YouTube crypto giveaway scams | Hacker News Reader

YouTube crypto giveaway scams

scaminvestigations.substack.com

75 pointshamiltonians105 comments

I find it rather irritating that the author didn't bother to describe the mechanics behind the supposed scam. A quick sample of other posts also suffer from the same lack of information.

In this situation he describes something that has been happening for a long while (years), and almost everyone active in the space is familiar with the scam. But what people don't know is that right now (still) it appears to scam people out of 6 digits per day.

Adding an explainer of what's happening might get rid of your irritation, but it might just irritate many other readers coming there for the meat. All the other posts are about the same topic, so this blog seems to more document details of what's happening as opposed to explain the basics to everyone.

Nothing complicated. It's the usual "send us btc/eth to get double back" scams.

The substack has other posts that have more context. https://scaminvestigations.substack.com/

Screenshot: https://old.reddit.com/r/ethereum/comments/n49iye/scam_sent_...

Crypto holders can get on EVE Online a free hands-on crash course on currency scams.

Or Runescape haha

Indeed. But this site is probably a pretty typical example of the scam: https://msnews.io/#rules

I like their calculator. Very helpful.

Apparently their marks cannot multiply by 2.

Holy shit. Try opening Dev tools (F12); it redirects you immediately to some random minecraft YouTube video.

They do NOT want people digging into the site, haha.

crazy find

It's using console-ban: https://github.com/fz6m/console-ban

It's easy enough to work round in uBlock - just add:

    ||cdn.jsdelivr.net/gh/fz6m/console-ban@3.2/dist/console-ban.min.js

as a filter.

Thanks for that tip.

Fun fact, they additionally try to prevent any text selection, right-clicking, or copy/paste chords. Pasting this in your devtools debugger restores all functionality:

    (function () {
     if (typeof document.body.style.MozUserSelect != "undefined") {
        document.body.style.MozUserSelect = "auto";
     }
     document.body.style.cursor = "default";
     document.captureEvents(Event.MOUSEDOWN);
     document.onmousedown = double_mouse;
     document.oncontextmenu = function() {return true};
     document.onkeydown = function() {return true};
    })();

Also, the "transactions log" is literally all random numbers generated in the browser:

    function createTableItem() {
        let coin = randomInteger(0, 1) == 1 ? "BTC" : "ETH";
        let inputValue = coin == "BTC" ? randomInteger(0, 5) + "." + randomString(5, "123456789") : randomInteger(0, 20) + "." + randomString(5, "123456789");
        let outputValue = ++inputValue * 2;
        let fee = inputValue / 100000;
        let address = coin == "BTC" ? $("input[name=address_btc]").val() : $("input[name=address_eth]").val();

        let row = `<div class="transaction-item">
                <p class="txhash">${randomString(25) + "..."}</p>
                <p class="block">${randomString(6, "123456789")}</p>
                <p class="from">${randomString(25) + "..."}<br>${address}</p>
                <div class="arrow"><img src="../img/check.svg" alt=""></div>
                <p class="to">${address}<br>${randomString(25) + "..."}</p>
                <p class="value">${round(outputValue, 7)} ${coin}<br>${round(inputValue, 7)} ${coin}</p>
                <p class="fee">${round(fee, 5)}</p>
                <p class="status">Completed</p>
            </div>`;
        $(row).hide().prependTo(".transaction-content").fadeIn("slow");
        $('.transaction-item:eq(5)').remove();
    }

    createTableItem();
    createTableItem();
    createTableItem();
    createTableItem();
    createTableItem();
    setInterval(createTableItem, 8000);

I was surprised at how few spelling errors the scam had until I got to the transaction hashes and wallet addresses.

But the lack of articles like “the” are a flag to be that this is probably Russian or Ukrainian. They generally do not use “the” when writing English.

While this prior may be informative, plenty of languages don’t have these. All Slavic languages AFAIK for a start.

You will send 0.000000000001 btc. You receive 2btc. Fantastic deal!

It's basically the Nigerian Prince email, but via YouTube and with crypto for payment.

I guess another advantage of the blockchain is that you can watch marks getting suckered in near real-time?

I am trying to find more information such as how they obtain the livestream views or how they hack the twitter accounts. Hundreds of articles have been written about this but no insight as to where the livestream views come from. Are the livestream from proxies or some sort of browser hijack.

Also, almost everyone by now is aware of the scam given all the news coverage it over the past few years, so I don't see the need to repeat myself again.

