Crypto Invoice Platform - legit?

[julerz12]

I was approached by some guy on Telegram, saying he wanted to promote their platform (https://pay.wmint.org/) ^Archive - a site that enables you to create a crypto invoice, send that invoice to whoever you like, and then they'll be able to "claim" the crypto? And it supposedly requires zero fees to the receiver.
It has badges for CertiK and SolidProof audits, but both of them point to nothing - it's just a badge.

Fill in the invoice, connect your wallet, and get a shareable link. Nothing is debited now: the transfer happens only when the recipient opens the link and claims the funds.

I told the guy it's better that he sends the campaign funds to my wallet address, but he insisted on using their invoice, which requires me to connect it to a Web3 wallet to be able to claim the crypto (in this case, USDT).  
BTW, that guy also presents himself as a "talent acquisition" - whatever that means. I didn't go through his request 'cause something feels off about his entire offer.

Have any of you used this type of service before, or could this be a wallet-drain attempt? If it's the latter, this guy could be lurking in this forum.

[logfiles]

Tricky one. I have never used such a service before.

Why is the person in a hurry to promote the service? The least he could do it at least try to show/demonstrate to your how the service works or how it can be trust before pushing it to the rest of the forum users who will participate in the signature campaign

Or maybe a review campaign is a better way of exploring the service.

[boyptc]

I can't find information about them unless directly accessing the website. It's up to you on how you'd handle this but, IMO getting funds and getting paid upfront shows a good start and in good faith that they are serious in promotion.

No information of about us, no FAQ etc. and has been made a couple of months ago.

Lack of those details which I think should be looked upon before accepting the project.

[BABY SHOES]

Just be careful, now phishing attempts by connecting wallets can drain the wallet of anyone who is careless, the spreaders of phishing there is always a way to convince his customers... I'm Sorry Not to accuse them, but rather to pay more attention to them.

If you are still curious try claiming the invoice using a new wallet with a separate device only, if in doubt ignore it.

I see there are many invoice maker platforms like this but never used, or would it be better for him to create an announcement thread on the bitcointalk forum to let other users judge whether this project is valid?

The domain site is just over 2 months old, there are no fair reviews yet.

[nc50lc]

I'd gladly try how it works, but this is consistently showing whenever I'm trying to connect my honeypot Metamask wallet:


Google translate; it says to refresh the page.

Unfortunately, this isn't open-source so it up to their reputation and your trust in them.

[crwth]

Hmm. Isn't there a method now that could drain a wallet with signatures? Like signing off-chain or approvals for unlimited token approvals, or something? This is where you need to make sure the message you are signing is legitimate and won't drain your wallet.

As other members have said, maybe a sacrificial wallet would suffice for testing?

Additionally, what you have pointed out: the badge without it pointing to anything should be a red flag already. Anybody can put a badge and say something. 

[nc50lc]

Hmm. Isn't there a method now that could drain a wallet with signatures? Like signing off-chain or approvals for unlimited token approvals, or something? This is where you need to make sure the message you are signing is legitimate and won't drain your wallet.

This is what I'm thinking when I tried it with my Metamask wallet.

I'm guessing that it's the sender that'll have to provide approvals and then, their service will process it on the user's behalf when then recipient claims the coin.
Looks like a legitimate workflow but open to exploits if the user doesn't know what he's doing or if the service is malicious.

But I'm not accusing them or anything.

[julerz12]

Why is the person in a hurry to promote the service?

Yep. That's one of the red flags: the way his very eager to pay up using that invoice. I've encountered lots of clients for my services, and all the time, the payments and funds transfer usually come in at the very last phase of the negotiation.

Or maybe a review campaign is a better way of exploring the service.

I doubt we'll ever see his platform have a legit campaign here. For all we know, he's just trying to drain wallets.

I can't find information about them unless directly accessing the website. It's up to you on how you'd handle this but, IMO getting funds and getting paid upfront shows a good start and in good faith that they are serious in promotion.

It's not really about getting paid first. While yes, most of the time, I would prefer that, but in this case, he seems to be in a hurry to pay up. There are no further questions about the specifics of the campaign whatsoever, which is why I wasn't comfortable accepting his offer. Clients (especially those who don't have an official thread in this forum) usually have tons of questions before we can even begin discussing the payments and funds transfers.

Just be careful, now phishing attempts by connecting wallets can drain the wallet of anyone who is careless, the spreaders of phishing there is always a way to convince his customers... I'm Sorry Not to accuse them, but rather to pay more attention to them.

