Don’t Fall for these Scams, Top Tips, Tricks & Insights to Keep You Safe & Secure in Web3 — Crypto Security Truths: Issue 18

Weekly Review of Top Cybersecurity Incidents, Topics, Tools and Issues in Web3, Crypto, and Blockchain Ecosystems

We have been capturing as much as we run across every week to find you clear examples of what not to do in the Cryptoverse in terms of risk, safety and security. We have captured a long list of topics this week in the following headings, every category is represented this week, a real first for us: Hacks, Ransomware, Malware, Phishing, Scammers, Gaming, Crime, On-Chain, News, Policy, Tools, Researcher, so buckle up and learn how to protect yourself better in Crypto.

Our top thought leaders capture their own perspetive for each category as an Analyst Notes.

25 Oct 24–1 Nov 24

Don’t forget you can vote up to 50-times a day for your favorite articles. We accept more than 1-vote.

Introduction

In a week marked by high-stakes security breaches and explosive revelations, the crypto landscape continues to reveal its vulnerabilities and hidden connections. As investigations uncover an alleged network of over 50 cryptocurrency wallets tied to YouTube megastar MrBeast and claims of $23 million in questionable profits, the digital asset space finds itself confronting uncomfortable truths. From the Keystone Wallet hack to Binance’s controversial listing fees demanding up to 15% of projects’ token supply, this week demonstrates that beneath crypto’s innovative surface lies a complex web of security challenges, influential players, and previously unseen relationships that may reshape public perception of some of social media’s biggest names.

Hacked

Keystone Wallet Hack Alert

On October 29, 2024, Twitter user @Nourekx alerted followers to a potential hack of their Keystone Wallet account, advising people not to click on any associated links. The hack was later confirmed, sparking concerns about security for Keystone Wallet users. This incident serves as a reminder of the importance of vigilance when it comes to suspicious activity in crypto-related accounts, especially on platforms where hacking incidents can lead to substantial losses. [ Nourekx on X ]

Misconfigured Oracle Hack in Morpho Lending Market

A lending market created on the Morpho protocol was hacked due to an incorrectly integrated oracle, resulting in a $250,000 loss. While there’s debate about whether this should be categorized as a “Morpho hack,” many believe responsibility lies with the market creator rather than the Morpho protocol itself. This incident underscores the risks associated with open protocols, where users can create multiple markets that may inadvertently expose vulnerabilities. [ 0xngmi on X ]

Lottie Player Supply Chain Attack and Swift Mitigation

Earlier today, Lottie Player was hit by a supply chain attack affecting notable projects like 1inch and Movement. Luckily, our system detected the attack and automatically blocked the affected domains, ensuring user safety. This swift response by Scam Sniffer illustrates the critical role of proactive monitoring in thwarting attacks before they reach users. Keeping an eye on domain and software integrity can make the difference between prevention and significant loss. [ Real Scam Sniffer on X ]

Analyst Takeaway: The Keystone Wallet incident highlights a critical vulnerability in personal crypto security, underscoring the need for users to be vigilant about account integrity and the potential repercussions of misconfigured systems. This event serves as a potent reminder that even established protocols can fall prey to exploitation, and users must exercise caution with unfamiliar links or suspicious activity.

Ransomware

Binance’s High Token Listing Fees Under Scrutiny

Investor Simon @sjdedic revealed that a prominent project was asked by Binance to provide 15% of its token supply for a listing, a fee that could reach $50–$100 million. This high cost for centralized exchange listings has led many in the crypto community to question Binance’s practices and consider decentralized exchanges (DEXs) as an alternative. Critics argue that such steep fees not only deter genuine projects but also contribute to price volatility and distrust, pushing the market toward more transparent, permissionless platforms. [ sjdedic on X ]

Analyst Takeaway: The high token listing fees imposed by Binance signal a troubling trend within centralized exchanges that could stifle innovation and push legitimate projects toward decentralized alternatives. As the community scrutinizes these practices, it becomes increasingly vital for investors and developers alike to understand the financial dynamics shaping our crypto landscape, emphasizing transparency and accountability.

