scammer

DyorSwap officially announced that the so-called "GIWA Mainnet" identified by the team earlier is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

DyorSwap officially announced that the so-called "GIWA mainnet" previously identified by the team is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

According to Qilu Evening News, a new type of virtual currency "staking mining" scam has recently emerged. Scammers create a perfect persona through long-term friendships on social platforms, chatting with victims for one to two months to build trust. They then guide victims to switch to overseas private communication software such as WhatsApp and Discord, inducing them to download fake mining platforms and sign contracts for authorization. Using the asset transfer permissions from the contracts, they quietly transfer funds from the victims' accounts in the background.The scammers never mention sensitive words like "investment" or "financial management," packaging the scam as "idle computing power staking mining," claiming zero risk and stable returns, and using small rebates to entice victims to increase their investments. Currently, most victims are young people with side job needs, with known losses exceeding 3 million yuan, and the highest individual loss exceeding 300,000 yuan. Victims are spread across many regions of the country. Lawyers remind that virtual currency transactions are not protected by law, and any strangers on social platforms inducing a switch to overseas software or requesting wallet authorization for unfamiliar contracts should be regarded as scams. Do not make secondary transfers.

On-chain detective ZachXBT posted that U.S. threat actor Tiffany Milanovich participated in the theft of approximately $5 million in crypto assets by impersonating hardware wallet and centralized exchange customer service.Her methods included disguising as Bitcoin IRA email support, during one attack transferring about $1.2 million in BTC and ETH from the victim's Trezor wallet, and in another case stealing about $500,000 in BTC from a Coinbase account. Tiffany induced victims to hand over access to their funds under the guise of "customer service calls," later boasting about the stolen money on social media and Telegram groups, mocking victims with recordings, and collaborating with other threat actors to launder money using phishing panels and instant exchange services, with some of the stolen funds still dormant on-chain.The threat actor codenamed "Tiffany" is suspected of participating in multiple crypto asset thefts, gambling the stolen funds at crypto casinos. The platform Shuffle has frozen related accounts based on evidence submitted by ZachXBT; Tiffany previously shared a search and seizure warrant from Connecticut, dated before some of the incidents involved.ZachXBT has obtained chat logs, recordings, and on-chain evidence, anticipating that this individual may face further legal consequences. This threat actor is also linked to the John Daghita (Lick) case, who is suspected of stealing over $46 million in crypto assets from a U.S. government-seized wallet.

According to Bloomberg, the Internal Revenue Service (IRS) has warned cryptocurrency holders that scammers are contacting some taxpayers by mailing fake letters in an attempt to steal their digital assets or personal data. The IRS stated that these letters may ask taxpayers to register for a so-called "Digital Asset Compliance Portal," which does not exist. The IRS also reminds users not to scan suspicious QR codes and not to answer or cooperate with calls requesting payment.While phishing and digital scams are not new in the cryptocurrency industry, sending fake IRS notices through physical mail seems to be a new scam tactic. Since the IRS has indeed sent letters related to digital assets to taxpayers in the past, and last year saw a surge in cryptocurrency tax filing notifications, many taxpayers are confused, which may lead scammers to exploit this familiarity for disguise. As the U.S. tax system requires taxpayers to disclose cryptocurrency activities on their tax returns, communication between the IRS and cryptocurrency holders has become more common. This also makes counterfeit tax notices more misleading. For cryptocurrency users, encountering "IRS letters" involving portal registration, QR code scanning, wallet connections, or payment requests should be treated with caution, and verification should be done through official channels.

CZ posted on platform X that anyone claiming to be able to help projects get listed on Binance can be considered a scammer, especially those who claim to know CZ or have a close relationship with him.He stated that in 99.999% of cases, he does not know these people, and if he does know them, he will blacklist them. He reminded users to pay attention to safety.

