1. Home
  2. Exit Scam

Exit Scam

Crypto Hacks and Scams Cost $300 Million in August

Crypto Hacks and Scams Cost 0 Million in AugustIn August, approximately $310.9 million was lost to exploits, hacks, and scams. However, digital assets worth $10.3 million were recovered, resulting in a net loss of $300.6 million. According to the security firm Certik, this is the second-highest monthly loss in 2024 so far. While May had the highest exploit total loss of just over […]

Fake crypto liquidity pools: How to spot and avoid them

Users say ZKasino still hasn’t returned ETH months after claims opened

The project claimed it was allowing users 72 hours to sign up to receive their ETH back, but two months later, the funds have not moved.

Controversial Web3 gambling protocol ZKasino still has not returned users’ Ether, more than two months after they launched a “signup” app for refunds, according to reports from users.

The project was previously accused of being an exit scam. But on May 28, the team promised to use a new app to return the funds that had been bridged to the network. But users claim the app simply took their ZKAS tokens and gave them nothing in return.

“Unfortunately, everyone who sent the ZKAS back has not heard anything from them yet,” one user, who communicated on the condition that his identity not be revealed, told Cointelegraph.

Read more

Fake crypto liquidity pools: How to spot and avoid them

Astrology NFT project ‘Lucky Star Currency’ rugged for over $1m – Certik

The deployer account for LSC drained over $1 million in tokens from the project, then swapped them to BUSD using PancakeSwap.

The astrology-themed NFT project Lucky Star Currency (LSC) has performed an exit scam for over $1 million, according to an October 9 report from blockchain security firm Certik.

The project’s deployer account called the ‘withdrawToken’ function on both the NFTMerge and AdwardCenter contracts, removing over $1 million in LSC from them. These tokens were then swapped for Binance USD (BUSD) stablecoin and sent to another account.

Lucky Star Currency is a project that focuses on NFTs and claims to be founded by astrologists. Its contracts include an Award Center and NFT Marketplace. It is marketed towards the Chinese crypto investment market. The team promotes the project on X (formerly Twitter) under the username @AstrAstrol75591. It also has a Telegram channel. As of October 9, the project’s website and user interface are offline.

Before the alleged rug, Lucky Star Currency was heavily promoted on the Chinese news app Toutiao and Q&A platform Zhihu.

At approximately 02:52 a.m. UTC, BNB Smart Chain address 0x9Ef72Ee68a7c841986A0C60e0FDbAE4e27446Deb removed over 1.6 million LSC from the AwardCenter contract for Lucky Star Currency. In a second transaction, an additional 1.4 million LSC was drained from the project’s NFTMerge contract. After draining funds, the attacker swapped them for over $1 million in BUSD via Pancake swap and then sent them to account 0x23f8c805306Bf27AB8bf3cEbEce4B778acfFd896. This account has been receiving BUSD from various sources for the past 82 days, implying that there may be more than one scam depositing funds to it.

According to Certik, the contracts that were drained have been listed on Telegram as the project’s official contracts.

Admin Telegram post stating the official addresses for LSC contracts 'NFTMerge' and 'AwardCenter.' Source: Certik.

In addition, blockchain data shows that the attacking account is the deployer for the AwardCenter contract.

Related: Chinese DeFi protocol WDZD Swap exploited for $1.1M: CertiK

The company that promoted the project claimed to have an office in Shenzen City, China.

Lucky Star Currency office, Shenzhen, China. Source: Certik, Telegram

Rug-pulls from Chinese projects have become a recurring problem in the Web3 space. Running a centralized cryptocurrency exchange is illegal in the country. Because of this, users who deposit to a Chinese protocol that has centralized elements may risk having their funds confiscated by police.

Over $100 million were lost in July when the China-based Multichain protocol drained all of its users' funds into an attacker’s account. The team alleges that police have arrested their CEO, but victims still search for answers as to what happened to their funds and how they can be reimbursed.