Google "crypto giveaway scam YouTube" no quotes for more info.

I’m guessing Discord server hijacking is also a source. There are hundreds of crypto servers that are full of spam (they advertise as pump n dump) and people constantly fall for them.

Lol a doubling scam. These scams have existed since MMOs began and you could trick people into giving you items/currency under false pretenses.

Ironically a smart contract is probably the safest way for a customer to engage in a doubling scam.

For those that aren't aware. It's pretty easy to write an escrow smart contract which ensures both parties got what they signed up for. But anyone falling for this scam definitely isn't going to ask "Can we use an escrow contract to double my money?"

>For those that aren't aware. It's pretty easy to write an escrow smart contract which ensures both parties got what they signed up for.

Press F [0][1] to doubt.

[0] https://hackingdistributed.com/2016/06/18/analysis-of-the-da...

[1] https://hackingdistributed.com/2017/07/22/deep-dive-parity-b...

Not only was the doubling part from Runescape but this kind of live stream-replay tactic was also first used for phishing Runescape accounts when Twitch first got popular. They would replay developer live-streams with 'use the link below to log in for free RS membership' subtitles, and view-bot the streams to the front page of RS twitch. I wouldn't be surprised if it's the same guys who pivoted to crypto to target much more foolish victims.

That existed before MMO (Diablo parody)

https://www.youtube.com/watch?v=qPsxIqawYpo

>Ironically a smart contract is probably the safest way for a customer to engage in a doubling scam.

Press F [0][1] to doubt.

[0] https://arstechnica.com/information-technology/2021/12/hacke...

[1] https://www.zdnet.com/article/poly-network-hackers-potential...

Are you just trying to say the smart contracts can have bugs in general?

It's trivial to write a bug free money doubler smart contract. The logic needed is VERY simple.

If somebody is smart enough to verify that a smart contract does what it says on the tin, they should be more than smart enough to realise that crypto doubling is always going to be a scam.

The idea is that it is possible to set up an actual doubler smart contract that is not a scam. Sure it's not profitable to do, but it is a little funny.

It's hard enough for most people to read a contract written plain English. How do you expect to read one written in code?

To me, this (together with the fact that software will always have bugs) is why smart contracts are a very bad idea.

An earlier post seems to provide more context, https://scaminvestigations.substack.com/p/better-than-ransom...

That still doesn’t explain the scam.

They explain it in the first paragraph.

There’s no more to it than the name essentially. A scammer gives an address and says that if you send crypto to that address, you will receive double the amount you send back. Then they keep the money you send.

I’m sure they dress it up, maybe they actually fulfill a few or they have shills that claim they did, but it’s really not more complicated.

It’s classic “if it sounds too good to be true…” stuff.

Holy shit it really is the classic Nigerian Prince scam.

It's so dumb you probably missed it:

> The scam takes many forms... promising to double Bitcoin sent to an address... But of course, the promised doubled crypto never comes, hence a scam.

I've reported these on YouTube yet they're still being recommended to me hours later. Clearly they're incapable of moderating their own platform. What's it going to take for them to start taking this seriously?

Genuine question: Does anyone here have a good sense of how easy/hard it is to moderate a platform like YouTube? My sense is that the answer is VERY HARD, so I tend to give them the benefit of the doubt when things go wrong. But perhaps I’m being too generous. Is this something that could be prevented if YouTube just tried harder?

Yeah I see just as many complaints about unfair takedowns. At their scale, I think it’s a little more complex than people want to admit.

YouTube could at least make it harder for scammers by not promoting streams through the algorithm or at least not showing them unless there's a subscription. I would also argue that they shouldn't just give everybody the ability to livestream at first given how many of the scammer accounts are new. That strikes me as a common sense solution.

If both were implemented I suspect these sorts of scams would no longer be worth the effort.

>I would also argue that they shouldn't just give everybody the ability to livestream at first

They don't. You have to verify your channel first using a phone number.

Here's an easy solution: only allow people who have proven their identities to have videos promoted by YouTube's algorithms, so they can be held legally liable if they publish videos that break the law

Then people will complain the recommended videos are not as related as before and/or they only promote corporate entities who will verify

It's basically impossible to do it right - when you have such a wide audience, every single decision you make will upset potentially millions of people, be illegal/legal in some parts of the world, will impact both good and bad actors, etc. And you have to relay on automation a lot, as it's not cost effective to have meaningful review by humans.

