Crypto owner losses ≈ $1 million after fake job interview

[pawanjain]

Two days go by, and Alexander gets a notification on his phone that some crypto got transferred out of one of his wallets. He checked several wallets on his PC and noticed that each one had been emptied. In total, he claims that almost 150 different wallets and addresses got drained of all their coins.

I am literally shocked because this hack is indeed complex. I am wondering how come they would have got access to his wallets.
Lets assume they got access to his computer but his wallet should have been secured by a passphrase or something.
I am assuming Alex would not have stored the passphrase in a simple text file but would have encrypted it or had it password protected.
In that case, how would have those scammers hacked into his wallet ?

[Lucius]

I don't understand how it was possible to empty 150 different crypto wallets with just one click on a link? What comes to mind is that this user may have protected his wallets with a password that was very simple and identical for each wallet, but again, if we take into account that someone stores so much value in hot wallets, then it is possible that he also stored his backups on the same computer in unprotected text form.

Even if he used the simplest password, how did they find all his wallets and gained access to his computer to empty all of them? It's quite an advanced scam compared to the usual phishing schemes we see on a daily basis.

I read the article on the link posted by @lovesmayfamilis and it seems that the matter is very simple, the person really has to literally click on a link that the attacker sends in the chat in order to download the malware, which then enables the attacker to have complete control over the user's computer, something like a remote access trojan (RAT).

The target receives a phishing message explaining that there will be changes to the employee's vacation schedule and that some employees, including the victim, are impacted. The phishing message contains a download link to the supposed new schedule, which is actually a link to the DarkGate malware. If the malicious file is executed on the target machine, it will install the malware, giving the attacker complete access to the device and its data.

However, even full access to the computer means that you cannot empty all crypto wallets just like that, unless they are not protected by a password at all, or the attacker knows which wallets the user has and prompts him to open them and thus find out the password.

[Iroh]

Same question that was boiling in my mind while reading the post but glad Coyster made some enlighten explanation. The question now is whether we are to avoid joining any form of conversation through links or we should be the one to host the meeting in a case like this.

I think it's best to just have your portfolio stored away safely in another PC asides from your work PC that you regularly use for business communication. I read the full story via the Twitter link on the OP and Alex(the guy whose money was stolen) even admitted that he goofed by not keeping only the amount he intends to trade with on the computer he likely uses for work and was used to communicate with the scammers.

I think it was brave of him to speak out. I know a lot of people who are OGs in the crypto space would probably keep mum due to the embarrassment but in his own words,

If my loss prevents this from happening to even one person, then it wasn’t all for nothing.

[348Judah]

Scams are taking new dimensions each day starting from offers we receives online, the scammers now have indeed advanced to a more reliable means to get more prey for themselves, because they knew that many that would fall a victim were those already seeking for opportunities online, they don't have to wait any longer for us to be careless in other for them to take advantage, instead they set their target using a specific route like we have here providing for fake offers online.

[Satofan44]

150 wallets and all on the same device? I would not be surprised if he was advertising himself as a privacy and security expert, what an idiot.  

Not everybody listen to their own advice. Knowing the right thing is one thing but doing the right thing is another.

I would consider that advice by a fake expert. Whoever has time to suggest things that they themselves are not doing, they are a fraud who does not believe in the things that they are preaching. It is very similar to many signature campaign participants here.

However, even full access to the computer means that you cannot empty all crypto wallets just like that, unless they are not protected by a password at all, or the attacker knows which wallets the user has and prompts him to open them and thus find out the password.

No, that is not how things work. There are automated tools by now which will scan your machine for every possible known wallet type, desktop and extension wallets. They can extract them fast or they can empty them fast, sometimes they try both. It depends on the target and on the attackers.

Even if they are all password protected, which I assure you in many cases they are not, where are these passwords most often stored? On the computer in plaintext, or on the computer inside a password manager. If you have complete access to somebody's system, you can do anything. If you don't know how, it is mostly due to a lack of your own imagination. Sometimes people compromise systems and wait months or even years, gathering information, before executing an attack.

[AVE5]

Sorry Op, I did not actually understand the story fully.
According to the story above, Alex is only in contact stage with the alleged or to-be partners. What really happened, did he disclose his private details at the course of the meeting?
Could it be that they hosted the meeting with tools like TeamViewer and he gave them unrestricted access to his computer?

I'm to believe that Alex the victim with his 150 wallets was all hot wallet (as Op may say) to store the tokens and same device that those Wallets were installed should be the same device Alex used to join the online communication (interview) with the scammers on their legitimate disguise.
So Imo, he was sent malicious link to connect/join the interview with the scammers with same device that holds the wallets therefore is the medium that gave the scammers access to the wallets of target.
So if Alex had used external device that's not connected to the device where the wallets where installed, I don't think he'd had fallen the victim and that's why Op suggested a hardware wallets or he'd had just have a confidential (separate) device to install those Wallets and never associate it with the internet to enhance security and stay off online threats.

