Canadian phishing scammer busted for stealing over $1 million in crypto and NFTs

Popular on-chain spy ZachXBT has exposed yet another crypto scammer responsible for stealing millions of dollars in digital assets using sophisticated phishing attacks.

The thieves’ targets included Discord services for DeFi projects such as Orbiter Finance and the Pika Protocol.

impersonation and seizure

in a twitter thread published On Monday, ZachXBT reported that the attacker, Soup (aka Dan), carried out his scam by posing as Luke Hamilton – an employee of crypto media outlet Decrypt.

In collaboration with other scammers, Soup lured members of various crypto project teams to join fake Decrypt Discord servers. He then tricked them into submitting KYC information as part of a fake application and interview process, later executing a phishing attack in an “elaborate effort to steal their Discord tokens.”

2/ Makes the soup fake @decryptmedia Websites and poses as Luke Hamilton (a real Decrypt employee)

He works with other scammers to contact crypto projects team members to trick them into joining a fake Decrypt Discord server and in an elaborate attempt to steal their Discord tokens. pic.twitter.com/Oe6mX2zFk1

— ZachXBT (@zachxbt) 17 July 2023

A Discord token is an alphanumeric string that represents a user’s login credentials, which grant them access to any servers they own or are part of.

The scammer compromised the Pika Protocol Discord server by posting a malicious link in the announcement channel on May 30, 2023, allowing them to access it. steal $220,000 in crypto. In a private DM, Dan admitted to receiving 15% of the scammers’ profits.

The next day, the scammers attacked Orbiter Finance using a malicious link to steal another $760,000. Soup confessed to receiving 30% of the stolen funds, of which 7.5 ETH was identified in one of its known addresses,

Soup spent some of the proceeds from his crimes on exclusive five-figure Roblox items.

ZachXBT said Soup was involved in the burglary of the Mutant Ape Yacht Club (MAYC NFT #21080) last year. In collaboration with their scammer partner, Fent, the duo created a fake MAYC and offered to trade it to the victim in exchange for genuine MAYC. who is suffering Accepted,

Soup also stole Cryptopunk #6983 in January this year.

ZachXBT wrote, “Soup admits it made $1M in profit on its own while its partners made even more.” “He appears to have little remorse for his actions after financially harming projects and people.”

relation to blue

ZachXBT was able to track down an address called Soup after the scammer accidentally disclosed it when it was proven that the ENS address Purplelobster.eth was controlled by Blue – another scam exposed by ZachXBT last week. Blue sent $25 worth of ETH soup at that time.

Blue, a former YouTuber turned NFT scammer, also had ties to Monkey Drainer, who is known for stealing over $24 million in digital collectibles and bragging about his thefts online. In some of his recent phishing attacks, Blue took over $200,000 in crypto and NFTs from yancy.eth and LoveMake.eth addresses.

ZachXBT said at the time, “Disgusting to see these phishing scammers show zero remorse and spend money on tasteless items.”