Fake crypto liquidity pools: How to spot and avoid them

Tragedy or rug pull? Inside the collapse of a ‘charitable’ NFT project

Orica NFT’s charity efforts have succeeded, but its tokenholders have not, and up until now, its co-founder was nowhere to be found.

Launched in November 2021, nonfungible token (NFT) marketplace Orica held itself up as an “ethical platform” benefitting artists, collectors and charities alike. At the time, the organization was involved in prominent projects — from building a school in Uganda to aiding victims of human trafficking to helping Ukraine

But less than two years later, the project’s founders have disappeared, and the marketplace’s user interface has gone offline. All that remains are the project’s charity efforts, which proved to be genuine, in tandem with allegations from disgruntled users that the developers orchestrated a rug pull. In a new revelation, co-founder Danial Zey breaks his yearlong silence, not only denying all allegations and insisting the project was “hacked” but also claiming that the project is still ongoing. Cointelegraph investigates. 

An ICO amid the bear market

According to initial coin offering (ICO) information site CryptoTotem, Orica ran a fundraiser from Aug. 14 to Sept. 14, 2021. It aimed to raise $3.1 million from the sale of its Orica (ORI) token. In its ICO, Orica promised to earmark 50% of the total supply of ORI for “NFT marketplace rewards.” Another 10% was supposed to be supplied to “advisors and partners,” 15% given to the team and 25% sold to investors. At launch, Aug. 21, 2021, the price of ORI rose to a peak of $3.638 per coin, then fell to $0.036 by Oct. 1, 2022, based on data from Live Coin Watch. 

The token no longer has tangible value at the time of publication, and its communication channels appear to have gone cold. A former user, who wished to remain anonymous, told Cointelegraph that the “[NFT] marketplace kind of dried out with not enough people using it and then very quickly everything went kind of offline including their website."

ORI price chart. Source: Live Coin Watch

The philanthropy that survived 

In late 2021, the firm partnered with Austrian charity project Bbanga to help build a school for children in the Ssese Islands in Uganda. Bbanga commissioned German digital artist Mellowmann to release Uganda-inspired digital art pieces as NFTs, which were then to be sold via Orica’s marketplace. The sale surpassed the $6,500 goal needed to construct the school.

Mellowmann and Bbanga NFT sold at the Orica auction. Source: Orica

A former Orica staff member, who wished to remain anonymous, told Cointelegraph that “the Uganda school received full payment as this was overseen by Sani, Founder of the Bbanga Project, who was working with Orica at the time." The project released a video this June showcasing that some of the school's buildings had already been built, including a main hall and library.

The Orica and Bbanga school in Uganda. Source: Bbanga

On Dec. 21, 2021, charity group Hope for the Future also announced that it would be selling NFTs on Orica to fund its efforts. Hope for the Future is another Austrian-based nonprofit that helps victims of human trafficking reintegrate into society after they are rescued from captivity. The charity continues to operate today. Its efforts to help Ukrainian artists also materialized in the REFUGE campaign that ran in March 2022. 

An embroidery NFT "Obra" previously held for sale on Orica. Source: Aline Brant

When prompted on the matter, the former Orica staff member said, “All artists were paid in full." An amount close to $30,000 was raised in conjunction with Orica’s efforts to help Ukraine and was processed by crypto donations processor The Giving Block. In one of the last statements before going cold, Zey wrote: “We donated 10% of the amount we ever made. Our main product is tech that is built to give to people."

And the project that didn't ...

Despite official claims as to why the project went down, blockchain data and user complaints suggest irregularities. 

On May 11, 2022, the Polygon version of Orica was deployed as part of its migration from BNB Smart Chain. This version had a total supply of just 84 million tokens, 16 million less than the original Orica token on BNB Chain. The Polygon version of ORI was a “liquidity generator” token with built-in liquidity provider and swap functions. It had the ability to call contracts on the decentralized exchange QuickSwap, which is a fork of Uniswap v2 on Polygon. 

On June 4, 2022, an Orica Discord server admin who goes by the name “Plem” told users the migration was complete. According to Plem, users had received tokens on the new chain equal to the ones they held on the previous chain.

