pump and dump scenario earned the perpetrator little more than a couple months’ rent, some market manipulators were especially prolific. Chainalysis identified one wallet that orchestrated 81 possible pump and dumps grossing $830,000 in profit.



Pump and dump schemes tend to harm retail investors, and they’re a sticky <a href="https://blockworks.co/news/crypto-twitter-bots-returns">part of crypto’s reputation</a> that have led some regulators to <a href="https://blockworks.co/news/republican-crypto-market-bill-handout">sour on the asset class</a>. 



In August, the Securities and Exchange Commission <a href="https://www.sec.gov/news/press-release/2023-157">convicted</a> former New Jersey correctional officer John DeSalvo with fraud over a pump and dump scheme. DeSalvo <a href="https://www.justice.gov/usao-nj/pr/former-new-jersey-corrections-officer-charged-cryptocurrency-fraud-scheme-targeted-law">marketed</a> his Blazar token to law enforcement officers as a “crypto pension” and drew more than $600,000 in investment before selling billions of his own tokens and collapsing the enterprise, the US Attorney’s office for New Jersey said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Average potential crypto rug pull makes $2,600 in profit: Chainalysis

James Cirrone

US federal prosecutors got their way in the Reginald Fowler case, with a New York judge imposing an approximately six-year prison term on the convicted crypto fraudster.&nbsp;



Fowler’s sentence stemmed from the fact that he “evaded federal law by processing hundreds of millions of dollars of unregulated transactions on behalf of cryptocurrency exchanges as a shadow bank,” US Attorney Damian Williams said in a statement on Monday.&nbsp;



Prosecutors in April <a href="https://blockworks.co/news/reggie-fowler-shadow-bank-crypto-capital-corp">pushed for a seven-year prison term</a>, plus fines amounting to over $720 million.&nbsp;



The bank fraud is tied to Fowler’s time running Global Trading Solutions (GTS). The former Minnesota Vikings minority owner pleaded guilty last April to lying to banks in order to process more than $700 million in “unregulated” crypto transactions, the Southern District of New York said in a <a href="https://www.justice.gov/usao-sdny/pr/former-co-owner-minnesota-vikings-sentenced-75-months-prison-providing-shadow-banking">statement</a>.&nbsp;



“Fowler evaded federal law by processing hundreds of millions of dollars of unregulated transactions on behalf of cryptocurrency exchanges as a shadow bank,” Williams said. “He did so by lying to legitimate U.S. financial institutions, which exposed the U.S. financial system to serious risk.”



The shadow bank, Crypto Capital Corp, was established to process transactions for crypto startups operating by choice or necessity outside of the traditional banking system.&nbsp;



Bitfinex was also wrapped up with Crypto Capital, <a href="https://blockworks.co/news/reggie-fowler-shadow-bank-crypto-capital-corp">giving the payment processing firm $850 million</a> to process customer withdrawals. New York Attorney General Letitia James alleged in 2021 that <a href="https://blockworks.co/news/tethers-settlement-with-the-nyag-a-positive-for-industry">Tether loaned Bitfinex the $850 million</a> to cover the loss.&nbsp;



Prosecutors said Fowler personally opened dozens of accounts that processed crypto transactions without the knowledge of the banks involved.&nbsp;&nbsp;



Fowler has been ordered to forfeit $740.2 million of the proceeds.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Reggie Fowler Gets Over 6 Years for Crypto Scheme, Ordered to Forfeit $740M

Katherine Ross

A US district judge has ruled in favor of Binance’s motion to dismiss a lawsuit connected to a purported pig butchering scam.



Plaintiff Divya Gadasalli alleged in her lawsuit that names several defendants that she lost over $8 million in a pig butchering scam.&nbsp;



Pig butchering scams are typically a setup in which scammers reach out through texts or via dating apps to build a relationship with victims. Scammers generally then look to scam their victims into fake investments and disappear.&nbsp;



She filed the claim against <a href="https://blockworks.co/tag/binance">Binance</a> and defendants “Jerry Bulasa (&#8216;Bulasa&#8217;), Dong Lian, and Danyun Lin.” Bloomberg <a href="https://www.bloomberg.com/news/articles/2022-05-05/a-texas-tale-of-tinder-millions-in-stolen-crypto-and-murder">reported</a> in May of last year that Bulasa was possibly using a pseudonym, and the identity of the additional two defendants wasn’t immediately clear.