But that brings obvious follow up question - should then such a big platform exist? IMO, even with all those problems - yes. Being able to easily share content with people around the world is and remove barriers for acquiring knowledge is a huge advancement. But I can totally see people disagree with that.

This seems like quite a low effort investigation that also just assumes all transactions are victims.

My guess is that throughout the live stream they would have shills in the chat LARPING as genuine viewers sending their crypto and successfully receiving the reward, so a lot of the TXs would be from the scammers themselves used to fool other sheeple.

This could make sense if there were outgoing transactions but they are all incoming.

Whoever said "Traditional financial systems are rigged with fraud! Crypto solves this" RIP

Until the days people are gullible, any amount of tech doesn't solve the problem. Even worse, most people don't understand the slightest of how crypto works and will be easily rigged in crypto world!

I think you accidentally a word at the beginning of your second paragraph, but it's also worth considering that keeping people gullible and trusting is unfortunately an implicit goal of a lot of (non-scam) companies too. It's much easier to sell things to people who are easy to persuade and convince.

But crypto doesn't solve that. In fact, it worsens it, making people believe a fairy tale of lazy wealth.

How does the scam work? They restream copies of my livestreams: https://YouTube.com/RichardHeart, And put a frame around it with a send 1 coin get 2 back giveaway. It's truly sad when I receive direct messages from those who have lost their life savings. And the worst part is, usually in life, hearing about free money is an obvious warning, but in crypto, there truly is free money, and all the time. Bitcoin guys got free BCH, and if they held, BSV, and byteball, and bitcoin gold, and xlm, and xrp, and HEX. Airdrops happen all the time. So it's this weird edge case, where as stupid as send one get two back sounds, in crypto.... It's sometimes almost plausible.

It would be nice to know what the scam entails.

Send me your coins and I'll double them.

Except that's exactly what some popular staking/liquidity pools promise, just in slightly more time.

So, when do enough scams on people choosing to participate go from being their problem, to society's problem? And when do we all start to have to pay for this at some point? Because I have a feeling we will, even though I have no idea why.

For example, drugs have a systemic effect on society, but crypto losses generally do not, so the reluctance to crack down on crypto scams unlike other crimes. Someone sending $50k to fake Saylor is not like 50k in the pockets of narco gangs.

I think the same would apply about casinos and gambling, yet those have had to be regulated in the public interest.

A family member lost $3k to this. YouTube promoted a real looking interview with the founder of ETH, high production value, saying they will double your ETH etc.

When most of of crypto users are poor and less educated they tend to be targeted…

Yeah like crypto or not, why would you be paid instantly for doing nothing ? $3k is a month or more of work for most people, did that person really believe the world lied to him and instead of working a month, he could "double" it immediately ?

They probably did. It's because they've heard of other people getting rich off of crypto. The classic get rich quick swindle. Ponzi schemes and all sorts of other marketing schemes are also similar.

Seems insane, but it's essentially no different from any other kind of gambling. Suspecting that the game is fixed doesn't stop a lot of people from betting the house regardless.

You would basically need to appoint a guardian to manage the affairs of these people to prevent them from being scammed.

Victims already fell for the first part of the scam, buying into crypto without first understanding what it is.

Here's where the problem sits.

There's this list of 50 giveaway scam websites currently active: https://pastebin.com/raw/NmTQQq3C

Most of the sites in that list were found from these Youtube videos (discovered with the help of crowdsourced labor, thanks to Microlancer.io). Many of these websites were registered just recently.

It takes about 15 minutes of labor on average to complete the procedures (from a Proof-of-Concept) to archive and submit takedown requests for each of those. That's 15 minutes more per site than the author of this post wishes to allocate, uncompensated, at the present moment.

Link to a writeup on the Proof-of-concept: https://bitcointech.medium.com/eradicating-giveaway-scams-no...

Tomorrow there'll be a dozen or two new additional sites to add to this list. The day after, another dozen or two.

Anyone have any suggestions as to how to combat this problem?

For the past eight months, a proof-of-concept (PoC) has been underway. In that time, this PoC has taken down nearly 1,500 websites.

After the first hundred or so takedowns, it was determined that there would be no easy and effective method.

Eradicating Giveaway Scams — No Easy And Effective Method Found

https://bitcointech.medium.com/eradicating-giveaway-scams-no...