Orica announcing the Polygon migration. Source: Discord

Some users complained that they had not received their tokens. In response, the admin told them to add the new token contract in MetaMask. If they did this and still did not see their tokens, they were asked to submit a support ticket. 

But the deployer on Polygon did not directly send tokens to users who held ORI on BNB. Instead, it transferred ownership to a separate account, which proceeded to sell nearly the entire supply of the coin through market-making operations. Zey stated that this second account was not operated by him. Instead, he claimed that a “hacker” stole his deployer key and transferred it. The new owner proceeded to call various liquidity provider and swap functions over the next two months on QuickSwap.

Zey did not report this attack until Aug. 11, 2022, exactly one month after it had occurred. A member of the team had reported 24 days after the “attack” that the migration had been completed. The same day, the new owner transferred an unusually large amount of tokens — 23,187,983 — to address 0x14dd44e1d3f9a173998c53d75622127ce921ccee. After this transaction, the new owner continued to post liquidity provider transactions for ORI tokens until the new owner stopped on Sept. 11, 2022. In a similar Aug. 11, 2022 Telegram message, Zey claimed that his laptop had been hacked and that tokens had been “moved out directly from the deployer.”

On Aug. 12, 2022, Plem announced that the project would be “closing communications” due to a “hard situation that involves massive uncontrollable tokens deployment and selling process.”

Orica staff stating that they would cease communications. Source: Discord

In the final message, users were told to send direct messages to Zey if they had questions, referring to the team’s blockchain operations lead. Subsequent messages to the group indicate that Zey has blocked all messages.

Orica's last message before going dark on Discord. Source: Discord
Co-founder Danial Zey’s response to a user inquiry before new messages in the channel were archived. Source: Telegram

Related: Newly discovered Bitcoin wallet loophole let hackers steal $900K — SlowMist

On Sept. 11, 2022, the new owner made a final transfer of approximately 150 Polygon (MATIC), worth $133.10 at the time, to address 0xfE3fB1d3C9FBF50b6af3A60b5D070dF68D87b99e. This account had previously received 3,463 MATIC ($3,082 at the time) from the new owner. At the time of publication, 9.9 million ORI ($4,341 at today’s price) remains in the account that was transferred ownership after deployment. 

Co-founder’s new revelations

Speaking to Cointelegraph on Aug. 17, 2023, Zey denied the rug pull allegations, stating: 

“I think the situation is complex and it is not wise to give out info that we might need to win some of the funds back. About the part with rug pull. We had a team of more than 15 people and we paid them until the end salaries plus we paid for the liquidity , Certik audit and some parts of the development."

“Our tokens were locked," said Zey. “On the blockchain it is also provable that we had several severe attacks on us. We are a charity project but still got hacked," he stated while alleging that hacked funds were laundered through cryptocurrency mixer Tornado Cash, making it impossible to trace. “The few remaining people that worked without any salary like myself are still in this project working patiently behind the scenes but the comeback has to be strong so we can make up for the situation," Zey claims. 

Zey did not respond to a request for the hash ID of transactions linked to the alleged Orica hack. 

Out of 12 team members listed in the project’s ICO, five have deleted their LinkedIn profiles — Zey, legal counsel Ivan, process manager Karim, IT project manager Pouriya and business development manager Rilwan. The others, save for Zey, were either unreachable or had left Orica by the time of its breakdown. 

The Orica founding team became unreachable after last year. Source: CryptoTotem

A mixed legacy 

As of today, most of what remains of Orica is in the brick and stone of a school in Uganda and the artists it has helped.

But also remaining are the tokenholders who never received a proper explanation as to why the project has ceased to exist. Despite breaking his silence, Zey never addressed the reasons for the hiatus, and many questions remain unanswered. 

It’s not uncommon to see that investors and co-founders alike build rapport around a project as friends and exit as enemies during its collapse. But for Orica, there was at least a brief moment in which everything seemed to have worked well.

Cointelegraph editor Zhiyuan Sun contributed to this story. 

