A certificate screenshot is not a license. Guaranteed daily yield is the red flag. The domain is on our blocklist.
SEC-style certificates shown in posts — claim of the material, NOT verified
No company, CNPJ, deposit address or Pix key found
facebook.com/permalink.php?s…
UZEX / EM Investment (Facebook, Nov 5-6, 2026)
Site: uzexop[.]com
Pitch: guaranteed 1%/day from US$500; claimed 50-55%/day; leadership bonus >US$30,000/month
Promoter: EM Investimento - Portugal
Guaranteed 1% a day from $500. Claimed 50–55% daily returns. Leader bonuses over $30k/month.
The Facebook pitch flashes SEC-looking certificates for "UZEX INC" and "EM INVESTMENT GROUP INC."
Those weren't verified. The yield doesn't need to be.
Details in the next reply.
IG accounts in the wave include:
@poppys62.440 @charlotteedw60 @nina.xasizob_
@thesophia.m.56 @harpercox1852 @deborah390978
Musk and the BBC are impersonated, not involved.
Fake Elon Musk/BBC giveaway wave (Brazil IG, Nov 5-6, 2026)
Domains: comusk[.]com (code MUSK, US$12,500) and octorax[.]com (code OCTO, US$1,500)
Same family as kovexplay[.]com / dotexplay[.]com / dolexplay[.]com (code ELON)
instagram.com/reel/DfZVFIRxo…
instagram.com/reel/DfZ4SAzsH…
A fake BBC clip. "Elon Musk" handing out cash to new crypto investors. Nine Instagram accounts in two days.
This time the domains are new: one code is MUSK, another is OCTO. Same playbook that already burned Kovexplay, Dotexplay and Dolexplay.
Details in the next reply.
MetaMask staking fee-recipient diversion (incident Sep 28, 2026; Nov 5 update)
~0.385 ETH rewards diverted; Tornado Cash-funded recipient
0x98B9231de84334c1d48BA0b72CF13f92484924A3
metamask.com/news/user-updat…
protos.com/metamask-unstakes…
Not the wallet. The staking fee pipes.
MetaMask says unauthorized access to staking infrastructure diverted about 0.385 ETH in rewards. Validators are exited. User wallets and staked principal look untouched — but the diversion address is public.
Addresses in the next reply.
Relay: operator wallet blocked
teapawt.net/theczarlos/status/2118…
basescan.org/address/0x2405C…
about 10 minutes ago one of my old hot wallets was drained
this looks like an industrial-scale attack by noble.base.eth (using 0x7028174ED69A237DE0791101b5b85D1E6Db35887)
my current hunch is that this is linked to the @Railway exploit
Railway-linked hot-wallet drains (Nov 5, 2026)
96 Ethereum wallets drained ~70 min from 16:11 UTC; seed/key theft pattern
Operator (ETH/Base):
0x7028174ED69A237DE0791101b5b85D1E6Db35887
Funder / noble.base.eth (Base):
0x2405Cf271723901e0020D59c2405f239151c9221
96 wallets. Seventy minutes. Same signature: the victim's own key.
Definitive's growth lead watched an old hot wallet empty, then mapped a drain wave he ties to noble.base.eth. Relay blocked the attacker. Railway link still a hunch.
Addresses in the next reply.
Guaranteed daily yield plus a hard 500% cap is a classic HYIP clock. The domain is on our blocklist.
MEXCOL, Facebook (Nov 4-5, 2026)
Site: mexcol[.]co
Plans: BROZONE / GOLD / PLATINUM
Daily ROI 1.0-4.0%, Direct Income 5-8%, max return 500% (min US$50)
Promoters posting masked BTC withdraw "proofs" (bc1…*****)
No company, CNPJ or complete deposit address found
1% to 4% a day. Max return 500%. Plans from $50 to $50,000.
That's the Facebook pitch for a platform called MEXCOL, complete with screenshots of "completed" BTC withdrawals.
The withdrawal addresses in those proofs are masked. The daily yield isn't.
Details in the next reply.
Collectors (TRON):
TNJPXRWEptdSzbC1pYGp8suyTao4qddJe6
TEDjNzXWsTrRcHmRnGPPqGRmqCmrA1vvGZ
TXgDHFfNia3PmJKM5u5U35ePDku7TUV6Xo
TEdbrs5teWWyzAtP639fRAX2yKNPCSMqJe
JustLend route:
TWUPpTF63yevhZ55eoN6CbDodZzgp856n4
TZ7soEw5nn5mvC9k5pNszB74261Hjotfbf
bitquery.io/investigations/i…
iPhone DarkSword / Safari seed-theft drains (Oct 5–Nov 4, 2026)
≥$4.06M USDT from 365 TRON wallets; ≥$103K more on 8 other chains (Bitquery)
Fee wallet (TRON):
TUYFAa8hHjeEW6bPqBJ4v3RjQR2uKM1Svk