99% of crypto enthusiasts are in the game because they think it's a get rich quick scheme. It's only natural that a significant subset of them would be attracted to such scams.

I've reported so many of these. Every time there is a SpaceX launch these fake videos fill up my recommendations from "ElonMusk" and "Space X"

This is a shitty post. No description of the scam itself and incorrectly asserts that YouTube giveaways generate permanent consistent income for a single group.

How does it follow that 200k over 12 hours => ransomware is less profitable. Are all 14 transactions victims? Are all 14 transactions paid to the same actor?

It's because it's obvious: they are "double your bitcoin" scams: you send them, they double it back. It's as old as digital currency transfer, themselves much older than bitcoin. I remember doing that in Eve Online.

I saw a few of livestream scams happen real-time so let me explain what I saw. I didn't see it on YouTube but I saw it on Twitch a few times and I never saw anyone mention it before.

Short answer is it's an evolution of the Elon Musk Twitter scams where people are told to send crypto (Usually bitcoin) to an address to double it. The main difference than the traditional scams is with livestream you have an audience - the chat.

Tens of thousands of viewbots to bring the counter on the livestream high and then the chat is flooded with chat messages but fake accounts that I can see how people could think they were real. Things trying to convince you that it is safe, that it worked, and even talking with each other asking how easy it is. It doesn't matter if the account is banned after 20 minutes or more, it's already done the damage.

First time I saw this was about ~6 months ago. It was a fake account with a similar name for a Dota streamer. They had fake footage of the game and I was pretty shocked. It had something like 10,000 viewers and after reporting the channel it was still up for a while.

Other times I've seen it with Elon Musk with footage of the Tesla plant talking to a reporter about crypto. I can see how the voices can be fakes as well and how much potential it can have when combined with the chat. These were up for less time.

I watch some live Fortnite on Twitch from time to time before falling asleep as I sometimes play with my son. Now I am a natural skeptic but I'm actually a little embarrassed to admit it, but a Twitch one of these scams actually had me for a few minutes. I don't own any crypto but it actually had me searching for the best way to get some bitcoin fast as I didn't want to miss out on this gift from Elon. If I actually owned any crypto I might have fallen for it fully, it was that good of a trick. It was so good I told some my wife the next day I saw one of the best scams in a while.

It was exactly as you described - with Elon Musk looking like he was "live" and the chat was busy and full of people saying "it worked for me. Thanks Elon!" type stuff. Even the channel had used ElonMusk in its name. I honestly thought I was just lucky and happened to catch a billionaire, who is also a known crypto supporter, being generous and trying to get more people into crypto as well by giving some away to the lucky few who caught him live.

What stopped me obviously is me not actually owning any crypto and not being able to get some instantly and without large fees, but also a few things that didn't feel right in the gut. Like the channel was something like "ElonMusk3239". I thought "surely Twitch would make sure the real one didn't need to have the 3,239th account with his name".

Also the website the link directed you to in the chat looked a little to simple and supposedly showing in real-time all the lucky people getting double along with all the crypto addresses - ALL without any sort of signup or verification, etc. You just submitted everything right there and boom you would get double back. Reminded me of those "free VBucks" website my son has come across before.

The final reality was when the channel got taken down while I was watching and another popped up within a minute in the Live Chat area again but with another ElonMuskxxxx name. Then that would get taken down and again another popped up. That is when I realized Twitch was currently in a battle with some group trying to scam crypto.

Definitely one of the most realistic looking scams I've seen in a while.

Be nice if they specified what the scam is so I don’t become an unsuspecting victim.

I've seen a even more sophisticated one involving one coin. It had a very likely deep faked video of the founder who disappeared a while back trying to pump up the coin.

All of this hell has broken loose due to youtube hiding dislikes

This has been a constant thing for way longer than that.

I don't understand how anyone can be cutting-edge enough to be into crypto and know how to send a transaction, yet not also know how to spot a scam in the year 2022.

You mean the people who ‘invest’ in crypto without fully understanding it fall for other get rich quick schemes? No way!

Hm, yeah, I guess that take makes sense too.

Oh wow, I had a reality-check of this a couple weeks ago when someone casually mentioned "investing into bitcoin" as something to do with a couple of thousand dollars at hand. And everyone agreed. In a group of people that are completely removed from the usual tech nerds.

I fear crypto hasn't been cutting edge for years. I still don't quite take it seriously, but apparently it is normal now.

