1. Home
  2. Bot

Bot

‘Infected by fraud’ — Projects claim CoinMarketCap airdrops were gamed

A crypto project claims a promotional token airdrop campaign led by CoinMarketCap was riddled with "fraud" that left its token price crumbling.

Two crypto projects have cried foul play over promotional airdrops conducted by CoinMarketCap (CMC) on their behalf, which they allege was "gamed" for the benefit of a small group of exploiters.

These promotional airdrops — designed to be distributed to thousands of wallets to raise awareness of a crypto project — ended with the tokens funneling to just a handful of wallets, suggesting potential manipulation of the system.

SATT token drop

Blockchain advertising solution SaTT alleged to Cointelegraph that a promotional airdrop it paid CMC to conduct in Dec. 2022 ended with 84% of the airdropped tokens funneling to just 21 wallets.

The promotion was meant to see 25,000 winning wallets receive 4,000 SATT each, worth $6.30 at the time per CoinGecko data.

However, SaTT claimed that shortly after the airdrop was distributed, 20,953 wallets “automatically transferred the tokens to 21 wallet addresses” which then sold off their token holdings days later around Dec. 10, netting around $142,000 for those 21 wallet owners.

The sell-off plunged the price of SATT by 70% between the end of the airdrop on Dec. 1 to when the wallets sold their tokens on Dec. 10.

SaTT claims wallet 0x929… (pictured) has over 4,500 transactions of its token, the largest it found out of the 21. Blockchain data shows the wallet sold over 4.3 million tokens through PancakeSwap. BscScan

TokenBot token drop

A similar experience was shared by TokenBot co-founder Shaun Newsum, who told Cointelegraph that it did a similar CMC-led airdrop of its TKB token on Dec. 9.

Newsum said CMC provided its 30,000 airdrop winners but he chose to “stagger” the airdrop “just in case something happens.”

TokenBot sent out its tokens to a batch of 4,000 winners to start, but around 3,300 ended up sending the funds to one wallet, said Newsum.

Blockchain data shows thousands of TKB transactions flowing to wallet 0x5AF… before initiating a cross-chain swap and then selling its holdings. BscScan.

Newsum said around $20,000 was lost by TokenBot in the incident and the project had to deploy more liquidity from its treasury.

“Obviously some person figured out how to game CMC,” he added. “If we were to have bulk sent, the whole airdrop would’ve been a complete disaster.”

Newsum however said he has since received an apology from CMC and was told that it was investigating the airdrop and would return with an updated winners list for the project.

Cast your vote now!

In its investigation, SaTT claims to have found another 18 tokens or nonfungible tokens (NFTs) airdrops conducted by CMC since Jul. 2022 that were also allegedly “infected by fraud” to the tune of $6.6 million.

This included airdrops for projects including TopGoal, OwlDAO and AgeofGods.

SaTT theorized two possibilities of how the “fraud” occurred:

“Either a group of hackers injected tons of fake accounts [into the airdrop on CMC’s website] [...] or it was actually an inside job.”

CoinMarketCap responds

Speaking to Cointelegraph, a CMC spokesperson addressed some of these claims, arguing that at least four of the projects identified by SaTT have yet to distribute rewards, meaning it would be “impossible” for them to have faced “malicious” activity.

It also noted that while three projects, including SaTT, AgeOfGods and TokenBot have spoken to the CMC team about their concerns, it has not received any communications from other projects about the alleged issues.

The spokesperson however acknowledged that “bots are an issue that touches nearly every industry.”

“The industry has been facing this issue among airdrop programs for some time and the reality is that not a single industry has been able to solve the bot issue entirely.”

“We are continuously working to improve our systems and services to limit this issue and will work closely with these projects to find solutions and help resolve any current issues,” the spokesperson added.

Related: Crypto’s recovery requires more aggressive solutions to fraud

CMC added that any claims of bot participation in its airdrops are taken “very seriously” and itis “working on resolving each case individually.”

It also shared several features it has employed to deter bot participation, such as a CAPTCHA challenge and email verification requirements for participants. It’s also developing a two-factor authentication integration.

Cointelegraph contacted TopGoal and OwlDAO for comment but did not receive a response at the time of publicati. AgeofGods could not be reached for comment.

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

Ripple CTO shuts down ChatGPT’s XRP conspiracy theory

An AI chatbot alleged Ripple can secretly control its blockchain through an undisclosed backdoor in the network's code and has been ridiculed by the firm's CTO.

