1/ This scammer is using leaked Coinbase customer data to spam out fake SMS text messages to users. I could dox the scammer right now but I'd rather conceal his identity until he is brought to justice! Let's give you an inside look into the scammers perspective and workflow.
2/ Earlier this year, my team and I noticed a massive spike in social engineering attacks mainly aimed at @coinbase and @binance users Reddit and X were flooded with screenshots from victims targeted by these social engineering scams.
3/ Typical scam wording to look out for. 1. A withdrawal request was made on your account 2. Your password was reset 3. A suspicious login attempt was made on your account The scammers will always add a sense of urgency and provide a support number telling people to contact
4/ I won’t go into full detail about how I accessed the scammers' systems, as I plan to use some of these methods in future investigations. I’ll also keep things censored to avoid alerting the scammers. (I’m probably monitoring their computer screens as you are reading this)
5/ I gained access to the scammers computer system and I immediately noticed that the majority of these groups mainly communicate via telegram.
6/ The scammers use PBX systems like @FreePBX and @bitrix24. These systems help the scammers spoof their phone numbers which ultimately enables them to impersonate Coinbase and Binance support.
7/ Lead lists: The scammers purchase stolen customer data from various telegram vendors and dark web resources. (5k COINBASE US2) (100K_USA-gemini_sample) (5000_PCS_LEDGER_USA)
8/ The scammers heavily rely on ChatGPT to format and convert the victim data into plain text numbers….Obviously without any consideration for user privacy. ChatGPT will separate victim phone numbers and then load the data into a .TXT file. The scammers then take the output
9/ The scammers communicate with someone on telegram who provides software to blast the victims with fake messages. (This is a screenshot from the scammers backend side of the admin panel)
10/ These are some hilarious messages sent back to the scammers as a result of the spam.
11/ Even though these chats make it seem like people don’t fall for this scam, the reality is very different. Scammers still manage to trick multiple people every single day. (Screenshots taken from google for example purposes)
12/ If they get someone to believe the initial pitch, they move on to the next step by messaging a telegram bot called @spoofmailer_bot. The bot will email the victim, spoofing off of "help@coinbase" The email also contains instructions for a so-called “recovery process,” which
13/ We're in the middle of an active investigation and while I’d love to expose the scammers, their structure, and their private group chats, I have to be careful with what I say here. These scammers aren’t just stealing, they’re actively celebrating when victims get drained,
14/ Most of this happens in invite-only group chats, but we've managed to gain access to the computers of some of the admins involved. We can see the phone calls, chat logs, wallets, live audio of ongoing scams, and so much more. That being said, if I reveal too much right now,
@NanoBaiter Just got that fake text!
@Alex_Ambroz Yep. They are blasting people all day!!!
@NanoBaiter Didn’t they just offer $20M for this info??
@GPU_Yantzer These scammers aren't related to the recent ransom attack against @coinbase but they purchase leaked Coinbase data to spam the SMS texts. We suspect they are buying the data from various telegram vendors. My team and I are trying to figure out where the data is being sold.
@NanoBaiter Almost fell for this one. Checked my Coinbase account and it wasn't drained so I carried on with my day
@arjan_sanders I'm glad you checked your account and avoided the scam!
@NanoBaiter Always interesting to read your investigations.
@oldengold Thanks for reading @oldengold!
@NanoBaiter They trying to scam me too with a text message. Funny part was, I don’t even have Coinbase. So if I reply, what might happen?
@twickettwat I wouldn't reply from your personal phone number (Safety reasons) but you can set up an account with @TextNow and give these scammers a piece of your mind lol https://x.com/nanobaiter/statu...
@NanoBaiter I need to know on thing. I was scammed by an investment company. Then I was scammed 2 times by recovery agent. Is it possible to recover your money after getting scammed or is just they are scamming people in disguise of recovery agent.
@Alwaysheru All of these people in the comments recommending someone to help recover the crypto are trying to scam you.
@NanoBaiter Is this coinbase support?
@Alwaysheru That's 100% a scammer and not the real coinbase.
@NanoBaiter Why the fuck don't you understand that doxxing or reporting Indian scammers ain't gonna do anything, they'll just pay the police and continue. Heck some of them even work with police support. I appreciate your skill and but it ain't gonna do shit in this corrupt country.
@mrparziwal This scammer is not indian but actually based in europe.
@NanoBaiter Get em Nano 💪🏽🫶🏾
@NanoBaiter Great investigative work 👏
@jamesb_bsc I appreciate the support @jamesb_bsc!