Gadasalli’s attorney and Binance representatives, as well as Binance.US, did not immediately return a Blockworks’ request for comment on Tuesday.



A Texas court dismissed the lawsuit on Monday, according to a PACER filing.&nbsp;&nbsp;



Gadasalli’s attorney in court filings said that Binance played a role in perpetuating the scam, but the judge overseeing the case this week found that Gadasalli’s claims lacked jurisdiction and failed to state an appropriate claim.&nbsp;



“Gadasalli cannot point to a single fact of how Binance is actually involved in this case,” the judge wrote in the filing granting Binance’s motion to dismiss.



<h2 class="wp-block-heading">Court: Binance.Us banned from Texas operations&nbsp;</h2>



The judge overseeing the case granted Binance’s motion to dismiss, based on multiple factors — including that Binance.US is barred from operating in Texas.



Gadasalli had argued that Binance encouraged the use of virtual private networks to access Binance or Binance.US from states where the two crypto exchanges are banned from operating in.&nbsp;



“The ability for individuals to use third-party VPNs to circumvent certain regulations will not be enough to meet the exceptional standard and subject a defendant to the Court’s personal jurisdiction,” the judge wrote in the motion to dismiss.&nbsp;



Pig butchering — named after the method of fattening a pig up before slaughter — has become somewhat prevalent. The term appears to have originated in Asia. 



On May 15, the US Secret Service San Francisco Field Office and Bay Area Enforcement Allied Computer Team said in a Reddit AMA that <a href="https://blockworks.co/news/secret-service-pig-butchering-scams">pig butchering scams have been the most common</a> types of fraud perpetrated lately.&nbsp;



REACT, specifically, has investigated over 50 cases, according to a Chainalysis <a href="https://blog.chainalysis.com/reports/2022-crypto-scam-revenue/">report</a>.&nbsp;



While crypto scam revenue fell to $5.9 billion from $10.9 billion the year prior, agencies have warned that these particular scams are on the rise.&nbsp;



In April, the Justice Department seized $112 million in funds linked to pig butchering scams.&nbsp;



“We all know that investment scams are not new, but the use of digital currency to commit fraud presents new challenges to victims and to law enforcement trying to recover lost funds — which likely total billions of dollars in the so-called ‘pig butchering’ schemes,” Martin Estrada, a US Attorney, said in a <a href="https://www.justice.gov/usao-cdca/pr/justice-dept-seizes-over-112m-funds-linked-cryptocurrency-investment-schemes-over-half">statement</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Binance Wins Dismissal of Lawsuit Linkedin to Pig Butchering Scam

The US Secret Service San Francisco Field Office and the Bay Area Regional Enforcement Allied Computer Team (REACT) hosted an Ask Me Anything (AMA) on Reddit on Monday, May 15.&nbsp;



According to its post, the REACT team specializes in “keeping cryptocurrency and its users safe” in San Francisco. The team is a mixture of analysts and special agents.&nbsp;



“Education is one of the primary goals at both USSS and REACT,” the USSS <a href="https://www.reddit.com/r/CryptoCurrency/comments/13h2mar/ama_on_rcryptocurrency_with_the_us_secret_service/">explained</a> when asked by Redditors why the Secret Service would host an AMA.



Both teams have extensive backgrounds in tracking and apprehending individuals who have committed cryptocurrency scams, listing a <a href="https://www.secretservice.gov/newsroom/releases/2022/08/alleged-russian-cryptocurrency-money-launderer-extradited-united-states">Russian</a> hacker who was extradited to the US as well as multiple hackers <a href="https://www.europol.europa.eu/media-press/newsroom/news/ten-hackers-arrested-for-string-of-sim-swapping-attacks-against-celebrities">arrested</a> for SIM-swapping attacks.