Ripple’s chief technology officer has responded to a conspiracy theory fabricated by Artificial Intelligence (AI) tool ChatGPT, which alleges the XRP Ledger (XRPL) is somehow being secretly controlled by Ripple.

According to a Dec. 3 Twitter thread by user Stefan Huber, when asked a series of questions regarding the decentralization of Ripple’s XRP Ledger, the ChatGPT bot suggested that while people could participate in the governance of the blockchain, Ripple has the “ultimate control” of XRPL.

Asked how this is possible without the consensus of participants and its publicly-available code, the AI alleged that Ripple may have “abilities that are not fully disclosed in the public source code.”

At one point, the AI said “the ultimate decision-making power” for XRPL “still lies with Ripple Labs” and the company could make changes “even if those changes do not have the support of the supermajority of the participants in the network.”

It also contrasted the XRPL with Bitcoin (BTC) saying the latter was “truly decentralized.”

However, Ripple CTO David Schwartz has called the bot’s logic into question, arguing that with that logic, Ripple could secretly control the Bitcoin network as it neither can be determined from the code.

The bot was also shown to contradict its own statements in the interaction, stating that the main reason for using “a distributed ledger like the [XRPL] is to enable secure and efficient transactions without the need for a central authority,” which contradicts its statement that the XRPL is managed centrally.

Related: Ripple files final submission against SEC as landmark case nears end

ChatGPT is a chatbot tool built by AI research company OpenAI which is designed to interact “in a conversational way” and answer questions about almost anything a user asks. It can even complete some tasks such as creating and testing smart contracts.

The AI was trained on “vast amounts of data from the internet written by humans, including conversations” according to OpenAI and warned because of this some of the bot's reponses can be “inaccurate, untruthful, and otherwise misleading at times.”

OpenAI CEO Sam Altman said upon its release on Nov. 30 that its “an early demo” and is “very much a research release.” The tool has already seen over one million users according to a Dec. 5 tweet by Altman.

Ethereum founder Vitalik Buterin also weighed in on the AI chatbot in a Dec. 4 tweet saying the idea that AI “will be free from human biases has probably died the hardest.”

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

Bank of Thailand Needs More Time to Complete and Launch Retail Digital Currency

Bank of Thailand Needs More Time to Complete and Launch Retail Digital CurrencyThe central bank of Thailand is not going to rush with the launch of its digital currency as it’s not yet sure about the benefits it would bring. According to the head of the monetary authority, the development of the state-issued coin may take several years. Thailand’s Central Bank Wants to Better Understand Risks of […]

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

3Commas issues security alert as FTX deletes API keys following hack

3Commas and FTX conducted a joint investigation in relation to reports from users of unauthorized trades on the DMG trading pairs on FTX.

Automated crypto trading bot provider 3Commas issued a security alert after identifying certain FTX API keys being used to perform unauthorized trades for DMG cryptocurrency trading pairs on the FTX exchange.

3Commas and FTX conducted a joint investigation in relation to reports from users of unauthorized trades on the DMG trading pairs on FTX. The duo identified that hackers used new 3Commas accounts to perform the DMG trades adding that “The API keys were not taken from 3Commas but from outside of the 3Commas platform.”

A subsequent investigation found fradulent websites posing as 3Commas were being used to phish API keys as users linked their FTX accounts. The FTX API keys were then used to perform the unauthorized DMG trades.

3Commas further suspects that hackers used 3rd-party browser extensions and malware to steal the API keys from users, adding:

“To reiterate and clarify, there has been no breach of either 3Commas account security databases or API keys. This is an issue that has affected multiple users who have never been customers of 3Commas so there is no possibility that it is a leak of API keys originating from 3Commas.”

Both FTX and 3Commas identified suspicious accounts based on user activity and suspended the API keys to avoid further losses.

A set of guidelines shared by 3Commas for user's safety. Source: 3Commas

FTX users that have connected their accounts with 3Commas and receive a message regarding their API being “invalid” or “requires updating” must create new API keys. In such cases, 3Commas suggested that:

“It is possible your API details were compromised and the API key has been deleted by FTX.”

Users have the option to create a new API key on FTX and link it to their 3Commas account to ensure no disruption to active trades.

3Commas are currently working with the victims to provide assistance and gather more information about the hackers.

Related: Voyager customers could recover 72% of frozen crypto under FTX deal

FTX recently partnered with Visa to roll out debit cards in 40 countries worldwide. The partnership allows FTX users to pay for goods and services using debit cards that boast “zero fees” and no yearly charges.

The market reacted to the development as the FTX token spiked 7%, momentarily reaching a trading price of $25.62.

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

MEVbots backdoor drains users’ Ethereum funds via arbitrage trading bot

An investigation of MEVbots’ contract revealed a backdoor that allows the creators to drain Ether from its users' wallets.

MEV gain, an Ethereum (ETH) arbitrage trading bot built by MEVbots, which claims to provide stress-free passive income, has been actively draining its users’ funds via a fund-stealing backdoor. 

Arbitrage bots are programs that automate trading for profits based on historical market information. An investigation of MEVbots’ contract revealed a backdoor that allows the creators to drain Ether from its users' wallets.

The scam was first pointed out by Crypto Twitter’s @monkwithchaos and later confirmed by blockchain investigator Peckshield. 

Suspect account @chemzyeth promoting MEV services. Source: Google cache

Following the revelation, primary promoter of MEV @chemzyeth disappeared from the internet.

@chemzyeth's Twitter account deleted after community callout. Source: Twitter

Peckshield further confirmed that at least six users had fallen victim to the backdoor attack.

Transaction of stolen funds from MEV gain's fund-stealing backdoor. Source: Peckshield

However, considering that the contract is still active, at least 13,000 unwary followers of MEVbots on Twitter remain at risk of losing their funds.

Related: ETHW confirms contract vulnerability exploit, dismisses replay attack claims

Carrying forward the success of scalability-focused layer-2 solutions, Ethereum co-founder Vitalik Buterin shared his vision for layer-3 protocols. He stated:

“A three-layer scaling architecture that consists of stacking the same scaling scheme on top of itself generally does not work well. Rollups on top of rollups, where the two layers of rollups use the same technology, certainly do not.”

One of the use cases for layer-3 protocols, according to Buterin, is “customized functionality” — aimed at privacy-based applications which would utilize zk proofs to submit privacy-preserving transactions to layer 2.

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

Axie Infinity’s Discord bot compromised, hackers issue fake minting message

The developers have managed to delete the fake message and remove the MEE6 bot from the main server.

Axie Infinity, the popular play-to-earn nonfungible token game, faced another attack on its Discord server earlier on Wednesday, leading to a compromise of its MEE6 bot.

MEE6 is a popular discord bot mainly used for automating roles and messages and is used by numerous crypto projects. The attackers used the compromised bot to add permissions to a fake Jiho account, and later issued a fake announcement regarding a mint.

The developers managed to remove the compromised MEE6 bot from the main server and deleted the fake messages as well. However, the official Twitter account of the project warned that many users might still see the fake message until they restart their Discord.

The developers also claimed that the compromise of MEE6 is not a new phenomenon and many projects have faced similar issues. However, the official MEE6 Discord support channel denied allegations of a hack and claimed they have verified with their engineers and didn't see any unusual activity.

MEE6 Official Discord Channel Message

Many believe that the hackers compromised the admin accounts first and then got access to the alternate admin account using MEE6. This helped them to send out webbook messages while hiding the compromised administrator account.

Related: The aftermath of Axie Infinity’s $650M Ronin Bridge hack

The Discord bot compromise comes within a month of one of the biggest heists on Axie Infinity’s Ronin bridge resulting in a loss of over $600 million worth of crypto assets. The recent slew of security breaches has brought down the confidence of the community in the game, which was once seen as a revolutionary project for the gaming world.

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

Solana developers share 3 key mitigation steps to make the network robust

Developers have suggested changing Solana’s current data transfer protocol UDP to QUIC, stake-weighted transaction processing and a fee-based transaction priority.

The Solana network faced its seventh outage on Saturday, resulting in a downtime of over seven hours. The developer team has released an outage report, along with three key mitigation steps to make the network more stable.

The network outage on Solana was caused by a significant surge in the number of transactions due to nonfungible token (NFT) minting bots. The bots used Candy Machine, a popular application used by Solana NFT projects to launch collections.

The transaction volume reached six million per second, overflowing individual nodes with 100 Gbps data. As a result, validators ran out of data memory, leading to a loss of consensus among them.

The developers ruled out distributed denial of service (DDoS) attacks and blamed NFT minting bots for the congestion. The network came online at 3:30 am UTC on Sunday.

The official report highlighted three key mitigation steps that are in work to make the Solana network more resilient against such congestion issues. The first major step is to move from its current data transfer protocol called user datagram protocol (UDP) to Google-developed quick UDP internet connection (QUIC). QUIC offers fast asynchronous communication like UDP, but with sessions and flow control like transmission control protocol.