Related: Crypto developer commits $2M rug pull fraud to fuel gambling addiction

Fake crypto liquidity pools: How to spot and avoid them

Project takes off with $31.6M in alleged exit scam

On-chain detective ZachXBT believes that the project has “likely exit scammed” after bridging $31.6 million to multiple addresses on Tron and Ethereum.

A crypto project called Fintoch, which claimed to be backed by investment banking firm Morgan Stanley, seems to have taken off with almost $32 million of its users' funds, according to on-chain detective, ZachXBT. 

In a thread, the crypto sleuth showed a diagram that detailed the movement of the funds. The on-chain detective alleged that the project had likely conducted an exit scam.

The fund promised a 1% daily interest for investments from users. However, users of the platform have started to report that they are now unable to withdraw their funds from Fintoch. 

In addition to this, while the project claims to be owned by Morgan Stanley, the investment banking company, denied any ties with the project through a statement. The firm said that Fintoch used its trademarks without any authorization and said that they do not assume any responsibility for transactions with the company.

The Monetary Authority of Singapore (MAS) also issued an alert against Fintoch earlier in May. According to MAS, the company “may have been wrongly perceived as being licensed or in any other way authorized or regulated by MAS.”

Apart from these, reports back in March suggest that the image used for the CEO of the company, called Bobby Lambert, actually belongs to a paid actor whose real name is Mike Provenzano.

Related: $3M worth of customer funds swiped via alleged Swaprum DEX rug pull

In other news, the Federal Bureau of Investigation (FBI) has issued a warning regarding a recent surge in fraudulent crypto job advertisements. On May 23, the FBI advised United States citizens and individuals residing or traveling abroad to remain cautious, as these deceptive ads are often associated with labor trafficking.

In April, the crypto space experienced a continued surge in crypto exploits, exit scams, and flash loan attacks. According to blockchain security firm Certik, over $103 million in funds was stolen from various crypto projects and investors in the month.

Magazine: US enforcement agencies are turning up the heat on crypto-related crime

Fake crypto liquidity pools: How to spot and avoid them

$4M ‘exit scam’ suspected as Kokomo Finance flies off radar, token plunges

Kokomo Finance's social media presence and websites are offline, while the price of the KOKO token fell more than 95% within a matter of minutes.

Optimism-based lending protocol Kokomo Finance has been suspected of a $4 million “exit scam” that has seen user funds plucked out from the platform via a smart contract loophole.

Blockchain security firm CertiK alerted its followers to the “exit scam” in a March 26 Twitter post, noting that the Kokomo Finance (KOKO) token has plummeted 95% in value in a matter of minutes.

CertiK also noted that Kokomo Finance removed all social media accounts immediately following the alleged rug pull too.

Kokomo Finance has either deactivated or deleted its Twitter account. Source: Twitter

CertiK said the deployer of KOKO attacked the smart contract code of a wrapped Bitcoin token, cBTC, by resetting the reward speed and pausing the borrow function.

After that, an address beginning with “0x5a2d..” approved the new cBTC smart contract to spend over 7000 Sonne Wrapped Bitcoin (So-WBTC).

The attacker then called another command to swap the So-WBTC to the 0x5a2d address, which produced a $4 million profit, according to the security firm.

Changes to the smart contract code of the KOKO began at about 9 am UTC on March 26. Source: Optimistic Etherscan

A CertiK spokesperson told Cointelegraph that it was the largest "incident" that they’ve detected on Optimism.

Kokomo Finance is an open-source and non-custodial lending protocol on Optimism, where investors could trade for wBTC, Ether (ETH), Tether (USDT), USD Coin (USDC) and DAI.

Kokomo Finance rose up the ranks quickly in recent days, with blockchain data platforms like CoinGecko and DefiLlama officially tracking it shortly after Kokomo Finance went live on Optimism on March 25.

The price of Kokomo Finance token, KOKO fell over 97% at about 4:10pm UTC time on March 26. Source: CoinGecko

Recent screenshots reveal that more than $2 million was locked into Kokomo Finance prior to it falling more than 97%.