The USSS said the scam they come across the most is called pig butchering, where victims are targeted on social media, dating sites or online messaging platforms. The hacker <a href="https://www.michigan.gov/ag/consumer-protection/consumer-alerts/consumer-alerts/scams/cryptocurrency-scam-pig-butchering">pretends</a> to develop a relationship with the victim — either in a friendly or romantic way — and then exploits them.



“In San Francisco specifically, we tend to focus on victim-based cases, meaning those where there&#8217;s an individual(s) or company that&#8217;s been affected. These days we see a ton of pig butchering investment scams and have devoted resources to help those victims,” the USSS said.



When investigating a crypto crime, REACT quickly assesses the “stolen funds by tracing the victim’s initial transfer out of an exchange or wallet to a suspect, and attempt to effect a seizure,” according to the 2023 Crypto Crime <a href="https://go.chainalysis.com/rs/503-FAP-074/images/Crypto_Crime_Report_2023.pdf">Report</a> from Chainalysis.&nbsp;



“When tracing funds during investigations, the agency doesn’t dwell on pass-through wallets; it targets those containing funds that it can directly attribute to victims as California law states that law enforcement can only seize funds that meet that criteria,” the report said.



Crypto investigations also “vary in a lot of ways to fiat investigations, both in good ways and bad ways, but most notable is that crypto transactions are irreversible and immutable.”



And the victims in the bulk of the cases the USSS and REACT are investigating have lost over $500,000.



In 2022, Chainalysis found that “illicit transaction volume rose for the second consecutive year, hitting an all-time high of $20.6 billion.”



“We are involved with the crypto investigations from beginning to end (victim reports the crime, we investigate it, prosecute it, etc.). We work in collaboration with other agencies as the need arises, but each case is different,” the USSS said.



The USSS suggested that users “use cash” if they don’t want any transactions tracked, and the REACT team praised blockchain technology.



“The blockchain provides us with an amazing opportunity to track the flow of money. It&#8217;s a continuous ledger that is unchangeable and transparent,” REACT said.



The USSS and REACT took a lighthearted approach to the AMA. When asked if they would ever consider releasing a token or memecoin, the USSS said it created and minted its own NFT collection, which is still available on <a href="https://opensea.io/collection/usss-sfo">OpenSea</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Secret Service Sees ‘a Ton’ of Pig Butchering Scams: Reddit AMA

Michael Bodley

Crypto security specialist Halborn and Chainalysis are teaming up in a new initiative designed to arm clients with the technological means and know-how to both preempt and recover from instances of industry fraud.&nbsp;



The seven-phase planned partnership is designed to “help equip Web3 companies at any stage to prevent and respond to security threats that have <a href="https://blog.chainalysis.com/reports/2022-biggest-year-ever-for-crypto-hacking/">plagued the industry</a>,” both companies first told Blockworks in a statement on Tuesday.&nbsp;



Awareness of scams, frauds, and purported or documented crimes have kept crypto industry participants on edge in 2023. Industry participants say that has been especially true in recent weeks as the <a href="https://blockworks.co/tag/sec">SEC</a> and <a href="https://blockworks.co/tag/cftc">CFTC</a> have continued their offensives against a number of major crypto players with US ties.&nbsp;



Scott Gralnick, who holds the title of director of channel partnerships at Halborn, told Blockworks in an interview on Tuesday that the ultimate goal of the crypto intercompany collaboration is to combine a couple of “preventive” and “proactive” firms to craft “preventative solutions.” 



“With where [we are], I thought it was paramount that we keep this ecosystem safe and secure,” Gralnick said, referring to macro events and speaking on behalf of Halborn. “This [digital assets] ecosystem at large is lacking what this [industry[ needs to be safe in terms of security.”



His company now is up to a team of about 100 employees, which Gralnick referred to as “white hat hackers” in an industry with bad actors still abounding.&nbsp;



“Right now, what the ecosystem looks like reminds me of 2019…post ICO [boom],” he said. “All the scammers are sort of being flushed out of the system, and you&#8217;re getting back to the real builders in the space building products, keeping [their] heads down and getting ready for the [next] boom. We’re in the same type of environment.”&nbsp;&nbsp;



It’s designed to break things down into seven sequential phases, according to both companies. Halborn is responsible for executing phases one to five, as outlined in the image below, while Chainalysis is taking on the remaining two phases: “fraud prevention” and “ongoing monitoring.”



