On August 20th 2024 Reddit user u/VtheCryptoEng lost his life savings ($207,300 USDT) in a social engineering / phishing scam.

He reached out to me about a year ago looking for help while at the same time trying to work with law enforcement in his jurisdiction to track down the scammers responsible.

Here's a breakdown of the wallets affected.

Theft Wallets

• VtheCryptoEng Wallet - 0x0079867C5D6DAA9cA3303cf9B0f6082B0de51887
• Hacker Main Wallet - 0x188e0b7d96F954bcA1C50B696030268C567C7C39
• Theft TXN - 0x4d01ae0676da8ae6c8e86f793e3463b904dafc134de6ff5d6ff5812a8fec809b

The stolen funds were distributed into the below two wallets before eventually finding their way into numerous intermediaries and deposit addresses.

• Hacker Wallet 1 - 0x9c79871A450b59bE9009E7cf2b5205B4591bbe08 (136,820 USDT sent)
• Hacker Wallet 2 - 0x067FD9A01F82d9f503e167003911997eC890E617 (70,514 USDT sent)

Statement of the theft from victim's POV:

On August 20 [2024] at 6:41 p.m. my life savings (3 bitcoins and 11.21 Eth) were scammed by a crypto scammer called xo.eth on Snapchat (he has about 60 thousand subscribers). He told me to call him by telegram (onlyonexo) he changed it now to (xoliquid), but since he is in Dubai he can't call from there, he has a British accent but he also said he was from the UK originally, he convinced me to sell my bitcoins and eth to Usdt and transfer them to TrustWallet, I had them in exchange MEXC. at that time, 3 bitcoins and 11.21 Eth were worth approximately 207,356 Usdt. he told me to go on discover on trustwallet then type diceswap[io] I went there and he told me to try a swap with 100 Usdt to eth just to test the fees... the second I made the exchange, I received the 100$ USDT (165 Usdt) that I exchanged for eth and at the same time I lost all my funds, he just hung up on me and blocked me everywhere. The call has last 1 hour in total.

I did a quick lookup on Hacker Wallet 1 and Hacker Wallet 2 and noticed those particular wallets have numerous complaints on places like Chainabuse and X.

Additionally, I found a handful of wallets with MILLIONs in what appeared to be stolen funds.

An example of another victim connected to the same scammers

Looking at the community complaints of the wallets I'm following, it appears this group of scammers is based in UK.

They purchase IG, TikTok, and Snap accounts with tens of thousands to hundreds of thousands of fake followers posting stories on social media of expensive vacations, eating at fancy restaurants and wearing luxury watches.

It's living that social media illusion to the 10th degree.

They DM the real users (victims) offering services that can increase their crypto profits but ONLY if they move their funds out of their exchange into one controlled by the scammers.

Once a target is found, the scammers will engage in phone conversations to really build the trust by befriending the victim and making them feel like like they are moments away from multi-millionaire status.

It's the classic Financial Scam.

Once the funds are gone, so are the scammers.

The Investigation

About three years ago, I lost most of my own life savings in hack that absolutely devastated me. I know the feeling of watching a six figure wallet get drained real-time to $0. I decided to investigate this scam to see what I could do.

Following the funds, I noticed there were a few wallets that seemed to be collecting most of the stolen crypto. These wallets ranged from about 500K - 4M in funds.

Additionally, there were numerous shared deposit addresses where these wallets sent funds to. I could make the connection of which wallets belong to who based on the shared interactions.

Here is a graph I did showing the flow of funds from VtheCryptoEng's wallet and other victims into the scammer wallets. I marked off the scammer wallets with labels.

The above is a visual of some of the fund movements.

The scammers would frequently move large amounts of crypto to different wallets, presumably to mask their trail.

This wallet in particular - 0x0ffcdF3002A3c88c3eC4b579535CE09292CB2D2A showed a lot of activity and was a destination for some of VtheCryptoEng's funds.

I was able to trace a large stash of DAI, USDT, and SOL sitting in that wallet.

Above is a look inside the inflows of wallet 0x0ff....B2D2a.

Funds from numerous victims, including VtheCryptoEng made it into this wallet after about 5 hops.

I was made aware of some interesting conversations happening between the victim and this wallet.

On-chain Taunting

It's one thing to steal, it's another level of maliciousness to taunt the victim after their life savings is gone.

In desperation, many victims will reach out on the blockchain hoping the scammers will return the funds in kindness. This doesn't work 99.9% of the time.

It appears this group monitors the blockchain for victim responses and responds with animosity reserved only for the lowest of web3 scammers.

Above is an on-chain conversation between VtheCryptoEng and the person behind wallet 0x0ffcdF3002A3c88c3eC4b579535CE09292CB2D2A

Ok, you want to taunt the victim now. Let's see what happens when we go after the one thing you care most about, your (stolen) funds.

Getting Revenge

In web3, it's uncommon that victims recover anything after a large theft. You rarely hear about them because the process can take YEARS from the initial theft until funds get returned. In most cases, victims are lucky to get a partial return.

I was able to work with LE to get assets in this scammer's wallet frozen and a few others that hit deposit addresses.

Tether froze the USDT in wallet 0x0ffc....CB2D2A

There's about 164K in the scammer's wallet of 0x0ffcd...CB2D2A that will eventually go back to VtheCryptoEng and other victims. The scammer can't touch it, the funds are frozen.

The scammer has since moved the rest of the assets to different wallets.

In total, about 540K in crypto assets were frozen in connection to VtheCryptoEng's scam and other victims.

Although this is a small victory, the amount stolen across the victims of this scam is in the Millions. I'm hopeful that enough funds will be recovered to make the victims whole though this usually isn't the case unfortunately.

Im confident this group will eventually be caught. Only then can justice truly be served.

Final Thoughts

I want to close this post by saying I've never been paid for the work I've done in web3 investigations. I don't do this for money but for the sheer joy of hunting down the most malicious of bad actors.

There's still A LOT more work that needs to be done. Although the funds are frozen, the legal process needs to run its course.

The funds need to be seized and then redistributed to the victims which is a process that can take years depending on the jurisdiction.

Lastly, It’s a long road to get the actual funds back, but watching that $540,000 sit frozen and untouchable is a massive win.

Scammers think they’re invisible on-chain, but this proves that with enough persistence and the right legal channels, we can actually strike back.

Stay safe out there!