Over 72% of the total value locked in the Kokomo Finance protocol came in the form of wrapped Bitcoin, according to data from DefiLlama.

Cointelegraph attempted to access all social media and blog websites listed on Kokomo Finance’s Linktree page, however, all of these links now lead to some form of an error page, suggesting the page has been removed.

Related: 7 DeFi protocol hacks in Feb see $21 million in funds stolen: DefiLlama

Cointelegraph came across Kokomo Finance’s smart contract audit, which was reviewed and shared by 0xGuard earlier in March.

While most aspects of the audit were passed, “typographical errors” were found and the owner of the KOKO token was found to have a one-time ability to 45% of the maximum supply to an arbitrary address.

Kokomo did not pass all aspects of its smart contract audit, which was reviewed by 0xGuard in March. Source: GitHub

Cointelegraph reached out to 0xGuard for comment but did not receive an immediate response.

Magazine: Should crypto projects ever negotiate with hackers? Probably

Fake crypto liquidity pools: How to spot and avoid them

Defrost Finance breaks silence on ‘exit scam’ accusations, denies rug pull

Defrost Finance had not publicly commented on the rug-pull accusations in the media until now.

Defrost Finance, the decentralized trading platform that suffered a $12 million exploit in the days leading up to Christmas, has denied allegations that it had “rugged” its users as part of an elaborate “exit scam.”

On Dec. 23, the platform announced it suffered a flash loan attack, leading to the draining of user funds from its v2 protocol. One day later, another incident saw a hacker steal the admin key for a second “much larger” attack on the v1 protocol.

It’s understood the attacker or attackers conducted the flash loan attack by adding a fake collateral token and a malicious price oracle to liquidate users.

Observers, including blockchain security firms Peckshield and CertiK, as well as asset management platform DeFiYield, have suggested based on “community intel” that members of the team may have been behind the “exit scam” — given the fact that an admin key was required to perpetrate the exploit.

However, in an exclusive statement to Cointelegraph on Dec. 28, the team behind Defrost Finance broke its silence on the accusations, stating:

“We deny the accusations that the team rugged users. A compromised key does not equate to a rugpull, as much as the episode may raise doubts among the public.”

Defrost made two key arguments to deny its involvement.

Firstly, Defrost argued that if they had planned to orchestrate a rug pull, they would’ve done it months ago when its total value locked (TVL) neared $200 million.

According to DefiLlama, Defrost Finance’s TVL had fallen to just $13.14 million on Dec. 23, the day of the first attack.

“Anyone behind a rugpull would have probably defrauded investors when our TVL was 15 times what it is today.”

Secondly, Defrost argued that if they had been the perpetrators they would have “fled” long ago, which they haven’t done.

“[Anyone] anticipating the inevitable attention from the crypto community would have fled long ago. Yet here we are, working to get the funds back to their rightful owners,” it said.

Defrost Finance’s statement came just hours after decentralized finance investment platform DeFiYield in a Medium blog post on Dec. 27 again accused Defrost Finance of “rug pulling” its users.

DeFiYield pointed to on-chain data that it claimed suggested the creator of the multisig wallet was the same address that requested and then later approved the transactions that inserted the malicious source oracle that liquidated users.

It also alleged the developers behind Defrost Finance were the same as those of Phoenix Finance (FinNexus) which was exploited for $7.6 million in May 2021 in what some have also speculated was an “inside job.”

Related: Here's how Defrost Finance plans to refund users following $12M hack

Defrost said it regrets being unable to share more details about the attack, as its priority has been helping users retrieve their funds.

"There are several issues that we would like to address in recent reports concerning Defrost Finance. We regret we cannot get deep enough into some details — but surely the community will understand this is a sensitive matter and our priority must be to help our users retrieve their funds. All other concerns are secondary to this,” it said.

The team is certainly unhappy about the allegations and earlier on Dec. 28 warned members of its Telegram group that it will ban members that attempt to perpetrate the “false narrative” that the Defrost team is responsible for the recent attacks.

“At this point, it’s not conducive to moving forward to continue allow [sic] the public chats to operate like the Wild Wild West. Will be implementing stricter protocols.”