Malware

Is Grass Malware or Spyware? Their Token launch & Airdop bring more questions!

A recent token launch became notorious after the project distributed spyware to users, giving away 10% of the supply through airdrops, and then quickly inflating to a $800 million fully diluted valuation with minimal liquidity. This scam attracted widespread criticism on Twitter, with many community members pointing out the red flags, such as browser security warnings and suspiciously low liquidity, as a cautionary tale about the perils of participating in certain high-risk airdrops. [ whodoneit21 on X ]

Analyst Takeaway: The Grass project’s distribution of spyware during its token launch epitomizes the dangers of hasty participation in high-risk airdrops. Users must cultivate a critical eye toward seemingly attractive offers, as this incident illustrates how quickly ambition can devolve into exploitation, marking a cautionary tale in the ongoing battle against malicious tactics in the crypto space.

Phishing

Phishing Incident Linked to Supply Chain Attack

A victim lost 10 BTC (about $723,436) by unknowingly signing a phishing transaction. This incident is likely tied to today’s supply chain attack on Lottie Player. This attack demonstrates the immense financial and security risks associated with vulnerabilities in widely used software tools. This case is a stark reminder to scrutinize every transaction prompt, especially in the wake of recent breaches. Supply chain attacks can have a ripple effect, impacting not just developers but unsuspecting end users too. [ Real Scam Sniffer on X ]

Navigating Scam NFTs — Expert Advice from NFT_Dreww

NFT_Dreww.eth recently shared advice on managing scam NFTs, urging users to avoid “free money” temptations. To stay safe, users should hide suspicious NFTs, especi ally on trusted platforms like Magic Eden, which provides easy options for removal. If a hide function fails, report it immediately to the platform. Education is paramount for staying safe in the Web3 space. The advice underscores the importance of approaching “too good to be true” offers with caution and reinforces the need for accessible security education. [ nft_dreww on X ]

Analyst Takeaway: The phishing incident tied to the Lottie Player supply chain attack reveals the far-reaching impacts of software vulnerabilities on end-users. This scenario emphasizes the importance of thorough scrutiny before signing transactions and demonstrates how interconnected systems can amplify risks, reminding users to remain vigilant in the face of sophisticated phishing attempts.

Scammers

MrBeast’s Crypto Network and Questionable Profit Gains

An investigation reveals that MrBeast, one of the world’s most popular YouTubers, may have leveraged his massive following and a network of over 50 cryptocurrency wallets to promote, profit from, and later “dump” various crypto projects and NFTs. In collaborations with other well-known influencers like KSI and LazarBeam, as well as partnerships with high-profile crypto projects, MrBeast is alleged to have earned over $23 million. Wallet tracing and analysis of token allocation patterns suggest repeated instances of insider trading, misleading promotional tactics, and potentially unethical profit-taking practices. Below is a comprehensive breakdown of these alleged activities.

First a shout out to the researchers themselves:

Here is a list of all the Crypto Projects they did analysis on:

1. SuperVerse (formerly SuperFarm)

2. Ethernity Chain (ERN)

3. AIOZ

4. Refinable (FINE)

5. SHOPX

6. XCAD

7. Jigstack (STAK)

8. Polychain Monsters (PMON)

9. Boson Protocol (BOSON)

10. Standard Protocol (STND)

11. Ally Direct (DRCT)

12. Ternoa (CAPS)

13. METIS L2 (METIS)

14. PlayMetaGods (MGOD)

15. MetaWars (WARS)

Here is our summary of the great analysis these four did:

Hunter — On-chain Sleuth

angelfacepeanut — Web2 Research Specialist

SomaXBT — On-chain Sleuth

Parson — Researcher

But this has kicked off more analysis by others showing linkage to many other aspects. We fully expect this treasure trove to keep paying dividends to researchers for some time. There are more folks implicated, that could be analyized that would help this space understand what has been happening. Maybe even front run these folks before the next wave enters the market would be great. Some of this additional analysis you will see below in different threads. [ KasperLoock, somaxbt, Cointelegraph, lookonchain on X and Loock.io Blog ]