<figure class="wp-block-image"><img decoding="async" src="https://lh4.googleusercontent.com/B_jCmfWIQjvbx3fHeaAdu6dMf903rz5Y500w0fG5PvxND_4hIiFHOltWHvPoTJpt8RKDQ7Y97tWso_GRimfpBUxAcLWbdm_2jFkBeM9kR2NBbubMBMtBfDLn3NRrEqe7PW5zopt8p8mXDp3HC272M9U" alt=""/><figcaption class="wp-element-caption">Source: Halborn and Chainalysis</figcaption></figure>



The penultimate phase, according to the joint statement, is designed to prioritize “the detection of high-risk activities” with a focus on “preventing fraudulent transactions.”



“The key takeaway is that we’re trying to keep the ecosystem safe, and you can&#8217;t do anything on your own,” Gralnick said in the interview. “If you want to go fast, go alone. If you want to go far, go together.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Chainalysis, Halborn Join Forces To Tackle Crypto Fraud

US law enforcement officials are lauding Blockchain Intelligence Group for the crypto investigative firm’s “significant collaboration” with federal officers probing the Frosties NFT collection rug pull.



Blockchain Intelligence Group’s role, officials said in a <a href="https://www.globenewswire.com/news-release/2023/03/27/2634710/0/en/Crypto-Investigative-Support-Company-Recognized-in-U-S-Department-of-Homeland-Security.html">statement</a> on Monday, resulted in the first federal arrest pertaining to an alleged NFT scam and prevented “additional victims from being defrauded.”&nbsp;



Federal authorities awarded Blockchain Intelligence Group the Homeland Security Investigations’ annual “private sector partnership award,” they said. Firm executives and employees were recognized in a ceremony at New York’s John Jay College of Criminal Justice on Friday. 



Blockchain Intelligence Group CEO Lance Morginn accepted the honor on behalf of the company, according to the company. It was bestowed by Ivan J. Marvel, who holds the title of special agent in charge for the New York unit of Homeland Security Investigations (HSI).



The Frosties scam is said to have resulted in NFT holders being defrauded of as much as $1.3 million in early 2022. At the time, the ruse was indicative of rising proliferation of bad crypto actors in a bullish digital collectibles space.



Frosties are a “cool, delectable, and unique” NFT collection, according to its OpenSea <a href="https://opensea.io/collection/frosties-nft">page</a>, which lists the 8,888 total Frosties minted.&nbsp;



Ethan Vinh Nguyen and Andre Marcus Quiddaoen Llacuna were <a href="https://www.justice.gov/usao-sdny/pr/two-defendants-charged-non-fungible-token-nft-fraud-and-money-laundering-scheme-0">charged</a> by the Department of Justice in relation to the rug pull, which was <a href="https://blockworks.co/news/nft-creators-stole-1-3m-from-investors-then-vanished-sources-say">previously reported by Blockworks</a>. The previous account cited sources, including interviews with Frosties holders who said they were defrauded, in breaking the news.&nbsp;&nbsp;



In the statement on Monday, Morginn said that when the Blockchain Intelligence Group “identified suspicious behavior occurring over social media channels relating to what appeared to be an apparent rug pull involving the Frosties NFT” and notified law enforcement “without hesitation.”&nbsp;



The blockchain tracing specialist then teamed up with law enforcement officials, Morginn said, and “quickly tracked and traced the flow of funds as well as the NFT all on one graph.”



Correction, March 29, 2023 at 12:37pm ET: Blockchain Intelligence Group won the Homeland Security Investigations’ annual &#8220;private sector partnership award,&#8221; not its parent company, the publicly traded BIGG Digital Assets.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Investigators Sing Blockchain Intelligence’s Praises in Frosties NFT Probe

Casey Wagner

Around $775,000 of stablecoin USDT was allegedly stolen in a phishing scheme on the Tron network, according to an investigation by risk assessment firm Global Ledger.



