Crypto owner losses ≈ $1 million after fake job interview

[Pmalek]

This is episode #2 of stories involving crypto owners who were hacked and/or lost a lot of money to various online scams. Last month, I wrote BTC Investor Losses 7,4 BTC with Fake Sparrow Wallet Mobile App.
This is a more complex story and a more advanced scam that resulted in Alexander Choi losing $996,000 in various coins and tokens.

Here is what happened...

The story begins with Alexander being approached over X by some token community profile regarding a partnership opportunity. They were interested in working with him and asked him to schedule a call to talk more. They had two meetings over Microsoft Teams, and everything seemed legitimate and done professionally. The first person Alexander spoke to introduced himself as Dan. He had an American accent and was well-spoken. They discussed the future and how they could cooperate because Alex is also a crypto founder. They spoke again two days later. This time, another cofounder joined the meeting to discuss their plans.

Two days go by, and Alexander gets a notification on his phone that some crypto got transferred out of one of his wallets. He checked several wallets on his PC and noticed that each one had been emptied. In total, he claims that almost 150 different wallets and addresses got drained of all their coins.

Alexander then did some more research on the SPARK token community he was talking to. Turns out, they had fake followers and were involved with another rug pull in the past under a different name.

The money is gone now, and he will probably never get it back.

But there are several things you can do differently from Alexander to not get yourself in a similar situation:
- Don't hold your crypto in hot wallets. Especially not on devices you use for everyday activities. If Alexander's crypto had been in a hardware wallet, an airgapped computer, or a second computer he only uses for crypto, this could have been avoided. There is no reason to hold $1 million worth of crypto on an internet-connected device when there are safer options around.
- Take your time to investigate and research people and projects. Alexander found out these people were scammers, but only after they scammed him. Why didn't he do his due diligence before?
- Always be careful and suspicious. It's still unclear what kind of Microsoft Teams meeting Alex attended. He claims it was an official link, but who knows. Fake links with extensions and scripts are shared this way. One wrong click and you invite malware and drainers into your system.


If you want to read the full story, you can do so here:
https://x.com/notalexchoi/status/1964464236710461885

[_act_]

Many people will not be active on a forum like this forum, Bitcointalk. I have several posts already about how job interview is the new ways to scam people. Scammers use the privilege to tell their who-to-be victims that they should send money or instead to introduce malware into the person's device which is used to drain the person's wallet. Job interview scam has been on the rise since two years ago, it become more common last year and this year it still continues.

This what the last one that I posted about: How 31 North Korean ‘developers’ fooled top crypto companies and stole $680K

[Wiwo]

Many people will not be active on a forum like this forum, Bitcointalk. I have several posts already about how job interview is the new ways to scam people. Scammers use the privilege to tell their who-to-be victims that they should send money or instead to introduce malware into the person's device which is used to drain the person's wallet. Job interview scam has been on the rise since two years ago, it become more common last year and this year it still continues.

This what the last one that I posted about: How 31 North Korean ‘developers’ fooled top crypto companies and stole $680K

Yeah over here in my country, job interviews and other methods that involves financial gains like what happened to this did in the story that the project made an offer to collaborate with him all with aim to keep him engaged to gain access to his device, any ways we already know what it is and as you said most bitcointalk members already knows how important it is to keep your cryptocurrency assets off line as much as you can.

Having a dedicated device for holding your wallets and always offline is the way to go, i already have an air gab device that keep my wallet and oldest sim on, this device is always off and i only power it when i want to do a transactions.

[Btcdeybodi]

This is a very sad one, almost 150 wallets got drained? like how did these scammers run this shit
Very devastating story to hear but honestly, the way scammers are using different techniques to scam people these days is really scary and believing things we come across on the internet now is very risky because the advancement in technology is good but i see it causing more harm than good in the future. The advice should be that we should be very vigilant before partnering in a project with people we do not know because the rate of scams is alarming. Most platforms make use of fake followers just to convince you that many people are interested in what they do but they are just same group of people. Imagine losing almost 1 million dollars, it's really heartbroken.

[Zoomic]

Sorry Op, I did not actually understand the story fully.
According to the story above, Alex is only in contact stage with the alleged or to-be partners. What really happened, did he disclose his private details at the course of the meeting?
Could it be that they hosted the meeting with tools like TeamViewer and he gave them unrestricted access to his computer?

[doomloop]

I have several posts already about how job interview is the new ways to scam people.