LUCE Coin — From $130 Profit to Millions Lost

The Vatican’s new mascot “Luce” inspired the creation of a LUCE coin, which its developer held for just 17 seconds, pocketing $130. The coin’s value then skyrocketed, and the developer missed out on what would now be $5.5 million. The volatile nature of the crypto market is well illustrated here — decisions made in seconds can result in massive profit or colossal regret. It’s a reminder for traders: sometimes, holding pays. [ ArkamIntel on X ]

Ronaldinho and the MCDULL Token Scandal

Influencer Ronaldinho promoted $MCDULL, a token allegedly sniped by insiders, only to delete his endorsement after backlash. This incident has reignited debates over influencer responsibility and accountability in crypto. As calls grow louder for influencer accountability, the crypto community is reminded that high-profile endorsements don’t guarantee legitimacy. Due diligence is essential — even when celebrities are involved. [ Bubblemaps on X ]

Market Sentiment and Shorting Airdrops

Crypto analyst Wazz commented on the current market trend, noting that shorting recent airdrops or longing meme coins has become an almost surefire profit strategy. This trend, he suggests, reflects the appetite for “exit liquidity.” Wazz’s observation hints at the speculative frenzy in the market, where strategic shorting and longing align with broader sentiment. It’s a reminder that, in this climate, liquidity matters — and being the “exit” isn’t always profitable. [ WazzCrypto on X ]

Red Flags for Spotting NFT Scams on Social Media

In the NFT world, scammers employ subtle tactics to gain users’ trust and exploit social media connections, making detection essential. One telltale sign is when an account takes over an older profile, often predating 2015, and erases previous posts to blend in by retweeting NFT or BAYC-related content. Even official-looking features, like a verified badge, notable followers, or NFT credentials, don’t guarantee authenticity. Tools like BotSentinel or Alphagate_io can help track suspicious account changes, such as username and bio updates, and watching for these signs can protect users from deceptive overtures by fake profiles. [ nft_dreww on X ]

Analyst Takeaway: The findings around MrBeast’s alleged crypto activities raise significant ethical concerns regarding influencer responsibility in the crypto space. As the lines between promotion and deception blur, it is essential for the community to demand greater transparency from those wielding significant influence over market trends, reinforcing the need for due diligence when engaging with high-profile endorsements.

Gaming

The Disconnect Between Game Developers and Content Creators

In the emerging web3 gaming space, collaboration between game developers and content creators is often fraught with misunderstandings. Many game teams lack experience in fostering mutually beneficial relationships with creators, seeing blockchains as pseudo-publishers rather than true partners. This gap can limit exposure and hamper marketing effectiveness, as seen in the Solana Gaming Ambassador Program’s attempts to bridge this divide. When gaming chains strengthen their support for creators, integrating marketing across web2 and web3, they could unlock powerful synergies to drive both game visibility and community growth. [ WrecksGG & Attis_gaming on X ]

Analyst Takeaway: The disconnect between game developers and content creators in the web3 gaming sector underscores a significant gap in collaborative marketing strategies. As blockchain gaming continues to evolve, fostering genuine partnerships will be crucial to driving visibility and community engagement, necessitating a shift in how developers approach relationships with creators.

Crime

Safety Reminder from a Harrowing Experience of Drink-Spiking

In a disturbing incident, Hana, a newcomer in the crypto industry, encountered a partner from DWFLabs who spiked her drink during a business meeting in Hong Kong. Fortunately, a vigilant waitress warned her, preventing potential harm. Hana’s story underscores the ongoing issue of safety for women in professional environments and serves as a powerful reminder: trust instincts, be cautious with drinks, and recognize that professional settings are not immune to predatory behavior. Her courage in speaking out aims to protect others and encourages victims to reach out if they have faced similar situations. [ hannanotsorry & Truth Labs on X ]

Analyst Takeaway: Hana’s disturbing experience with drink-spiking in a professional setting brings to light the pressing issue of personal safety within the crypto industry. It’s a stark reminder that the digital world’s risks extend beyond screens, underscoring the need for vigilance and awareness in both online and offline interactions, particularly for vulnerable individuals.