True. Nah, don't be sorry. It's valid for anybody to question an unknown site, especially the ones that require anybody to connect their Web3 wallets.

I'd gladly try how it works, but this is consistently showing whenever I'm trying to connect my honeypot Metamask wallet:

I guess they aren't available to some geo locations.

Hmm. Isn't there a method now that could drain a wallet with signatures? Like signing off-chain or approvals for unlimited token approvals, or something? This is where you need to make sure the message you are signing is legitimate and won't drain your wallet.

Exactly, there are tons of them, and if you're not careful enough, one malicious approval, your entire crypto would be gone.

As other members have said, maybe a sacrificial wallet would suffice for testing?

I don't really have an extra system to test this out since my old laptop died months ago.  I'd rather just ignore them for now, I guess.

Additionally, what you have pointed out: the badge without it pointing to anything should be a red flag already. Anybody can put a badge and say something. 

Yep. Pretty weird to boast an audit badge with no links to back it up. I've seen that trick used a thousand times by most memecoins. LOL

[MuffinMaster]

It’s quite an innovative solution, but I’d definitely be afraid to use it. The fact that there is no fee for the sender also raises a red flag for me and makes it look even more suspicious. Incorrect audit links are another red flag.
However, it’s hard to rule out that something like this is technically possible. It would be good for the community to test it themselves - in my opinion, a review campaign is not bad idea.

To secure your funds, you would need to create a new wallet. I think creating a "test" profile in Google Chrome and installing MetaMask or Trust Wallet there with a completely new address should be safe enough. I definitely wouldn't connect the wallet I use on a daily basis, it's best to create one just to test the service.

[boyptc]

I can't find information about them unless directly accessing the website. It's up to you on how you'd handle this but, IMO getting funds and getting paid upfront shows a good start and in good faith that they are serious in promotion.

It's not really about getting paid first. While yes, most of the time, I would prefer that, but in this case, he seems to be in a hurry to pay up. There are no further questions about the specifics of the campaign whatsoever, which is why I wasn't comfortable accepting his offer. Clients (especially those who don't have an official thread in this forum) usually have tons of questions before we can even begin discussing the payments and funds transfers.

I guess just apply your standard procedure into this because you've been more than experienced in handling these queries than I.

Maybe giving them the benefit of the doubt for now and whatever is your decision, I think you know what's best.

Welp, good luck bro.

[LoyceV]

a site that enables you to create a crypto invoice, send that invoice to whoever you like, and then they'll be able to "claim" the crypto?

This sounds shady. From their website (without giving them a free backlink):

Set the amount in USDT, add a memo and an expiry date, and get a unique invoice link. Your wallet proves you are the sender, but nothing is debited at this step.

It just doesn't make sense. Crypto is supposed to be peer to peer: someone gives you their address, you send your payment to that address. Simple as that.
Adding a third party doesn't make any of this better, even if it's not a scam.

[PX-Z]

Hmmm.  The process seems familiar from those fiat payment gateway features i worked with (Paymongo payment link and Maya, IIRC Blockonomics have payment link invoice too). But those are payment gateways where they need to be approved from their business docs, etc. first.

But this one? Even though the "how it works" seems confusing. Using the pronoun "you" as the sender then later it will debit from "your" wallet again. lmao

Anyway, i tried to connect metamask as i want to create an invoice to check what's their way on how you as the invoice creator will get the fund after you made the invoice link, but unfortunately, it doesn't connect.

[nc50lc]

I'd gladly try how it works, but this is consistently showing whenever I'm trying to connect my honeypot Metamask wallet:

I guess they aren't available to some geo locations.

The "refresh" error doesn't seem to be related to my locale though.

It appears only when Metamask is active on standby waiting for it to connect.
Without any available wallet, it can continue to show the QR code that can be used by a mobile wallet to connect.

Anyways, it's a good call to ignore them (for now) since its core feature isn't even working in one of the most used Altcoin wallet out there.

[arwin100]

I'd gladly try how it works, but this is consistently showing whenever I'm trying to connect my honeypot Metamask wallet:

I guess they aren't available to some geo locations.

The "refresh" error doesn't seem to be related to my locale though.

It appears only when Metamask is active on standby waiting for it to connect.
Without any available wallet, it can continue to show the QR code that can be used by a mobile wallet to connect.

Anyways, it's a good call to ignore them (for now) since its core feature isn't even working in one of the most used Altcoin wallet out there.