Global Ledger claims the funds were laundered via the TRX staking mechanism. Staking on Tron involves delegating TRX tokens to one of 27 Super Representatives, the network’s version of a validator node.



Global Ledger said the fraudsters used the SunSwap exchange to get <a href="https://blockworks.co/price/usdt" target="_blank" rel="noreferrer noopener">USDT</a> for Tron in a certain wallet. They then used <a href="https://blockworks.co/price/trx" target="_blank" rel="noreferrer noopener">TRX</a> for staking to verify their transactions and cover transaction fees, Global Ledger said.&nbsp;



The staking volume enabled the thieves to elect a specific Tron validator called “metaverse home,” a representative from Global Ledger told Blockworks. “Together with the wallet that collects the profit, approximately 100 phishing wallets participate in voting to help ‘metaverse home’ be chosen as a validator.”



With “metaverse home” selected, the validator receives the opportunity to create transaction blocks and receive a reward of 16 TRX for each block, the representative added.



“Proceeds were not cashed out through exchanges, in which case they can be traced and seized by law enforcement,” a representative from Global Ledger told Blockworks. “They were used to vote for the validator, [to] earn the cleanest money possible, [freshly] mined coins.”



The use of USDT is incidental and “metaverse home” is not linked to <a href="https://blockworks.co/tag/tether" target="_blank" rel="noreferrer noopener">Tether</a>, Global Ledger said, but its status and ability to earn money validating the blocks is certainly based on funds received from phishing USDT.



The nature of the scam shows how automated voting for a super representative can in ways permit this type of scheme, Global Ledger said.&nbsp;



“This is the first time we see such a laundering scheme,” a representative from Global Ledger said, noting that the scheme’s scale and sophistication indicates a business-like venture.



“These guys may have Slack, Jira and daily stand-ups like any other startup,” they said.



Updated Feb. 27, 2023 at 2:56 pm ET: An earlier version of this story misstated the total amount of stolen USDT.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Tracking a Novel Scheme to Launder Tether on Tron Blockchain

Bessie Liu

A report making the rounds among crypto traders this week claims 97.7% of tokens launched on decentralized exchange Uniswap V2 are rug pulls.&nbsp;



But the researcher behind it said the paper’s intention has been widely misinterpreted. 



Rug pulls are when developers or promoters hype up emerging tokens without any plans to actually execute on their promises. The often-sophisticated scams absconded with <a href="https://www.statista.com/chart/27775/biggest-rug-pulls-by-estimated-cryptocurrency-usd-value-stolen/" target="_blank" rel="noreferrer noopener">$7.7 billion</a> in 2021, according to Statista. 



In an interview with Blockworks, Bruno Mazorra — a Ph.D. candidate studying blockchain, cybersecurity and cryptography at the University of Pompeu Fabra — said that his research which is making its way through <a href="https://twitter.com/DrNickA/status/1587060596234747907?s=20&amp;t=_iz2jxswArearV8528dK_A" target="_blank" rel="noreferrer noopener">crypto Twitter</a> was intended to show how artificial intelligence (AI) technology could be used to detect scam tokens, rendering regulation unnecessary. 



“I’m quite afraid that [the paper is being] misused,” he said.



Despite Mazorra’s intentions, users are concerned that the research could be co-opted by governments to dole out regulation.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><a href="https://twitter.com/Bitboy_Crypto?ref_src=twsrc%5Etfw">@Bitboy_Crypto</a> has our back ! He’s taking arrows to protect Defi ! But in all seriousness US gov will use this to strongly regulate decentralized exchanges.&mdash; BJ (@buc_eescrypto) <a href="https://twitter.com/buc_eescrypto/status/1587069785287938050?ref_src=twsrc%5Etfw">October 31, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The paper caught the attention of the likes of Scott Lewis, co-founder of analytics protocol DeFi Pulse, who criticized the researchers for misusing the term “rug.”



“Most of [the tokens] on Uniswap were low effort/low revenue phishing style scams, where the token tried to look like an established token. Same scammer could launch thousands of these,” he tweeted. “‘Rug’ is an exit scam and was not 97.7% of tokens on Uniswap.”



