⚠️JUST IN: A crypto whale’s multisig was drained of $27.3M following a private key compromise.

The victim’s private keys were compromised during and after the creation of the wallet. Shortly after depositing $27M+, all funds were drained and laundered through Tornado Cash in 100 ETH ($311K) batches.

@scammed / @DWCusers

⚠️UPDATE: The drainer has laundered $12.6M (4,100 ETH) via Tornado Cash and still retains roughly $2M in liquid assets.

The drainer also maintains control of the victim’s multisig, which currently holds a leveraged long position on Aave, with $25M in ETH supplied against $12.3M DAI borrowed.

@scammed / @DWCusers

⚠️JUST IN: North Korean state linked hackers stole over $2B in Bitcoin and crypto this year.

DPRK linked actors accounted for 76% of all service level compromises in 2025, the highest share ever recorded. The largest single incident was the $1.4B Bybit hack.

@scammed / @DWCusers

⚠️JUST IN: On Dec 18, three suspects invaded the home of a cryptocurrency investor in La Rochelle, France at around 5:00 AM, stealing €8M in cryptocurrency.

The investor and his partner were held hostage and threatened before being forced to transfer their cryptocurrency to the attackers. French authorities have opened an investigation and no arrests have been made yet.

@scammed / @DWCusers

⚠️BREAKING: A victim lost $50M in Ethereum assets due to address poisoning.

The victim first sent a $50 test transaction. Shortly after, a lookalike poisoning address appeared in their transaction history. When preparing to move the full $50M, the victim copied the wrong wallet address and transferred all funds to the attacker.

@scammed / @DWCusers

⚠️BREAKING: Coinbase posted on X that Ron has been charged for stealing $16M+ through social engineering as Coinbase Support.

This appears to be the first time Coinbase has publicly acknowledged a specific threat actor who social engineered victims to steal cryptocurrency, sharing details of his arrest and an official press release.

@scammed / @DWCusers

⚠️UPDATE: The victim who lost $50M in ETH after copying and pasting a malicious wallet address has sent an official on-chain message to the attacker.

A criminal case has been filed and all wallets linked to the theft are actively being monitored. The victim has also offered a $1M reward if the funds are returned.

@scammed / @DWCusers

⚠️JUST IN: Coinbase CEO Brian Armstrong shared a mugshot of notorious caller “Ron,” who stole over $16M from Coinbase users.

Ron was one of the longest-running callers, stealing $16M+ across 100 victims via phishing and social engineering. Following his arrest, authorities only recovered $500K of the funds and placed him in jail with $1M bail.

@scammed / @DWCusers

⚠️JUST IN: Notorious OGU member @shade has exit scammed 4 users for $250K+.

Shade has unlinked his username and moved the ~$250K into a freshly created wallet. Funds are expected to be routed and laundered to obfuscate tracing.

@scammed / @DWCusers

⚠️JUST IN: Another victim lost $86,000 after copying the wrong address from a contaminated transfer history.

The victim sent a $10 test tx. Shortly after, a lookalike Ethereum address sent $0. After copy pasting the address, believing it was theirs, the victim sent the full $86,000 to the attacker.

As shown, the bottom two wallets match at the start and end but are different wallets.

@scammed / @DWCusers

⚠️JUST IN: A crypto whale’s private key was compromised, with approximately $2.3M stolen.

Both of the victim’s wallet private keys were compromised, with $1.8M and $500K stolen across two wallets. All funds have since been swapped to ETH and deposited into Tornado Cash.

@scammed / @DWCusers

⚠️JUST IN: Binance founder CZ commented on recent address poisoning scams following a user losing $50M after copy pasting the wrong wallet address.

CZ stated this is a blockchain level issue, not a user error, and said wallets should automatically detect whether a receiving address is a known poison address and block the transaction before it is sent.

@scammed / @DWCusers

⚠️JUST IN: A major U.S. food delivery provider, Grubhub, was exploited via a phishing email campaign promising to “double” users Bitcoin.

Grubhub users received emails and in app notifications directing them to send BTC to attacker controlled wallets, falsely claiming the funds would be returned at a 10x multiple.

@scammed / @DWCusers