According to market news, the domain name of the Bitcoin wallet Samourai Wallet, which was once famous for its privacy features, has now been taken over by scammers after being seized by the FBI, and is being used to host phishing sites to steal Bitcoin.Domain records show that the website was registered through a privacy protection service, and the current owner's identity is unknown. Multiple users on the X platform have reported the phishing site to the domain registrar NameCheap, requesting the site be shut down, but have not yet received a response.

According to an announcement from the U.S. Attorney's Office for the Central District of California, former Los Angeles County Sheriff's Department Deputy Michael David Coberg was sentenced to 63 months in federal prison and ordered to pay $127,000 in restitution for assisting cryptocurrency scammer Adam Iza in extortion and false arrest.Coberg served as Iza's business partner and advisor, earning a salary of at least $20,000 per month. In October 2021, Coberg participated in bringing a victim to Iza's residence, where Iza threatened the victim with a gun, and Coberg interrogated the victim in his capacity as an on-duty law enforcement officer, forcing the victim to transfer $127,000 to Iza's account. In September 2021, Coberg conspired with Iza and others to lure another victim from Miami to Los Angeles, arresting him through a fabricated traffic stop and illegal drug possession charges.Coberg pleaded guilty in September 2025 to conspiracy to commit extortion and conspiracy to violate civil rights. Iza has been in federal custody since September 2024, has pleaded guilty to federal charges, and is awaiting sentencing.

Binance founder CZ revealed that he discovered users on the social media platform X using AI-generated images to impersonate supporters who are closely associated with him.CZ pointed out that the account has 863,000 followers, used a photo from a BNB Chain event in Korea that he attended as a banner, and posted several AI-generated photos of him with CZ. By analyzing the details of the photos, such as the fact that he never wears blue or purple clothing, and the inconsistent resolution of the characters in the images, CZ identified these as forged images. The original photo was actually a picture with Aster CEO Leonard.CZ reminded the community to be vigilant against such potential scams, while also stating that the Binance team welcomes sincere constructive feedback.

Wintermute CEO Evgeny Gaevoy posted on social media that some builders and KOLs who claim to "exit the crypto industry" before the age of 30 have not truly engaged deeply in industry development, and their statements are misleading. Gaevoy pointed out that this group of people is often not long-term investors but chose to leave at an early stage, so it does not constitute a genuine "exit." He believes that describing brief participation as "exiting the industry" is essentially about gaining industry experience and reputation that do not belong to them, which is unfair to long-term practitioners. Gaevoy emphasized that the development of the crypto industry relies on continuous investment and construction, and leaving after a short-term attempt should not be packaged as a symbolically significant personal choice.

According to SlowMist monitoring, the scammers who obtained 50 million USDT through a "transfer record poisoning attack" began to transfer the funds within 30 minutes after receiving them.The scammer first exchanged 50 million USDT for DAI via MetaMask Swap, then converted all DAI into 16,690 ETH, and finally deposited all the funds into the mixing service Tornado Cash. Previously, it was reported that a user suffered a loss of approximately 50 million dollars due to a "transfer record poisoning attack."

ChainCatcher message, CoinMarketCap has issued a warning on social media that scammers are impersonating its customer service personnel to contact users, attempting to steal private keys or recovery phrases. The platform emphasizes that CMC does not have a phone number and will never proactively call users.

ChainCatcher news, according to Cointelegraph, North Wales police are investigating a major cryptocurrency theft case. A scammer impersonated a senior UK police officer and successfully stole Bitcoin worth £2.1 million (approximately $2.8 million).The police stated that this is a "highly targeted and sophisticated scam," and the scammer may have obtained the victim's information through a data breach. The scammer claimed to have arrested a suspect in possession of the victim's identification, creating panic and urgency to lure the victim into logging into a cold wallet through a link provided by them. Believing they were following police instructions, the victim entered their mnemonic phrase on a carefully forged website, resulting in the theft of their funds.

ChainCatcher news, according to a report by Coindesk, based on a report from the security agency SentinelLABS, scammers are using AI-generated YouTube videos to promote malicious smart contracts disguised as MEV trading bots, having stolen over $1 million in cryptocurrency funds.In the most successful case, the address 0x8725 ...6831 stole 244.9 ETH (approximately $902,000) through an associated video (with 387,000 views). The scam tactics include: using AI-generated avatars/voices, manipulating the comment section, and employing techniques like XOR obfuscation in the contract code to hide the attackers' wallets. SentinelLABS warns users never to deploy "free bots" promoted on social media, emphasizing the need to review smart contract code, even on test networks.

ChainCatcher news, according to Protos, scammers are using AI tools to steal cryptocurrency through deepfakes and wallet drainers. Decentralized finance (DeFi) developer Joey Santoro stated that a friend of his recently lost $2 million in a complex deepfake scam.The scammers used an audio deepfake of stablecoin blockchain founder Paul Faecks to pitch a consulting position to Santoro's friend and lured the victim into opening a file during the call, thereby obtaining their password and private keys. Santoro warned users to isolate their cryptocurrency from everyday devices whenever possible.

ChainCatcher news, according to Decrypt, the U.S. Department of Justice announced on Wednesday that a Nigerian fraudster successfully scammed a donor out of $250,000 in cryptocurrency by impersonating Steve Witkoff, co-chair of the Trump-Vance inauguration committee.It is reported that the fraudster sent an email on December 24, 2024, using a clever domain spoofing technique—replacing the lowercase letter "i" in the official email "@t47inaugural.com" with a visually similar lowercase letter "l," resulting in "@t47lnaugural.com." The victim was deceived and transferred 250,300 Ethereum-based USDT stablecoins to a cryptocurrency wallet controlled by the fraudster on December 26.The FBI successfully recovered 40,300 USDT through blockchain transaction tracking, with the assistance of Tether, and these funds are currently undergoing civil forfeiture proceedings to compensate the victim. Experts warn that as the political sphere becomes more accepting of cryptocurrency, such scams targeting crypto donations may increase, and AI and deepfake technology will further amplify the scale and complexity of fraudulent activities.

ChainCatcher news, according to on-chain detective ZachXBT, New York social engineering scammer Christian Nieves (alias Daytwo/PawsOnHips) set up a small call center impersonating Coinbase customer service, guiding users to create Coinbase wallets containing controlled seeds on phishing websites, and has stolen over $4 million from users.His accomplice Paranoia (Justin) previously defrauded an elderly victim of $240,000 in November 2024, with part of the funds flowing into the Roobet platform and the rest converted to XMR. He publicly disclosed the Roobet account "pawsonhips" and leaked wallet addresses during a Discord call, showing that they are frequently used for online gambling.

ChainCatcher news, according to News On 6, a new law in Oklahoma, USA, aims to prevent scammers from using cryptocurrency ATMs to steal funds, particularly from the elderly. The law will take effect in November, limiting first-time users to a withdrawal cap of $2,000 within 72 hours, requiring ATMs to be licensed and tracked, and allowing scam victims to seek refunds within 14 days of reporting.Lawmakers and the AARP Oklahoma chapter stated that this law is a step towards protecting local residents from the increasingly rampant digital fraud.

ChainCatcher message, Jupiter co-founder meow tweeted, "The three major 'mosquitoes' in the crypto space are spammers, scammers, and sybil actors."

ChainCatcher news, according to Cryptoslate, Polygon co-founder Sandeep Nailwal recently revealed that scammers are using AI technology to forge videos of his likeness to defraud startups in the crypto industry.The scammers first hacked the Telegram account of Polygon Ventures head Shreyansh Singh, and then contacted startups within the ecosystem, luring victims into Zoom meetings under the pretense of investment discussions. During the meetings, the scammers used AI-generated images of Nailwal, Singh, and fictitious team members (without audio interaction) to deceive attendees into installing malicious software development kits.Nailwal stated that several entrepreneurs have reached out to him to verify the authenticity of the meetings. Nailwal advised community members not to install unfamiliar software during unsolicited interactions, and he emphasized the importance of operational protocols, urging crypto users to separate wallet signing activities from everyday device usage.