Yeah, scammers are stealing the identify documents in the name of interview in my country lately. People who are deliberately looking for job or income stream (in the name of work from home), easily coem forward to submit even their passport and other highly sensitive information.

If they take time to verify the background of the company which offered the job, might easily help people to escape from these scam attempts.

we already know what it is and as you said most bitcointalk members already knows how important it is to keep your cryptocurrency assets off line as much as you can.

Yes, the importance of cold wallets has been emphasised across this forum for years. Unfortunately not all crypto users are not using this forum and also not all forum members are not making use of what they learned from this forum against scammers.

[Coyster]

According to the story above, Alex is only in contact stage with the alleged or to-be partners. What really happened, did he disclose his private details at the course of the meeting?

Nope, Alexander Choi didn't disclose anything to the scammers during the call, Alexander is somewhat experienced in the industry, so he didn't do that. I have read from a few sources about this case and this is a very sophisticated scam, i believe the scammers are exploiting some form of vulnerability in video conferencing apps/platforms.

The scammers host the meeting and forward the link to their potential victims, i think it is at that point that the scam happens. There is not so much information on what the malware is right now and what vulnerability they are exploiting. But don't keep a huge amount of assets in a hot wallet like Alex did, and if you are not the host of a meeting in any of these third party apps, then you have to be very suspicious of it, be careful, there might just be a malware lurking in there.

[arwin100]

This is episode #2 of stories involving crypto owners who were hacked and/or lost a lot of money to various online scams. Last month, I wrote BTC Investor Losses 7,4 BTC with Fake Sparrow Wallet Mobile App.
This is a more complex story and a more advanced scam that resulted in Alexander Choi losing $996,000 in various coins and tokens.

Here is what happened...

The story begins with Alexander being approached over X by some token community profile regarding a partnership opportunity. They were interested in working with him and asked him to schedule a call to talk more. They had two meetings over Microsoft Teams, and everything seemed legitimate and done professionally. The first person Alexander spoke to introduced himself as Dan. He had an American accent and was well-spoken. They discussed the future and how they could cooperate because Alex is also a crypto founder. They spoke again two days later. This time, another cofounder joined the meeting to discuss their plans.

Two days go by, and Alexander gets a notification on his phone that some crypto got transferred out of one of his wallets. He checked several wallets on his PC and noticed that each one had been emptied. In total, he claims that almost 150 different wallets and addresses got drained of all their coins.

Alexander then did some more research on the SPARK token community he was talking to. Turns out, they had fake followers and were involved with another rug pull in the past under a different name.

The money is gone now, and he will probably never get it back.

But there are several things you can do differently from Alexander to not get yourself in a similar situation:
- Don't hold your crypto in hot wallets. Especially not on devices you use for everyday activities. If Alexander's crypto had been in a hardware wallet, an airgapped computer, or a second computer he only uses for crypto, this could have been avoided. There is no reason to hold $1 million worth of crypto on an internet-connected device when there are safer options around.
- Take your time to investigate and research people and projects. Alexander found out these people were scammers, but only after they scammed him. Why didn't he do his due diligence before?
- Always be careful and suspicious. It's still unclear what kind of Microsoft Teams meeting Alex attended. He claims it was an official link, but who knows. Fake links with extensions and scripts are shared this way. One wrong click and you invite malware and drainers into your system.


If you want to read the full story, you can do so here:
https://x.com/notalexchoi/status/1964464236710461885

This is another unfortunate lose for people seeking for job and instead of getting some income from the job they think could able to get from that interview here they are got fall from old job scam tricks done by those scammers.

I heard about same situation happened before and also cointelegraph and gate have an article about this https://cointelegraph.com/learn/articles/crypto-job-scams also this https://www.gate.com/learn/articles/crypto-job-scams-a-warning-guide/7508

To bad that there are still vulnerable people who fall for this schemes so again to avoid getting a problem towards this matter its really better for people to verify what they are trying to avail or get online.

This is another unfortunate story but somehow people could learn from the experience gotten by that person.

[Lucius]

~snip~
- Always be careful and suspicious. It's still unclear what kind of Microsoft Teams meeting Alex attended. He claims it was an official link, but who knows. Fake links with extensions and scripts are shared this way. One wrong click and you invite malware and drainers into your system.

I don't understand how it was possible to empty 150 different crypto wallets with just one click on a link? What comes to mind is that this user may have protected his wallets with a password that was very simple and identical for each wallet, but again, if we take into account that someone stores so much value in hot wallets, then it is possible that he also stored his backups on the same computer in unprotected text form.