[Marykeller]

This is sad. A friendly conversation about a partnership turned out to be a scam. This is heartbreaking because Alexander Choi never thought that a link to a video call meeting would actually make his gadget vulnerable to scams.

Sometimes, if we think we have run off from scammers, scammers think of other methods to scam us, by appearing legit and genuine. Who could have thought that this to happen, for scammers to gain full access to your gadget through a link to a video call sent to you

[Sim_card]

According to the story above, Alex is only in contact stage with the alleged or to-be partners. What really happened, did he disclose his private details at the course of the meeting?

Nope, Alexander Choi didn't disclose anything to the scammers during the call, Alexander is somewhat experienced in the industry, so he didn't do that. I have read from a few sources about this case and this is a very sophisticated scam, i believe the scammers are exploiting some form of vulnerability in video conferencing apps/platforms.

The scammers host the meeting and forward the link to their potential victims, i think it is at that point that the scam happens. There is not so much information on what the malware is right now and what vulnerability they are exploiting. But don't keep a huge amount of assets in a hot wallet like Alex did, and if you are not the host of a meeting in any of these third party apps, then you have to be very suspicious of it, be careful, there might just be a malware lurking in there.

I feel that the best thing is to avoid talking business to strangers on the internet because most of them most be scammers. Assuming Alex didn't listen to them and ignored their request, he wouldn't have fallen for the video call which he got affected from. I ignore messages or emails from strangers because in my country, you see random numbers sending text and emails from people you don't know. However, offline wallets are the best.

[BIT-BENDER]

Having over 150 wallet on the same device you use to apply for jobs and other aspects of life is a big mistake and I can understand that he did not do due diligence he probably was desperate for a job and everything was looking to go in his favour.
Again it is important to know where you source for jobs some sites that post about jobs could also be in partnership with some of these scammers to protect your wallet you need to have them on devices you aren't using.

[Felicity_Tide]

This problem of people losing a very large amount of their digital assets to silly and avoidable mistakes is now becoming rampant. It seems those threads about wallets and how to secure funds, that are being created often can never get old, as this particular case just proves that there is a need for a constant reminder. And if i may ask, why do rich people tends to make certain silly mistakes?. The other day, it was a case of someone who bought a wallet online, and the entire assets got drained.

This case proves that basic things like how to secure large funds especially when it has to do with separating devices, is very important. They might seem too basic, but they can safe us from a lot of troubles.

[Coyster]

I feel that the best thing is to avoid talking business to strangers on the internet because most of them most be scammers. Assuming Alex didn't listen to them and ignored their request, he wouldn't have fallen for the video call which he got affected from.

This is not possible for everyone in the industry, if you offer a crypto service or you have a crypto platform, there is no way you can avoid discussing business with strangers. Campaign managers in this forum are a great example, if they refuse to discuss business with strangers, they would have zero clients and would be unable to launch any campaign in the forum.

That said, Alexander Choi is the founder of crypto trading community Fortune Collective, so he will always actively be in crypto business discussions with strangers. That is why these scammers targeted him and asked him to partner with them, claiming to be part of the SparkToken team. The best thing to do is to have a cold wallet.

[Bright0515]

This sounds somehow legit that is why the victim of the scam fall for it. But how did they get access into his crypto wallet? You did not tell us how they got access into his wallet. Did they hack his wallet why he was on call for the job interview?

But there are several things you can do differently from Alexander to not get yourself in a similar situation:
- Don't hold your crypto in hot wallets. Especially not on devices you use for everyday activities. If Alexander's crypto had been in a hardware wallet, an airgapped computer, or a second computer he only uses for crypto, this could have been avoided. There is no reason to hold $1 million worth of crypto on an internet-connected device when there are safer options around.
- Take your time to investigate and research people and projects. Alexander found out these people were scammers, but only after they scammed him. Why didn't he do his due diligence before?
- Always be careful and suspicious. It's still unclear what kind of Microsoft Teams meeting Alex attended. He claims it was an official link, but who knows. Fake links with extensions and scripts are shared this way. One wrong click and you invite malware and drainers into your system.


If you want to read the full story, you can do so here:
https://x.com/notalexchoi/status/1964464236710461885

Moreover thanks to you for this information. It is like the scam victim have his wallet in the same device he used for the call or they sent him phishing link which he clicked and they hacked his device.

[Satofan44]

This problem of people losing a very large amount of their digital assets to silly and avoidable mistakes is now becoming rampant. It seems those threads about wallets and how to secure funds, that are being created often can never get old, as this particular case just proves that there is a need for a constant reminder. And if i may ask, why do rich people tends to make certain silly mistakes?. The other day, it was a case of someone who bought a wallet online, and the entire assets got drained.

The more people use cryptocurrencies, the more people will be hacked. It is simply the law of numbers. A very tiny minority of uses knows how to use these things safely.

This sounds somehow legit that is why the victim of the scam fall for it. But how did they get access into his crypto wallet? You did not tell us how they got access into his wallet. Did they hack his wallet why he was on call for the job interview?

Nigerian shitposter, read the article and the whole thread. All the information about this is provided already.

[Bright0515]

This sounds somehow legit that is why the victim of the scam fall for it. But how did they get access into his crypto wallet? You did not tell us how they got access into his wallet. Did they hack his wallet why he was on call for the job interview?

Shitposter, read the article and the whole thread. All the information about this is provided already.

No need exchange words with you because your trust feedback says the kind of person you are. Have a nice day and take care.

[uchegod-21]

I feel that the best thing is to avoid talking business to strangers on the internet because most of them most be scammers. Assuming Alex didn't listen to them and ignored their request, he wouldn't have fallen for the video call which he got affected from. I ignore messages or emails from strangers because in my country, you see random numbers sending text and emails from people you don't know. However, offline wallets are the best.

Can we really avoid strangers completely? It takes a day to know someone and then form a relationship with that person. Severally, people we don't know in person but must have seen our work online have reached out to us to either promote a brand or work on some project together. It is our duty to verify if those offers are genuine.

The only mistake I see that Alex did here was not verifying those scammers to ascertain if they are really business people. Alex had that amount of bitcoins but chose to store them in a hot wallet; a device he uses everyday. I consider Alex a victim of his own ignorance.

[Die_empty]

I feel that the best thing is to avoid talking business to strangers on the internet because most of them most be scammers. Assuming Alex didn't listen to them and ignored their request, he wouldn't have fallen for the video call which he got affected from. I ignore messages or emails from strangers because in my country, you see random numbers sending text and emails from people you don't know. However, offline wallets are the best.

Some people have their CV on different platforms, so they will be expecting business proposals or deals from anybody from any part of the world. If you keep avoiding business deals from strangers, you might end up missing out on valid deals.

The OP gave the right advice, which is not to keep our crypto assets in hot wallets or devices that are connected to the internet. Business deals should have a separate device from our coins to avoid exposure to dangers.  

[Satofan44]

Can we really avoid strangers completely? It takes a day to know someone and then form a relationship with that person. Severally, people we don't know in person but must have seen our work online have reached out to us to either promote a brand or work on some project together. It is our duty to verify if those offers are genuine.

It is ridiculous advice. Most people are on social media and work social media like Linkedin. Most people are exposed to all kinds of strangers all the time. In this day and age, such strategy is only for a fringe minority of people.

The only mistake I see that Alex did here was not verifying those scammers to ascertain if they are really business people.

How exactly do you believe verification can avoid a scam that involves a zero day exploit? They can create all kinds of fake documents and profiles. They can even hire people to pose in video calls if you believe deepfakes can be easily detected by other humans. Verification does not really avoid this situation.

Some people have their CV on different platforms, so they will be expecting business proposals or deals from anybody from any part of the world. If you keep avoiding business deals from strangers, you might end up missing out on valid deals.

Better advice would be to stop using Windows for starters. 

[Odohu]

This is a mistake that would have been avoided. What on earth will make someone keep all his cryptocurrency in one computer that is even connected to the internet? If I have such money, I will create several wallets that are not connected to any computer and spread the funds into them and their seed phrase will not be online. Even if I have a hardware wallet, I will not keep all my money in one device, instead I will keep them in several hardware wallets and kept in different locations. As scammers are getting more technical by the day, it is wise we also become smarter with our security.

[sunsilk]

That is why it's very important to have a hardware wallet. This gives added security to the funds that we have because there's a manual validation/confirmation before a transaction proceeds.

A costly mistake and it's hard to take this when the involved amount is high. Scammers and hackers are evolving everyday and always create their tactics differently from time to time.

We shouldn't let our feelings eat us up with excitement, whether it's a job interview, some giveaways, etc. We always need to verify matters before we continue.

[promise444c5]

However, even full access to the computer means that you cannot empty all crypto wallets just like that, unless they are not protected by a password at all, or the attacker knows which wallets the user has and prompts him to open them and thus find out the password.

He’s actually been studied, a lot of infos is probably in their hands before performing the attack.. The attack will also be done at once to prevent early notice which might disrupt  their plan.
Gaining access to to a victims computers gives almost equal access as the user.. all they need it to wait while they monitor his activities and also perform more social engineering tactics to get what they needed since they already have a trusted way(to the victim) of doing that..
Losing such amount is a pain