But maybe best not to try it, since if we look at the way how they explain their services offered and their site.

Most provably this is a wallet drainer on which once he sign or approve there's a chance that their wallet might get hacked.

Much better avoid interacting and ignore that site.  Not good for people to get curious about it, since its clear the owner of that site. Don't want to operate a legitimate business, but they their intention is to spread that malware.

[Zwei]

on every page on that website, they load a very large build.js (almost 10 mb) script from another domain that is very suspicious:

Code:

https://receptionteam.cc/static/reception/js/build.js

web.archive.org/web/20260917212136/https://receptionteam.cc/static/reception/js/build.js

i tried to have AI check it, but it's heavily obfuscated, so i can't prove anything 100%, but that in itself a big red flag.
and according to gemini, that script can execute malicious payloads on the fly, so just opening the website could put you in danger.



but let's ignore that for a sec, because i can prove they are liars.
they have a token called WMINT that you can buy, they even have a dashboard/leaderboard for the people who did invest/buy it:



they allegedly raised $18+ mil, but if we check the token address, there are no transactions besides the one that minted the token: https://etherscan.io/token/0x44F725Fdf509788E123fc79881174f940B8dbdE1#transactions



even more, the addresses they are showing on the leaderboard, they are hardcoded in a config.js file

Code:

https://wmint.org/js/config.js

Code:

    leaderboard: [
      { wallet: "0x79a3e2df36e6ca254898806e945828c06fbab7f4", usd: 560762 },
      { wallet: "0x05dd68f71a687939541bfd25de84bd17ed4282c5", usd: 558234 },
      { wallet: "0xef8a120bb42d1ccaf0fb4535e6563fb289ac2d06", usd: 556383 },
      { wallet: "0xd4e201a3d6a74d51d94ecfbeb6006d5bca144357", usd: 553087 },
      { wallet: "0xbf19691edba741ebdbd0c13ae7a8aa927ac57abf", usd: 551934 },
      { wallet: "0x32db1367e8bea719c1c6268d65ad7f36315655b1", usd: 551044 },
      { wallet: "0xfaab098f7c96518433996db8c239077d966ee739", usd: 547390 },
      { wallet: "0xf63f282fd578714cf8b3bdc43f3496c7ce78689b", usd: 544603 },
      { wallet: "0xe70b34c67f0cc4674726f1aaed7bd1038aef041b", usd: 543489 },
      { wallet: "0x2876f8bf1ea5a0597d3bfc67510e149eba6c7933", usd: 542246 },
      { wallet: "0x40d00f3bd64e4088fb60ffcb26040e7255653654", usd: 540169 },
      { wallet: "0xab2c540ea2815297b27b303506ca9930ae1f72e2", usd: 537319 },
      { wallet: "0xb8b35e977a21db6420a6db553d1c946654be8da2", usd: 534582 },
      { wallet: "0x4e9d9d1c1c00e05d740d14318ae3888b0927e256", usd: 534497 },
      { wallet: "0x4cbccac0e6f0ba4788193896116d0f814585bedd", usd: 529361 },
      { wallet: "0xd9915a6d5d00cd7faaf1ecfba498f4632b16a817", usd: 528618 },
      { wallet: "0x493e43b3dd9eba9327b2f7fb254f38206fcee14c", usd: 526935 },
      { wallet: "0x185494e2cf3a522bbdf8c2e7c0bf28673cdde9af", usd: 523818 },
      { wallet: "0xce632727345b49ef0c23fc6bf08544243a786195", usd: 521547 },
      { wallet: "0xc1905d4112cf2a713caa525a69d84ddd9b40f57b", usd: 521407 },
      { wallet: "0x439002d6ffe5f82a8760b27cc03b5cb82c94d145", usd: 521328 },
      { wallet: "0xbf6a98a70c054d55bf861152a0cddacc7878597a", usd: 516572 },
      { wallet: "0xf0f8778fa04b7b6e63dc45332998518e5182f95b", usd: 513400 },
      { wallet: "0x54ae1cad0f85e796fecaad76c5b983c35894bddb", usd: 509989 },
      { wallet: "0xda0935b2441042b0db51200ae97db0557c2a3d10", usd: 507634 },
      { wallet: "0x3c16e9d1d21d65ef9ffeb04f82b3b5f178a1a971", usd: 504994 },
      { wallet: "0xf03fa3f5b0e8567650702e820d8cb7b72af76d85", usd: 501596 },
      { wallet: "0x72178f0fd6a4d266c1452469b6b2754b7961c4be", usd: 499296 },
      { wallet: "0x92feb2695238e63e737c11bad2f1f326f3b93cb0", usd: 495604 },
      { wallet: "0x1379b2ad9af6dd33238f9950f96abbf567cf5937", usd: 493141 },
      { wallet: "0x496b165c4dcca33a5d03b0876bc96509251649e3", usd: 469666 },
      { wallet: "0x0c6720c3351a6d142841a28a781ce5b050138e6f", usd: 70011.08 },
      { wallet: "0x467f66d94edd069b7930e656af02e984f3aaf475", usd: 56851.641 },
      { wallet: "0x018cd6b873c1e68d8b0be6019b269840535b83eb", usd: 56443.004 },
      { wallet: "0x28740b0e9ffa7e135f69c2be06d63d103c431b91", usd: 44915.5452 },
      { wallet: "0x9d26431f5e39e7f5926e2e46825b84336af7d783", usd: 39994.64 },
      { wallet: "0xf881bbd01ece463262969bc2b02b7ccf616770fb", usd: 38188.6801465 },
      { wallet: "0x62df296e5d4ad3d5f609bf9215ce9d1a3e0c2d94", usd: 34221 },
      { wallet: "0xa1d74b0c031ce283d208b03dfa0601bad5241835", usd: 32604.2199298 },
      { wallet: "0x271125932ce6a97ea4213d5362ca9930cb105cea", usd: 31472.172 },
      { wallet: "0xf6f271a28aff109432aa7bb34a50842a2be21936", usd: 31259.1049 },
      { wallet: "0x9f22dbe15d6ecbdbb67389666f89b4ea6e58dfe5", usd: 30580.5 },
      { wallet: "0x3aad3c8741dc71ca08a38c75503708e8bcc09b07", usd: 30546.598501 },
      { wallet: "0xb4d9f8431ec3aca28737c2536b698cca84459e72", usd: 28216.042 },
      { wallet: "0x2e331be07a4164cf48f8cb338ea41eb10669830d", usd: 26040.142 },
      { wallet: "0xa1978c7bcbb1dcd69fd263eafa86f5c64be03f23", usd: 22123.7774984 },
      { wallet: "0x47879489cbd7bb9965d33f66c01eec929fb2c7b1", usd: 20220 },
      { wallet: "0x06a23e0dd6e57f7f4a0de9004fef504637e554e5", usd: 20002.385 },
      { wallet: "0xd2849395418c2a2821da00202bc51802db701403", usd: 19890 },
      { wallet: "0x3ed79872c96d686fbcc6f0e72f4500197a78714f", usd: 18449.503274 },
    ],