A post on Defrost Finance's Telegram group by a core team member. Source: Telegram

On Dec. 26, Defrost announced on Twitter it had managed to recover all the funds taken in the v1 hack, sharing in a post on Medium hours later that it has begun the process of returning funds to affected users.

The Ethereum wallet controlled by Defrost that is being used to facilitate the return of funds currently shows that $2.9 million of Ether (ETH) has been returned, along with $9.9 million worth of Dai (DAI).

“This will take a little time since we need to map who had what and where, but the wheels are turning fast and the entire process will be managed through smart contracts. It will be fully transparent and fairly swift,” Defrost told Cointelegraph in its recent statement.

No word was given about the v2 protocol as of yet, however.

Fake crypto liquidity pools: How to spot and avoid them

Albanian Court Approves Extradition of Crypto Exchange Thodex Founder to Turkey

Albanian Court Approves Extradition of Crypto Exchange Thodex Founder to TurkeyA court in Albania has ordered the extradition of the fugitive founder of cryptocurrency exchange Thodex to Turkey, where he is sought for fraud and other crimes. Faruk Ozer was arrested in Albania this summer, after disappearing last year as the coin trading platform collapsed. Albanian Judiciary Prepares to Hand Over Alleged Crypto Fraudster and […]

Fake crypto liquidity pools: How to spot and avoid them

Crypto scammers are using black market identities to avoid detection: CertiK

The blockchain security firm has uncovered a new tactic used by crypto scammers as the industry continues to improve its fraud detection capabilities.

Crypto scammers have been accessing a “cheap and easy” black market of individuals willing to put their name and face on fraudulent projects — all for the low price of $8, blockchain security firm CertiK has uncovered. 

These individuals, described by CertiK as “Professional KYC actors” would, in some cases, voluntarily become the verified face of a crypto project, gaining trust in the crypto community prior to an “insider hack or exit scam.”

Other uses of these KYC actors include using their identities to open up bank or exchange accounts on behalf of the bad actors.

According to a Nov. 17 blog post, CertiK analysts were able to find over 20 underground marketplaces hosted on Telegram, Discord, mobile apps, and gig websites to recruit KYC actors for as low as $8 for simple “gigs” like passing the KYC requirements “to open a bank or exchange account from a developing country.”

Pricier jobs involve the KYC actor putting their face and name on a fraudulent project. CertiK noted that most actors are seemingly exploited as they are based in developing countries “with an above-average concentration in South-East Asia” and paid around $20 or $30 per role.

Meanwhile, more complex requirements or verification processes could fetch an even higher asking price, particularly if the KYC actors are residents of countries considered a low money laundering risk.

Some roles paid up to $500 a week if an actor was to play the role of CEO for a malicious project but the KYC actor market was “marginal” compared to the market for already KYCed bank and crypto exchange accounts according to CertiK.

Crypto to fiat — or vice-versa — conversions were also cited as a significant percentage of the transactions seen on these marketplaces with CertiK calculating that more than 500,000 members in marketplace sizes ranging from 4,000 to 300,000 were buyers and sellers on these black markets.

Related: Scary stats: $3B stolen in 2022 as of ‘Hacktober,’ doubling 2021

CertiK warned that over 40 websites claiming to vet crypto projects and offer “KYC badges” are “worthless” as the services are “too superficial to detect fraud or simply too amateur to detect insider threats.”

They added the teams behind these websites are “missing the needed “investigation methodology, training, and experience” meaning these badges are then leveraged by scammers to mislead the community and investors.

That being said, the industry has been working hard and is gaining ground in its fight against crypto scammers. A tool released in October by traditional finance giant Mastercard combines artificial intelligence and blockchain data to help find and prevent fraud.

Contrary to popular belief, the open nature of blockchain transactions means it’s harder for fraudsters to hide the movement of funds. Another recent example has been the work of French authorities using on-chain analysis to find and charge five people who stole nonfungible tokens (NFT) through a phishing scam.

Fake crypto liquidity pools: How to spot and avoid them