Maya Zehavi, CEO of Stealthy Venture Labs, also picked apart the report. She said that claiming 97% of Uniswap tokens were rugpulls was equivalent to “saying 97% of Twitter accounts are fake, but none were active during the last year.”



<blockquote class="wp-block-quote">The original intention of the paper, according to Mazorra, was to show how you can use machine learning tools to detect scam tokens.</blockquote>



“This was not [a reason] for there to be more regulation in the crypto space, that is not the purpose of the paper at all,” Mazorra said. “We wanted to show how you could have the same impact without regulation.”



Mazorra also pointed out the paper — circulated by Nick Almond, the protocol leader of FactoryDAO — was a non-peer-reviewed version of the report that had been published in a bull market. An updated, peer reviewed version of <a href="https://www.mdpi.com/2227-7390/10/6/949" target="_blank" rel="noreferrer noopener">the study</a> can be found on the Multidisciplinary Digital Publishing Institute.



“It was much easier to do rug pulls in the bull market,” he said. “If we redo this paper in the bear market, I think our hypothesis or conjecture will change completely — how a scam would be deployed would be very different.”



Uniswap V2 is not the only decentralized exchange that allows users to launch tokens with very little value, Mazorra noted. In a hackathon at ETH Amsterdam, Mazorra and his research partner found similar results on Polygon and Uniswap V3.



Ultimately, Mazorra hopes his research and the machine learning tools he has developed can be a gateway for people to understand cryptocurrency tokens and make better investment decisions.



“We are just purely analyzing and understanding — we are not pushing for regulation,” he said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Are 97% of Tokens on Uniswap Really Rug Pulls?

Sebastian Sinclair

<div id="highlights-block_62e3359f241e1" class="highlights">
 <ul>
 <li>Google and Apple are being pressed on how they police crypto-related fraud in mobile applications hosted on their app stores</li>
 <li>Letters issued to the tech giants&#8217; CEOs are part of Sen. Brown&#8217;s wider probe into crypto scams</li>
 </ul>
 
</div>



The heads of Google and Apple are staring down requests for&nbsp;information from the US government about how the tech giants implement safeguards and monitor for crypto fraud in&nbsp;mobile applications hosted on their app stores. 



Chairman&nbsp;of the Senate Committee on Banking, Housing and Urban Affairs, Sen. Sherrod Brown (D-OH), sent <a href="https://www.banking.senate.gov/imo/media/doc/letter_to_alphabet_sundar_pichai_07272022.pdf" target="_blank" rel="noreferrer noopener">two</a> near-identical <a href="https://www.banking.senate.gov/imo/media/doc/chairman_brown_letter_to_apple_tim_cook_07272022.pdf" target="_blank" rel="noreferrer noopener">letters</a> Thursday to Google&#8217;s Sundar Pichai and Apple&#8217;s Tim Cook.



Brown, the committee&#8217;s chair since February, is requesting the companies describe their review processes for apps that make it onto their stores, as well as how they go about policing certain apps that circumvent their store policies.



The requests come as the senator ratchets up efforts to understand the scope of crypto-related scams. Also on Thursday, Brown chaired a <a href="https://www.banking.senate.gov/hearings/protecting-investors-and-savers-understanding-scams-and-risks-in-crypto-and-securities-markets" target="_blank" rel="noreferrer noopener">hearing</a> on “Protecting Investors and Savers: Understanding Scams and Risks in Crypto and Securities Markets.”



In it, the committee heard about how bad actors use marketing as a means to promote scams including through the use of apps hosted on Google&#8217;s and Apple&#8217;s stores.



Melanie Senter Lubin, president of the North American Securities Administrators Association and Gerri Walsh, senior vice president of investor education at the Financial Industry Regulatory Authority, both offered their insights during the hearing.



In his letters, the senator has sought information on the systems and processes the companies have in place for people to report fraudulent, apps as well as actions taken to alert users to fraudulent crypto app activity.



&#8220;While firms that offer crypto investment and other related services should take the necessary steps to prevent fraudulent activity, including warning investors about the uptick in scams, it is likewise imperative that app stores have the proper safeguards in place to prevent against fraudulent mobile application activity,&#8221; the senator wrote.



Apple and Google are being urged to respond to the senator&#8217;s request for information by no later than August 10, 2022.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Google, Apple Asked to Review Protections Against Crypto App Fraud

Shalini Nagarajan

<div id="highlights-block_629ddabf61cad" class="highlights">
 <ul>
 <li>Scammers used fake investment opportunities and romance-linked fraud to trick people into crypto transfers</li>
 <li>Nearly half of the victims were targeted on Instagram, Facebook, WhatsApp and Telegram</li>
 </ul>
 
</div>



Smart contract <a href="https://cms.blockworks.co/?s=exploit" target="_blank" rel="noreferrer noopener">exploits</a> and rug pulls may be exotic, but unsuspecting crypto users are at risk of more run-of-the-mill fraud too. Since 2021, investment-related fraud and romance scams were the top two methods of defrauding individuals on social media, according to a new <a href="https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/06/reports-show-scammers-cashing-crypto-craze#crypto1" target="_blank" rel="noreferrer noopener">report</a> by the Federal Trade Commission.



More than 46,000 people have collectively reported more than $1 billion in losses in crypto-related scams between the start of 2021 and the first quarter of 2022. That’s more than any other payment method — and nearly 60 times the crypto losses reported in 2018, according to the regulator.



The losses are not the result of any failure of cryptography or errant smart contracts, but old-fashioned social engineering that’s not unique to crypto. Last year, 59 million people in the US alone lost nearly $30 billion <a href="https://www.cnbc.com/2021/06/29/americans-lost-billions-of-dollars-to-phone-scams-over-the-past-year.html" target="_blank" rel="noreferrer noopener">to phone scams</a>.



The regulatory agency warned that using a social media platform while holding cryptocurrencies can be a particularly explosive mix.



<blockquote class="wp-block-quote">“Nearly half the people who reported losing crypto to a scam since 2021 said it started with an ad, post, or message on a social media platform,” the report said.</blockquote>



The top social media platforms identified in these online deceptions were Instagram (32%), Facebook (26%), WhatsApp (9%) and Telegram (7%).



An investment opportunity or offer that seems too good to be true usually is, and more than half of the losses reported to the FTC — $575 million — were related to <a href="https://consumer.ftc.gov/jobs-and-making-money/money-making-opportunities-and-investments" target="_blank" rel="noreferrer noopener">fake investment opportunities</a>.



“Investment scammers claim they can quickly and easily get huge returns for investors,” the report said. “But those crypto ‘investments’ go straight to a scammer’s wallet.”



Some people get convinced about the legitimacy of these schemes as they’re initially able to track the performance of their cryptocurrency and are able to make a small “test” withdrawal.


<div class="wp-block-image">
<figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="487" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png" alt="" class="wp-image-22473" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=1480 1480w" sizes="(max-width: 1024px) 100vw, 1024px" /><figcaption>Figures based on fraud reports to the FTC&#8217;s Consumer Sentinel Network indicating cryptocurrency as the payment method. The investment related fraud category includes subcategories for art, gems and rare coin investments, investment seminars and advice, stocks and commodity futures trading and miscellaneous investments. Source: <a href="https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/06/reports-show-scammers-cashing-crypto-craze#crypto1" target="_blank" rel="noreferrer noopener">FTC</a></figcaption></figure></div>


According to the FTC, <a href="https://consumer.ftc.gov/articles/what-you-need-know-about-romance-scams" target="_blank" rel="noreferrer noopener">romance scams</a> are the next most common type of crypto-related fraud. Nearly one in every three dollars of the reported losses, or $185 million, was lost to such a scam since 2021.



The regulator said sophisticated “keyboard Casanovas” allegedly entice people by laying claims to made-up wealth. They seem to offer spontaneous tips on how to get started in crypto investing before trapping the victim into sending money to a scam account.



Victims of romance scams reported a median individual loss of $10,000, the report found.



If a victim parts with cryptocurrency on fraudulent exchange platforms, imposter websites, or peer-to-peer transfers, recovery is likely to prove difficult, because transactions cannot be reversed.



People in their 30s were the most significant hit by fraud-related cryptocurrency losses. But older victims lost bigger sums, with the median amount for victims in their 70s being just under $12,000. Earlier this year, the UK’s Financial Conduct Authority <a href="https://cms.blockworks.co/fca-finds-increased-scam-reports-linked-to-crypto/" target="_blank" rel="noreferrer noopener">highlighted</a> about 3,000 reports of possible crypto-linked scams between April and September of 2021.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Frauds and Scams Top $1B Since 2021, FTC Says

<div id="highlights-block_629bdedad744f" class="highlights">
 <ul>
 <li>A malicious actor has made off with $359,000 worth of Bored Ape NFTs following a compromise to BAYC&#8217;s discord server</li>
 <li>The hack marks the third time in two months that BAYC&#8217;s NFTs have been compromised, raising questions over the project&#8217;s security</li>
 </ul>
 
</div>



A malicious actor has made off with 200 ether ($359,000) worth of Bored Ape NFTs after the Discord server belonging to the project was compromised on Saturday.



Bored Ape Yacht Club&#8217;s (BAYC) parent company, Yuga Labs, confirmed the amount in a <a href="https://twitter.com/BoredApeYC/status/1533181013815349248?s=20&amp;t=l0S14y3sVid1OW04PU6Ong" target="_blank" rel="noreferrer noopener">tweet</a> roughly 11 hours following the attack. The attacker was able to breach the security of the Discord account belonging to BAYC&#8217;s project manager Boris Vagner, according to on-chain analyst and Twitter user @NFTherder who first sounded the <a href="https://twitter.com/nftherder/status/1533037408144572417" target="_blank" rel="noreferrer noopener">alarm</a>.



<blockquote class="wp-block-quote">&#8220;Our Discord servers were briefly exploited today,&#8221; Yuga Labs tweeted via its BAYC Twitter handle. &#8220;The team caught and addressed it quickly. About 200 ETH worth of NFTs appear to have been impacted. We are still investigating.&#8221;</blockquote>



Following the successful breach, the actor was then able to post a phishing scam pretending to be Vagner that duped Bored Ape collectors into clicking a malicious link and sent their NFTs (non-fungible tokens) to the attacker&#8217;s address, NFTherder said.



Vagner was promoted to social and community manager in February, according to a <a href="https://twitter.com/BorisVagner/status/1488336821419270145?s=20&amp;t=DUcAvV7Cg4GwN-ru4d_E-g" target="_blank" rel="noreferrer noopener">tweet</a> in which he praised the founders of Bored Apes and Yuga Labs.



Questions have sprung up on social media as to how the Discord account was compromised, questioning the project&#8217;s security. Despite proper security measures by way of two-factor authentication, attackers, in this instance, may have circumvented security by obtaining a Discord ID token from a targeted victim.



One explanation for the method behind the attack was that Vagner&#8217;s Discord ID token — used to log in multiple times locally without verifying one&#8217;s identity — was also compromised. This could have allowed the actor to gain access to Vagner&#8217;s account.



The theft marks the third time BAYC has been hacked, including an instance on April 1 when a Mutant Ape Yacht Club NFT was stolen via a phishing link on Discord. Almost four weeks later, on April 25, <a href="https://cms.blockworks.co/bayc-instagram-hacked-for-more-than-10-million/" target="_blank" rel="noreferrer noopener">BAYC&#8217;s Discord and Instagram accounts</a> were also hacked when a link to a copycat website duped users into giving up NFTs worth millions of dollars.



Hundreds of users have taken to Twitter to vent their frustration at the repeated attacks and alleged lack of security.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">not getting a discord hacked is super easy. especially for projects WITH BILLIONS in revenue. honestly it&#39;s embarrassing.&mdash; UncleTravelingMatt.eth (@UncTravelinMatt) <a href="https://twitter.com/UncTravelinMatt/status/1533072701375528960?ref_src=twsrc%5Etfw">June 4, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



&#8220;They [BAYC] should consider investing a full-time security manager,&#8221; NFTherder tweeted in response to one user&#8217;s comment on BAYC&#8217;s security. &#8220;Surprised they haven&#8217;t already though.&#8221;



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.