The second key step is the integration of stake-weighted transaction processing instead of its current first-come-first-serve basis. The developers claimed a stake-weighted transaction processing along with QUIC would be more robust.

The third mitigation step is to introduce “fee-based execution priority,” where users would have the option to add an additional fee on top of the base fee. The fee prioritization is set for the v1.11 release.

Related: Solana DAOs can now bug you to vote with phone calls and texts

Apart from the Solana network outage, an even bigger controversy was the beta cluster restart instructions, reportedly issued by validator operators. The said instructions asked validators to block NFT minting bots manually at the layer-1 layer.

Solana Beta Cluster Restart Instructions Souce: Twitter

However, Solana’s head of communication Austin Federa said that the majority of validators kept their distance from censoring and a new update is being introduced on the Candy Machine with additional anti-bot features.

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

Telegram Users Can Send and Receive Toncoin Within Messenger Chats

Telegram Users Can Send and Receive Toncoin Within Messenger ChatsTelegram users can now send and receive toncoin directly within the application’s chats, according to a tweet by The Open Network (TON) Foundation. In addition to the toncoin support, users can also purchase bitcoin via the software’s bot system. TON Foundation Reveals Telegram Toncoin Support, Users Can Purchase Bitcoin via Bot The ability to send […]

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

Thailand Adopts Rules Restricting Cryptocurrency Payments From April

Thailand Adopts Rules Restricting Cryptocurrency Payments From AprilRegulators in Thailand have decided to limit the use of cryptocurrencies as a means of payment. The authorities consider the country’s current payment system efficient and insist cryptos would only bring risks for the financial system, economy, people and businesses. Thailand SEC Issues Regulations Limiting Use of Digital Assets for Payments Financial regulators in Thailand […]

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst

$1 million rock NFT sells for a penny in all ore nothing error

A simple mistake led one crypto user to sell his precious rock NFT for 444 WEI instead of 444 ETH, a tenth of a penny rather than $1.2 million.

It's a hard rock life for one crypto user. A clumsy keystroke and the actions of a sniper bot caused a million-dollar mistake on March 10.

A rock valued at 444 ether (ETH), or $1.2 million, sold for 444 Wei ($0.0012) to a bot as the seller, DinoDealer confused WEI and ETH. In a tweet, the seller said “in one click my entire net worth of ~$1 million dollars, gone.”

The "bot sniped" refers to bot snipers, which initially came into usage on auction site eBay. Buyers looking to time their bid to the last second would use the tools, however, they are now prolific on NFT listings. The popular freelance website Upwork now lists bot sniping tools for the NFT platform OpenSea from as little as $200. 

Once the bot snaps up the NFT or digital receipt, there’s no going back. Blockchains are constructed to be immutable so simple mistakes, such as confusing ETH and WEI, can be extremely costly.

Indeed, human error abounds in the crypto world. An unfortunate Bitcoin (BTC) user recently lost $10,000 (0.25 BTC) in a mistake that could have been avoided had they double-checked the receiver wallet address.

The seller, DinoDealer, seems to have come to terms with the loss, publicly sharing the address of the rock’s bot snipe. They made light of the situation by uploading a new Twitter profile picture and adding a crying emoji after their Twitter handle. Their avatar stands next to the precious rock, crossed out in red.

DinoDealer's new Twitter picture with sad rocks and cancelled rocks in the background. Source: Twitter

More jokes came from DinoDealer's futile attempt to reach out to the “crypto customer service.” Their attempts to speak to members of the crypto community were met with replies from suspicious users purporting to help, offering email addresses and WhatsApp numbers. 

Screenshots of the conversations DinoDealer had with "crypto customer service." Source: Twitter

Do not reach out to these numbers or email addresses.

The past month has been tumultuous for seemingly minor errors with potentially dire consequences. In some cases, a simple mistake can wipe millions of dollars of market value increasingly common.

Related: Rare Bears Discord phishing attack nabs $800K in NFTs

A Coinbase white hacker discovered a mistake in the Coinbase Pro code which could have nuked the market, while frantic bot trading behaviors drained the WTF token launch of 58 ETH. “Poor liquidity pool management” left the launch exposed.

In better days for DinoDealer, other crypto rock enthusiasts have come to his aid, one user sending the geologist salesman a picture of the rock with glasses and headphones, signed “mfer rocks.”

Rock bottom consolation for one million dollars.  Source: Etherscan

Here’s the Next Price Target for Bitcoin As BTC Repeats Previous Bull Market Pattern: Crypto Analyst