How Crypto Vigilantes Are Hunting Scams In A $100 Billion Market

A ragtag team is trying to weed out fraudsters in a fast-moving corner of the crypto world that’s entirely unregulated. How Crypto Vigilantes Are Hunting Scams In A $100 Billion Market

Ron Browning, Founder

On a Monday morning in October, in a southern Indiana basement, a 52-year-old grandfather in a Dogecoin hat is patrolling the darkest corners of the crypto world for Shit Coin scammers.

Ron Browning, Founder

Robert Browning and his motley crew — named the RugSeekers for a popular pump and dump scam called the rug pull — are investigating a tip about a new coin called We Save Moon. They’re examining its source code, wallets and price charts for red flags indicating fraud.

Browning enters the coin’s group chat on Telegram, the messaging app where this world hangs out. He starts typing under his alias RobAte25 — a reference to his grandson’s birthday, 8/25 — and moves in for the kill.

Browning asks for ‘mods,’ or the moderators of the chat associated with We Save Moon. ‘Gene Cernan,’ a mod named for an American astronaut, responds. The mod’s name will change throughout the exchange to other astronauts. In typical DeFi fashion, the mod encourages the group to ‘PUMP’ the coin — buy more of We Save Moon and boost the price.

Eric Mings, another RugSeeker, also joins and asks a question about the coin’s utility. In this world, coins that serve a purpose are often considered a better and safer investment. We Save Moon responds under a different name, Alan Bean, but doesn’t answer the question. Instead, Mings is directed to the group’s pinned messages.

Eventually, the moderator tells Mings that the utility of the coin is to get rewards, but doesn’t offer specifics. Meanwhile, Browning is asking whether the developers are ‘doxxed,’ meaning they’ve publicly shared their identities. If a coin creator is willing to go public, there’s less chance that they’ll scam people.

After being ignored, Browning identifies himself as a member of RugSeekers. Mings echoes his question about the doxx status of the creators. The developers say yes, and Mings asks for proof. Browning continues to be ignored. It’s clear whoever created this coin probably won’t cooperate.

Browning, a former contractor turned full-time crypto trader, is the self-appointed sheriff for weeding out fraudsters in decentralized finance, a fast-growing global market that has topped $100 billion in value. The policing comes not from Washington, but instead from places like this home a short drive northwest of Louisville, Kentucky, past corn fields, red barns and highway billboards.

Browning sits hunched over a small desk in the over-air-conditioned room, religious scripture and sports banners adorning the wall. A Ronald Reagan paperweight next to his laptop is etched with the reminder to “Trust, but verify.”

“I can look at a contract and within two seconds tell you if it’s a scam or not,” Browning says, his voice betraying his lower Midwestern roots.

For the We Save Moon takedown, Browning is sitting beside Mings, a friend whom he lured into the crypto world. Several other people, scattered across the country, are dialed into a group call, which Browning has on speaker phone.

Mings finds the We Save Moon website, looking for more information on the creators’ identities. He shares the team page, with cartoon characters, jokingly asking whether this is what they consider their doxx.

The mod says it isn’t, adding an “LOL.” Browning identifies himself again, but it looks like the mods are not going to engage with him. The Telegram group has several messages coming in every minute, from RugSeekers and others.

The RugSeekers aren’t the only ones in the group asking questions. Individual investors are also trying to figure out whether this coin is solid. When one investor asks if “this is a legit coin,” the developers almost lash out. “What kind of question is this?”

The developers walk back that answer here, deleting the previous text, and simply attesting to the fact that it is a real coin because people get rewards.

While the team’s in the chat, they’re also coordinating on a group call. One of the RugSeekers in Ohio is purchasing a small share of the coin as a test. That’s when they notice that when an investor sells any of the tokens, about $90 from the liquidity pool is transferred into another wallet. That’s known as a skim feature, where developers will slowly put a certain portion of the liquidity into their own wallets.

These types of scams are exploding in DeFi, the wild west of the crypto market. There, anyone and everyone can mint digital tokens — some that create outrageous fortunes, and far more that flop within hours. FOMO coin culture is the perfect breeding ground for fraudsters looking to take investors’ money and run.

The past month alone has seen the rise of so-called memecoins such as Squid Game, only to have them spectacularly collapse in suspected frauds.

Once Browning identifies a coin isn’t legit, his group goes on the attack.

In a matter of days, the developers will slowly pull the money out of the coin, leaving behind investors lamenting in the Telegram group about falling for yet another scam and, in some cases, losing thousands of dollars.

The moderators of the We Save Moon chat didn’t respond to messages from Bloomberg News seeking comment.

In the first half of this year, there were $681 million in major crypto thefts, hacks and frauds, according to research from CipherTrace, a cryptocurrency intelligence firm. DeFi-related hacks made up 54% of major crypto fraud volume, compared with only 3% for all of last year.