It isn't cutting edge anymore. Relatives of mine without computers (old ones) have asked about investing in it. Everyone knows about Bitcoin.

cryptocurrency exchanges have TV ads and buy football stadium branding ("crypto.com arena") and are easy to access. It's not a cutting-edge thing anymore.

"There's a sucker born every minute."

All you need to buy crypto is a credit card. Nothing cutting edge about it.

Surely there is a mechanism in these technological marvels which are cryptocurrencies to get the money back?

Bring the scammer before a judge. The same as when anyone scams you out of cash or gemstones or electronics.

"I put a ruby in a box and shipped it to Nigeria because an email told me to. How do I get it back?"

It's not a new problem.

I think 100% irreversible purely online/digital transactions are a bit of a new problem? If you wire transferred money to a scammer's bank account it won't be easy getting it back, but if you realize your mistake soon enough you at least have a chance. For example, it's possible to to get the receiving bank to hold the money pending an investigation. With a crypto transfer there's no higher authority to appeal to. (which has pros and cons)

My understanding is that it is effectively impossible to reverse a wire transfer (except when your bank screws up, such as sending the wrong amount, in which case they will reimburse you). You will be told to go to the police.

I'm also not aware of any bank that will allow some random person to call them up and freeze an account, even if they just wired money to that account.

Ofc there are ! There are 3 know authorities that sometimes intervenes that we must regulate and centralise more:

- Tether, which is reasonable enough to block transaction of known stolen USDT

- Exchanges who can reverse transactions if they havent left the exchange and are very monitored these days

- Miners, who can fork or reject an address if needed, something they dont all do because they're themselves not exactly loved by the country they suck energy out of

We need to switch away from decentralized currencies and move to a model of monitored USDT: that would allow the public to access every transaction of every actor, with the ability to block publicly criminals.

Weirdly crypto opponent focus a lot on decentralization but I don't think it matters as much as they think, while crime prevention is clearly more needed if people fall for "double your bitcoin" scams.

I think you mean it has cons and cons. We are discussing cons, after all.

It's pretty much just "mail fraud, but on a computer." Banking transactions are the exception, not the rule. Most ordinary transactions aren't reversible by a central authority. You traded your baseball cards for some magic beans, well, enjoy your magic beans.

People intuitively understand that they shouldn't put a stack of twenties and hundreds in an envelope and hand it to a stranger in a ski mask who promises to pay it back with interest overnight.

But people have been taught that electronic money transfers are risk-free with chargebacks and insurance, so they think that if this is a scam, it'll be the bank's problem.

You wanted to be your own bank, guess who's problem it is now.

The real problem is that people don't understand that, so they do with their Bitcoin what they would never do with their jewelry.

Sorry, it was a bad attempt at sarcasm.

i haven't done my own analysis on this yet, but a lot of times the scammers will send funds to the scam accounts to make it look more legit. The elon musk youtube scammers are horrible people, but I'd be surprised if 200 million was the actual amount stolen

If they wanted to fake it they would fake outgoing transactions.

The author says Twitter cracked down on this. But every time Elon musk tweets the first reply is a Bitcoin scam. If you click on any super popular person there’s a reply for sole Bitcoin scam.

IMO it’s only got worse on Twitter, not better.

crypto scams in general are out of control.

Crypto scam is redundant.

So, how does the scam work?

If it's like other crypto giveaway scams it works like this:

Twitter account impersonating some celebrity, e.g. Musk: "to show my love for crypto, I am giving some away. Send bitcoin to <some address> and I'll send double back!"

Replies from other Twitter accounts controlled by the scammer: "wow, I had my doubts but I sent some money and got double back. Now I'm rich. Thanks Musk!"

Marks: send crypto to that address and never get anything back.

AKA the EVE Online Jita chat scam.

People usually try with a small amount first. They might get that small amount back - which "confirms" they are getting something back. Then they send a larger amount.

its astonishing that anyone would fall for this...

why do people still fall for this?

why did people ever fall for this?

greed

There are mentally challenged people in this world who deserve your sympathy when falling for scams. Do not scorn them for greed, a trait with which many are afflicted, regardless of mental capacity.

“A fool and their money are soon parted”

Crypto stinks and that's why I don't wanna touch it with a ten-foot pole. I lose respect for any company, which sprinkles some crypto into their service to make it look cooler when it actually makes it stinkier.

Reply on news.ycombinator.com