web.archive.org/web/20260917212731/https://wmint.org/js/config.js

they are just a bunch of random addresses, if you check the first 3 that supposedly invested $$$$$$ each, they don't have a single outgoing transaction, let alone have transacted a single dollar.

so yeah, that platform is not legit. he was definitely trying to get you to connect your wallet to drain you or something, but apparently he can't get it to work?
or maybe he had something else on his mind for us on the forum.

it was a good thing you asked about it.

now that his whole shit is exposed, if that guy is lurking in the forum and reading this, i wanna say: fuck you.

[julerz12]

it was a good thing you asked about it.

now that his whole shit is exposed, if that guy is lurking in the forum and reading this, i wanna say: fuck you.

Thanks for the detailed response about this, Zwei. I guess it's safe to say this site cannot be trusted.
What concerns me is that he seems to know I'm running a campaign management, which means, yes, he is lurking in this forum and, for all we know, he's also targeting other campaign managers or other service providers.
I just hope no one falls into his trap. Wallet drains are no joke; everyone who's working with Web3 platforms and clients should be made aware of this.

Much better avoid interacting and ignore that site.  Not good for people to get curious about it, since its clear the owner of that site. Don't want to operate a legitimate business, but they their intention is to spread that malware.

Exactly, no official announcement thread, no links to back up his platform's audits, and from what Zwei has just added, even more red flags come to light.

[nc50lc]

on every page on that website, they load a very large build.js (almost 10 mb) script from another domain that is very suspicious:

Code:

https://receptionteam.cc/static/reception/js/build.js

Nice catch, and here's something that will support that AI's flags;

The domain's homepage is literally a "reception" containing details of how to connect their service to your website: