Elaborate Social‑Engineering Scams Drain Crypto Wallets, Warn Darktrace

Crypto users are falling victim to an elaborate social‑engineering scheme that drains wallets by masquerading as legitimate AI, gaming, Web3, and social media startups, according to a July 10 report by cybersecurity firm Darktrace. The operation mirrors techniques used by “Traffer Groups,” dating back to the Meeten campaign in December 2024, which deployed malware like Realst to siphon credentials.

How the Scam Works

1. Impersonation through fake startups – Threat actors construct convincing fake companies, complete with professional-looking X (formerly Twitter) profiles—often compromised verified accounts—and publish supporting content on platforms like Notion, Medium, and GitHub.
2. Targeted outreach – Victims are contacted via X, Telegram, or Discord by individuals posing as startup employees, invited to test software in exchange for crypto payments. The victims then download a binary after entering a registration code.
3. Cloudflare “verification” ruse – Once launched, the software displays a Cloudflare verification bubble while quietly profiling the system. If successful, malicious payloads are deployed—Python scripts, executables, or MSI installers—that steal wallet credentials.
4. Platform- and OS-agnostic targeting – Both Windows and macOS users have been targeted, with stolen code-signing certificates and obfuscation tools used to evade detection.

Wider Context of Crypto Fraud

This newly exposed campaign is the latest in a growing wave of crypto-related frauds, ranging from “pig‑butchering” scams to extortion-style “four‑dollar wrench” attacks. In early July, Chinese authorities issued warnings about stablecoin fundraising platforms acting as fronts for money laundering and gambling. And on July 8, the US Department of Justice unsealed charges against two individuals accused of orchestrating a $650 million crypto fraud.

Industry analysts have noted emerging tactics in 2025, including malicious browser extensions, compromised hardware wallets, and fake revocation sites. Technical support scams continue to proliferate, exploiting victims’ trust to steal private keys.