The data showed that at $361 million, the amount netted from DeFi-related hacks through July already surpassed the $129 million stolen throughout all of 2020.

The money at stake for individuals can be paltry by Wall Street standards, with $10, $100, maybe $1,000 investments at a time. But in the world of crypto trading, filled with amateur investors making bets from their couches, these sums can have a big impact on people’s savings.

Regulators, more apt to go after big traders, just can’t keep up.

Gary Gensler, chair of the Securities and Exchange Commission, warned in August that the cryptocurrency market is “rife with fraud, scams and abuse” and that “a lot of people will be hurt” if the government doesn’t boost investor protections.

Behind the scenes, the agency’s enforcement attorneys have sent out several subpoenas and other information requests to firms asking about DeFi offerings, according to people familiar with the matter.

Still, SEC cases usually take months or even years to bring as the agency is obligated to respect defendants’ legal rights under due process laws. And with limited resources, it’s impossible for the regulator to go after every scam in real time, especially since the DeFi world moves so quickly, with cons playing out in a matter of hours.

“The SEC brings big cases to send big messages because they don’t have infinite resources and they’re really looking to change the marketplace,” said John Reed Stark, who worked as an enforcement attorney for the agency for 20 years. “The SEC can be slow and methodical and sometimes short-staffed, but sooner or later they’ll get you.”

The SEC declined to comment.

In the absence of regulators, it’s hard to know where to look for vetted information about the legitimacy of a coin. Scanners like TokenSniffer run through contracts looking for potential red flags, but those alone don’t always weed everything out.

(TokenSniffer rated We Save Moon as “medium risk.”) The most effective way of exposing crypto scammers is by calling them out in their own group chats, on their own turf, and gaging their reaction.

Marcos Araujo, a 27-year-old from northeast Brazil, says he lost about $2,000 from his investment in We Save Moon. He ended up pulling out what little he had left before the coin totally crashed, but not before pleading to the developers in the Telegram group, “I put a lot of money into this project,” he wrote. “Please do something.”

Araujo, who had invested in cryptocurrencies for about six months, had never heard of the RugSeekers and didn’t see any of the messages of concern Browning had sent — for one, because things on Telegram move so quickly, with thousands of messages coming through a day, but also because once you’re banned from a group, the messages you had sent disappear. There was no trace that Browning had ever been in the chat at all.

Browning started RugSeekers after his own crypto bet gone wrong in July. He was promoting a coin called Altex, which boasted plans for something called a “CryptoCard,” a sort of credit card for meme coin investors, and a crypto university. Disaster ensued when bots infiltrated the project, causing the developers to panic-sell their stakes and sending the coin’s value plummeting, according to Browning.

He describes the personal devastation of being a scam victim as wrecking your car, going to a funeral and breaking up with your partner all at the same time. Even worse, he had lured Mings — the father of his teenage daughter’s boyfriend — into Altex for his first crypto bet.

“I sat right here in this chair on July 11 and I was taken badly,” Browning says. “I watched an $8,200 bag turn into $86 dollars. I had that feeling in my throat where you can’t swallow, because you feel so used and so rejected. It’s the worst of everything.”

Browning says he now spends most of his waking hours looking for scams. He also still invests, dabbling in coins such as Cardano, Solana and Ethereum, and estimates he has made about $80,000 from the bets this year. He doesn’t make money off the scam-hunting work, though the RugSeekers launched a coin of their own to try to raise funds for support.

He recognizes that the RugSeekers have a tiny footprint. Two days after Browning tweeted about We Save Moon and his concerns, the post had 4,145 impressions. “It’s nothing” compared to the population of crypto investors worldwide, he says.

Still, he continues, and the RugSeekers are on to the next coin. If he can save just one more person from investing in a scam, it’ll be worth it, he says.

“There’s not many places where I can tell you someone’s going to make $20 million today or some coin is going to be up 15,000% today,” Browning says. “The fear of missing out is the biggest thing, and that’s where people make the most mistakes.”

Updated: 1-30-2022

Cyber Vigilante Hunts Down Defi Scammers Running Away With $25M Rug Pull

An exclusive interview on tracking down a group of DeFi scammers responsible for the $25 million StableMagnet rug pull.

In the world of digital finance, where the weapon of choice for a heist is a computer rather than a semi-automatic firearm, tracking down scams and frauds from across the world becomes a near-impossible feat for centralized police forces.

In the world of digital finance, where the weapon of choice for a heist is a computer rather than a semi-automatic firearm, tracking down scams and frauds from across the world becomes a near-impossible feat for centralized police forces.

However, in an interview with Cointelegraph, an anonymous cyber vigilante shares insights into how he went about tracking down a group of decentralized finance (DeFi) scammers responsible for the $25 million StableMagnet rug pull, coordinating with police authorities and eventually having the stolen money returned back to the investors.

##StableMagnet #rugpull $22m and growing. Its SwapUtils library code is NOT verified and *DIFFERENT* from main Swap contract: https://t.co/Ls5XNA5UXf. @bscscan There is a need to verify the library code!

— PeckShield Inc. (@peckshield) June 23, 2021

Right before the rug pull, the cyber vigilante (anonymous for obvious reasons) examined the code to ensure the legitimacy of the project prior to investing himself. However, what he missed out on were a number of messages on Twitter alerting him on the possible exploits and vulnerabilities in the system.

Taking things personally, the vigilante — an active ethical hacker — set out to track the scammers and bring justice to the investors. He told Cointelegraph:

“I just felt like this was the only opportunity in my life — to have a very meaningful impact in a situation where most people are not going to have the time and the gusto to do that kind of thing.”

Starting from tracking down a GitHub account to identifying all family members of the scammers through social media accounts, our vigilante’s investigation pinpointed a group of Chinese locals from Hong Kong.

Eventually, the anonymous vigilante tracked down the scammers’ travel to a Chinatown in Manchester — a temporary move until the commotion died down:

“I didn’t want them to go to jail. I don’t like the centralized forces to come into the decentralized world as much as we possibly can.”

Taking the matter into his own hands, he booked a one-way flight ticket to Manchester while contacting local police authorities citing the narrow timeline before the scammers move to a different location. To the vigilante’s surprise, the Greater Manchester Police reacted swiftly and arrested a few of the scammers.

The police retrieved different pieces of a single USB device from the scammers, which contained roughly $9 million:

“Once that occurred, it was believable to the other project people (scammers) that I wasn’t BSing about finding them and knowing where they were and being able to get them taught if”

Following the arrests, other members of StableMagnet cooperated with the cyber vigilante and returned the majority of the loot. Ever since the development, his message has been heard loud and clear, “maybe it’s not a good idea to scam, at least not on the Binance Smart Chain.”

On Jan. 23, numerous popular crypto YouTuber accounts were hacked and posted unauthorized videos with text directing viewers to send money to an unknown (hacker’s) wallet.

BREAKING: Dozens of Crypto YouTubers have had their accounts hijacked by hackers promoting a fake crypto giveaway scam. Hacked accounts include:@IvanOnTech@boxmining@aantonop@themooncarl@Bitboy_Crypto@mmcrypto@Altcoinbuzzio@FloydMayweather@crypto_banter@CoinMarketCap pic.twitter.com/ykXkZUh9cO

— Mr. Whale (@CryptoWhale) January 23, 2022

YouTuber Michael Gu told Cointelegraph that his YouTube channel Boxmining posted a video without his permission. “Luckily, we caught it within two mins of the video going live and managed to delete it,” he said.

Updated: 3-14-2022

Crypto Sleuth May Have Found Tokens of Sanctioned Russians

* Forensics Firm Elliptic Flagged Wallet To Authorities
* The Wallet Contains Millions In Cryptocurrency, Elliptic Said

Crypto forensics firm Elliptic said it has passed on to authorities information on a digital wallet that may be linked to sanctioned Russian officials and oligarchs.

The wallet has “significant crypto-asset holdings,” in the millions of dollars, Elliptic co-founder Tom Robinson said in an interview Monday.

The finding comes amid a heated debate on whether cryptocurrencies can be used to evade additional sanctions imposed on Russian oligarchs and officials since Russia’s invasion of Ukraine. With authorities confiscating the oligarchs’ yachts and overseas fiat assets, some worry they’ll turn to Bitcoin, Tether and privacy-enabling coins.

“Crypto can be used for sanctions evasion,” Robinson said. “What’s in question is on what kind of scale. It’s not proving out realistic that oligarchs can completely bypass sanctions by moving all their wealth into crypto. Crypto is highly traceable. Crypto can and will be used for sanctions evasion, but it’s not the silver bullet.”

Elliptic, whose clients include government agencies and crypto exchanges, has already identified more than 400 virtual-asset services that let their mostly anonymous users buy crypto with rubles. Last week, activity on these exchanges tripled versus the week before the war broke out in late February, Robinson said.

Elliptic also linked more than 15 million cryptocurrency addresses to criminal activity tied to Russia. It also found several hundred thousand crypto addresses linked to Russia-based sanctioned actors and their associates, Robinson said.

Crypto exchanges from Binance to Coinbase Global Inc. have said they will abide by the imposed sanctions. Both exchanges have also said they won’t stop servicing all Russian customers — which is what the Ukrainian government asked for.

“In general, the level of sanction compliance is very high,” Robinson said.