On-Chain

FTX Drainer Wallet Allegedly Linked to MrBeast Wallet

A recent crypto controversy unfolded as sleuths claimed that a wallet associated with MrBeast had links to the infamous FTX Drainer wallet. This revelation, hinted at by blockchain experts, suggests that MrBeast’s wallet shares transaction history with the wallet tied to FTX’s downfall and even Celsius. The implications have fueled community speculation, raising questions about possible fund recovery efforts and potential legal actions. While no official response has emerged, this connection illustrates the intricacies of blockchain transparency and the unexpected entanglements that can arise in the crypto world. [ Truth Labs on X ]

Crypto Cartel and the Alleged Involvement of Influencers

A new exposé by TruthLabs alleges ties between high-profile influencers like MrBeast, Erik Voorhees, and Gary Vee within a purported “Crypto Cartel,” linking them to the controversial profits made from NFTs, with Gary Vee reportedly defrauding investors for over $200M through VeeFriends. This explosive claim frames these figures within a network compared to infamous names like Epstein, hinting at years of behind-the-scenes research by TruthLabs soon to be unveiled. [ Truth Labs on X ]

MrBeast’s Alleged On-Chain Connections with Elon Musk and FTX

TruthLabs speculates on MrBeast’s involvement in crypto fraud, referencing his connection with Elon Musk and Twitter’s management discussions during the 2022 FTX collapse. TruthLabs hints at finding on-chain connections linking Elon to “dirty money laundering” in crypto and ties to foreign adversaries through SpaceX, suggesting further revelations are imminent about these potentially deep-rooted financial entanglements. [ Truth Labs on X ]

NFT Sales and Allegations of Racist Content

TruthLabs reports MrBeast, under the alias WuTangClan on OpenSea, launched Series 4 Fake Rare Pepe NFTs in collaboration with Ghostface Killah. The proceeds were partially directed towards purchasing oDOGE, reportedly linked to a developer with racist pseudonyms. With MrBeast previously suggested as Elon Musk’s potential successor on X, TruthLabs calls for followers to bring attention to this behavior as the details emerge. [ Truth Labs on X ]

Analyst Takeaway: The emerging links between MrBeast’s wallet and the notorious FTX Drainer wallet highlight the inherent complexities and potential pitfalls within blockchain transparency. As scrutiny increases, the community must grapple with the implications of these connections, which could not only reshape reputations but also ignite further investigations into potential illicit activities.

News

Cyber Strategy’s Insight on Cybersecurity

Cyber Strategy shares an insight into cybersecurity architecture, stressing that true cyber peace is achieved not only through vigilance but through intelligent design. The post encourages followers to engage with Cyber Strategy for ongoing cybersecurity insights and truths in a rapidly evolving digital landscape. [ CyberStrategy1 on X ]

Controlled AI and Citizen Journalism

TruthLabs alleges that AI accounts, backed by government and corporate interests, manipulate the reach of citizen journalism on X, mirroring the control seen in mainstream media. This assertion paints a picture of a social platform more dynamic yet equally, if not more, controlling of public narrative — a stark warning to advocates of independent information. [ Truth Labs on X ]

Informant Allegations Against Ricky Heart

TruthLabs claims that an individual known as Ricky has acted as an FBI informant, tied to FBI-affiliated wallets, and hints at attempts by informants to intimidate those investigating him. Citing past threats made against whistleblowers like themselves, TruthLabs warns of a broader pattern of silencing individuals who expose government-linked proxies allegedly abusing citizens’ rights. [ Truth Labs on X ]

Tribute to Nikolai Mushegian and His Vision — 1 Year Anniversy of Maker Dao Founders Death

TruthLabs commemorates the one-year anniversary of Nikolai Mushegian’s death, describing him as a visionary who sought to develop anti-corruption, fraud-resistant technologies. Mushegian, a MakerDAO co-founder, reportedly engaged in deeper efforts to protect against the abuses of power before his untimely death, remembered here as a figure committed to liberating the 99% through decentralized innovation. [ Truth Labs on X ]

Coverups and Allegations Against Zach Testa and Others

TruthLabs questions the purported backgrounds of Zach Testa @degenharambe on X as being the creator of Pepe, and Gary Wang, alleging coverups of involvement with controversial domains. Addressing potential backlash, TruthLabs provides a 24-hour window for objections with evidence, reaffirming their stance of exposing hidden truths rather than chasing clicks, underscoring a mission to purge corrupt influences from American society. [ Truth Labs on X ]

Analyst Takeaway: Cyber Strategy’s perspective on cybersecurity architecture serves as a call to action for organizations to prioritize intelligent design alongside vigilance. As the cyber landscape becomes increasingly complex, a proactive approach that integrates security into the foundational framework of systems will be essential to achieving true cyber resilience.