Anyway, all these stories we read over the years confirm that being rich and being intelligent are not related to each other.

[cryptoaddictchie]

I cant imagine how this all happened in that instance. People should always be careful when dealing on their laptops or devices. Losing a $ million isnt gonna go un noticed by anyone. If thats me, I cant say what I do, probably losing my mind for real, cause thats huge money and if thats your only money how can you sleep well or do things after that.

[Satofan44]

Nope, Alexander Choi didn't disclose anything to the scammers during the call, Alexander is somewhat experienced in the industry, so he didn't do that. I have read from a few sources about this case and this is a very sophisticated scam, i believe the scammers are exploiting some form of vulnerability in video conferencing apps/platforms.

Abusing a zero day vulnerability in existing software, one which you have probably not discovered yourself, is not a sophisticated scam. It is a low level hack. You can readily buy these exploits in the dark web if they have not yet been made public. It is a trivial matter these days as most software has many undiscovered security issues due to bad practices and cost cutting.

Two days go by, and Alexander gets a notification on his phone that some crypto got transferred out of one of his wallets. He checked several wallets on his PC and noticed that each one had been emptied. In total, he claims that almost 150 different wallets and addresses got drained of all their coins.

150 wallets and all on the same device? I would not be surprised if he was advertising himself as a privacy and security expert, what an idiot.  

Similar but different scams are going around Telegram and Discord. They tend to offer several different and highly paid jobs in groups for testing out new games and other stuff. They are trying to catch anyone that may be interested whereas in this case it was a targeted scam.

[Pmalek]

Having a dedicated device for holding your wallets and always offline is the way to go, i already have an air gab device that keep my wallet and oldest sim on, this device is always off and i only power it when i want to do a transactions.

Just for the record, that's not an airgapped device. An airgapped device can't access the internet at all, like some of the airgapped hardware wallets we have or an airgapped computer with the network/WIFI card removed. What you are doing is better than having your crypto on a phone you use for everyday activities, though.

Sorry Op, I did not actually understand the story fully.
According to the story above, Alex is only in contact stage with the alleged or to-be partners. What really happened, did he disclose his private details at the course of the meeting?
Could it be that they hosted the meeting with tools like TeamViewer and he gave them unrestricted access to his computer?

He claims that interviews took place over Microsoft Teams, and that he was given an official link. Somehow I doubt it was an official link. They might have tricked him into installing a malicious extension followed by malware specifically created to find crypto wallets. What happened next is unclear. Perhaps it was drainer malware. Perhaps a keylogger that tracks and takes screenshot of everything you do. Perhaps a cookie hijacker that steals your cookies and allows you to access everything the other person does online. Who knows...   

I don't understand how it was possible to empty 150 different crypto wallets with just one click on a link? What comes to mind is that this user may have protected his wallets with a password that was very simple and identical for each wallet, but again, if we take into account that someone stores so much value in hot wallets, then it is possible that he also stored his backups on the same computer in unprotected text form.

Even if he used the simplest password, how did they find all his wallets and gained access to his computer to empty all of them? It's quite an advanced scam compared to the usual phishing schemes we see on a daily basis.

[Catenaccio]

But there are several things you can do differently from Alexander to not get yourself in a similar situation:
- Don't hold your crypto in hot wallets. Especially not on devices you use for everyday activities. If Alexander's crypto had been in a hardware wallet, an airgapped computer, or a second computer he only uses for crypto, this could have been avoided. There is no reason to hold $1 million worth of crypto on an internet-connected device when there are safer options around.

About $1M fund and store it in hot wallets, it's pretty stupid and very careless. With fund like $5,000 or $10,000, I think it's big enough for having a hardware wallet as you can get more benefit and safety with it than saving some hundreds of dollars with risk of losing all money you have.

Additionally, for daily actitivies, especially interaction with strangers or explore new websites, new projects, new applications, use a device that does not store any wallet or log in your exchange accounts.

This loss reminds me about Luke Dashjr developer who is a senior Bitcoin developer, a forum staff, but too careless and lost his bitcoins.

Bitcoin developer @lukedashjr's wallet was hacked.

[knowngunman]

Sorry Op, I did not actually understand the story fully.
According to the story above, Alex is only in contact stage with the alleged or to-be partners. What really happened, did he disclose his private details at the course of the meeting?
Could it be that they hosted the meeting with tools like TeamViewer and he gave them unrestricted access to his computer?

Same question that was boiling in my mind while reading the post but glad Coyster made some enlighten explanation. The question now is whether we are to avoid joining any form of conversation through links or we should be the one to host the meeting in a case like this.

Scammers are doing everything possible to be a step ahead of us using incredible strategies and sophisticated tools. The more inform we become, the more they develop new methods. Crypto seems to be the new oil money and becomes their target.

[_act_]

According to the story above, Alex is only in contact stage with the alleged or to-be partners. What really happened, did he disclose his private details at the course of the meeting?
Could it be that they hosted the meeting with tools like TeamViewer and he gave them unrestricted access to his computer?

I think they might sent him a file that contain malware, told him to open it. He trusted them and think the file is safe. But when he will know, it would have already been late. I have a separate device that I am using to open files, download things and I do not have banks, exchanges and wallets apps on the device.

[Ambatman]

Sometimes we get complacent, even when we know of the dangers
We tend to reason such wouldn't happen to us because we careful (yeah I was a victim of a clipboard malware).

Perhaps a keylogger that tracks and takes screenshot of everything you do. Perhaps a cookie hijacker that steals your cookies and allows you to access everything the other person does online. Who knows...   

Highly unlikely Imo.
Quite a lot of addresses were drained which shows that he should have atleast five different seedphrase (considering HD wallet structures)
I doubt he would have entered them all within that two days.
I'm not used to wallets that deal with other cryptocurrency but from my experience wallets don't require you using your seedphrase to gain access to their app.

Likely a cryware which definitely should be through the meetings link. So far from what he shared that's the likely case.

I think they might sent him a file that contain malware, told him to open it. He trusted them

I expect he should have some level of paranoia towards opening sent files from unknown source.
Well he's same person that had 150 address holding approximately a million in a single device.

150 wallets and all on the same device? I would not be surprised if he was advertising himself as a privacy and security expert, what an idiot. 

Not everybody listen to their own advice. Knowing the right thing is one thing but doing the right thing is another.

[Chinesebaby]

:
- Don't hold your crypto in hot wallets. Especially not on devices you use for everyday activities. If Alexander's crypto had been in a hardware wallet, an airgapped computer, or a second computer he only uses for crypto, this could have been avoided. There is no reason to hold $1 million worth of crypto on an internet-connected device when there are safer options around.

This is a really sad news to come across this afternoon and most especially a sad day to the user who lost over $1million worth of crypto to these scammers, because this is really an avoidable mistake whereby if only he had used just $1000 to buy a separate device or laptop and used only for the storage of his cryptos, all this makes would have been avoided. And I hope this comes as a lesson to many people who holds a large portion of crypto and still holds on the same wallets.

[_act_]

I expect he should have some level of paranoia towards opening sent files from unknown source.
Well he's same person that had 150 address holding approximately a million in a single device.

I think they might sent him a file that contain malware, told him to open it. He trusted them

Not everybody listen to their own advice. Knowing the right thing is one thing but doing the right thing is another.

If not because I came to this forum, I did not know all these. It was when I came to this forum that I started to know about scam and hack and how they are working. Also this forum helped me to know about each wallet types and their importance and how our devices can download malware. This forum helped me a lot. But there are some people that do not learn about scam and hack and also do not have a forum or community that they can discuss something like that, that is why you will see them vulnerable to scam and hack.

[lovesmayfamilis]

He claims that interviews took place over Microsoft Teams, and that he was given an official link.

I searched the Internet for information about the dangers of communication via Microsoft Teams, and as it turned out, scammers have long been using it for their fraudulent schemes.

https://www.makeuseof.com/microsoft-teams-phishing-scams/

With such an amount, the owner should have stopped all communication via that device, at least for the sake of his privacy. However, he not only kept huge amounts on the computer but also allowed them to be stolen literally from under his nose. Sometimes quite strange questions arise: how do such people manage to get such a sum if they are so careless about storing it?

[Wiwo]

Just for the record, that's not an airgapped device. An airgapped device can't access the internet at all, like some of the airgapped hardware wallets we have or an airgapped computer with the network/WIFI card removed. What you are doing is better than having your crypto on a phone you use for everyday activities, though.

Oh really, thank you so much for correcting my misconceptions about airgapped device, i thought that any device that you are not connecting to the internet with frequently and only main for storage can be referred to as airgapped device.

Fact is that my main aim is to keep my wallet separate on the device that inhave no use for and dedicated to that purpose only, so you are right in the last statement of the usage of the said device.