Policy

Immutable Receives SEC Wells Notice, Vows to Defend Digital Ownership

Immutable, a leading blockchain gaming platform, received a Wells notice from the SEC, signaling enforcement action shortly after their first interaction. Immutable joins companies like Coinbase, Uniswap, and OpenSea, facing SEC scrutiny under what they call a “regulation by enforcement” policy. Despite this, Immutable remains committed to defending digital ownership rights for the gaming community. They are well-capitalized to support their mission, emphasizing the critical need for transparent guidelines as they work to protect the rights of developers and players. [ ImmutableX on X ]

Crypto Business Marketing Mistakes and Scam Risks

Crypto security experts highlight how marketing errors, like failing to use a “last tweet in thread” graphic, can make legitimate announcements vulnerable to scammers. Scammers capitalize on these mistakes to create convincing replies, deceiving followers into thinking fraudulent posts are authentic. Discussions suggest solutions like using graphics or even disabling comments to prevent scams, though some argue this limits engagement. This incident serves as a caution for crypto businesses to prioritize security and community integrity in social media marketing. [ beausecurity on X ]

Analyst Takeaway: Balancing Innovation and Regulation in Blockchain Gaming Immutable’s recent SEC Wells notice serves as a stark reminder of the precarious balance between innovation and regulatory compliance in the blockchain gaming space. As a seasoned analyst with years of experience in navigating regulatory frameworks, I see this as a pivotal moment for the industry. Immutable’s determination to defend digital ownership rights is commendable, but it also highlights the urgent need for comprehensive regulatory clarity. Without transparent guidelines, developers may face significant challenges that could stifle creativity and growth. The industry must rally for clearer regulations to ensure that players and developers alike can thrive in a secure environment.

Tools

MetaMask Ranks #1 in Wallet Security

MetaMask leads in wallet security across iOS, Android, and Chrome, topping Coinspect Security’s ranking. After just three months of partnering with Wallet Guard, MetaMask has set high security standards by excelling in key areas like dApp permissions, intent verification, physical access, and threat prevention. Other ranked wallets include Rabby, Coinbase Wallet, and Rainbow. Coinspect’s evaluation encourages safe wallet usage and establishes benchmarks to guide users in making informed choices for Web3 security. [ 0xOhm_eth on X ]

Rabby Wallet Advances Multi-Chain Functionality

Rabby Wallet introduces groundbreaking multi-chain features for decentralized finance (DeFi), offering a unified portfolio across 110+ EVM chains. With seamless cross-chain dApp usage, users can switch between chains without pop-ups. Additionally, Rabby’s GasAccount allows for efficient multi-chain gas payments using stablecoins, eliminating the need to hold different gas tokens across networks. These advancements make Rabby a strong contender in the race for user-friendly and efficient Web3 wallets. [ Rabby_io on X ]

Permit Signatures in Crypto: Risks and Warnings

Crypto users are urged to exercise caution with permit signatures, a convenient but risky tool. Revoke.cash highlights how malicious actors exploit these signatures to drain funds, as users unknowingly grant “blank check” permissions. Experts advise double-checking URLs and setting spending caps to limit risks. This cautionary reminder stresses the importance of understanding security implications before using such tools to prevent devastating financial losses. [ Wii_Mee on X ]

Balancer v3 Hookathon Showcases Innovation in DeFi

Balancer’s V3 Hookathon drew impressive talent, with 45 submissions from developers showcasing their innovations for the decentralized finance (DeFi) platform. A prize pool of $17,000 attracted creative solutions aimed at enhancing Balancer’s ecosystem. The top entries have been shortlisted for final judging, with winners to be announced by the end of the week. This competition underscores Balancer’s commitment to fostering growth and innovation in DeFi. [ Balancer on X ]

Analyst Takeaway: Strengthening Web3 Wallet Security MetaMask’s top ranking in wallet security is a significant marker for the industry, reflecting a robust partnership with Wallet Guard that prioritizes user protection. As an experienced cybersecurity analyst, I believe the emphasis on dApp permissions and threat prevention is crucial for the entire ecosystem. Users must take advantage of this benchmark to make informed decisions when selecting wallets. The introduction of multi-chain functionalities by Rabby Wallet demonstrates the evolving landscape of decentralized finance (DeFi) and the need for user-friendly solutions. However, the caution around permit signatures serves as a vital reminder: while convenience in crypto transactions is alluring, users must remain vigilant against the potential for exploitation. The stakes are high, and understanding these tools is essential for mitigating risks in the rapidly changing Web3 environment.

Researcher

AVS for Enhanced Economic Security in Blockchain Voting

0xngmi suggests that an Automated Verification System (AVS) could improve economic security in blockchain voting, especially in cases where minority opinion voters are penalized. However, the risk of capital loss may deter participants. While AVS holds promise for increasing safety, the proposed slashing rule might pose challenges in attracting sufficient investment. This insight highlights the complexity of balancing security and inclusivity in decentralized voting mechanisms. [ 0xngmi on X ]

Analyst Takeaway: Navigating Security Challenges in Blockchain Voting The proposal for an Automated Verification System (AVS) in blockchain voting underscores the ongoing tension between security and user participation. From my perspective as a researcher with years of experience in decentralized systems, this initiative offers potential solutions to enhance economic security but also highlights the inherent risks involved, particularly regarding capital loss. It’s crucial to strike a balance that fosters inclusivity without compromising safety. As we continue to explore innovations like AVS, the community must critically assess the implications for broader adoption and the willingness of participants to engage in these mechanisms. Understanding these dynamics will be vital as we push for secure, decentralized voting solutions that align with community interests and investment potential.

Conclusion

This week’s events underscore a critical juncture in crypto’s maturation. The convergence of security incidents, from supply chain attacks to sophisticated phishing schemes, highlights the urgent need for robust security frameworks. Meanwhile, the scrutiny of high-profile figures like MrBeast and allegations of coordinated market manipulation point to growing demands for transparency and accountability. As platforms like MetaMask lead the charge in wallet security and Immutable faces regulatory challenges, the industry appears to be moving toward a more regulated, security-conscious future — though not without its share of growing pains.

Thanks for getting this far in our article. Don’t forget that you can vote up to 50-times a day for your favorite articles on Medium. We accept more than 1-vote, as it helps us spread the Cybersecurity insights into Crypto. The more people that see this information, the more people we can help. We should share information about criminals and scammers to help protect each other, just like we pick up stray trash and put it in the trash can.

Further Resources about Cyber Strategy Institute:

If interested in other analysis, checkout our other Medium articles, our Indpeth Analysis Articles and for more of a daily understanding of the Cryptoverse follow our Twitter account. Relying on a dying Cybersecurity model is not a foundation for success; that is what Warden changes for the good!

Warden

It is designed leveraging a Zero Trust model, stopping all known bad and unknown malicious threats. This starts by defending at the kernel level, so that any software does not know it’s been placed into a sandbox. We call this the “Inception Protection” model, which will not allow any program to impact your systems. No other system can do this on the market today. Protect your digital life, your families or your organization today with Warden!

If you want a 50% Discount on your purchase, then sign up for our newsletter, and we will send you the code for your support. Just reply to your first email saying you would like a discount.

Cyber Strategy Institute

Medium: https://cyberstrategy1.medium.com/

Twitter: https://twitter.com/CyberStrategy1

X: https://x.com/Warden_Secure

Website: https://cyberstrategyinstitute.com

Protect Yourself, Family or Business Today with Warden!

https://cyberstrategyinstitute.com/personal-protection-warden