CryptoINT_Researcher (@CryptointR) profile picture

CryptoINT_Researcher

@CryptointR

Posts warning about cryptocurrency related scams

Joined February 2020
  • Tweets1.1K
  • Following133
  • Followers86
674Media
Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)Photo by CryptoINT_Researcher (@CryptointR)
1/3 🚨 Newly registered phishing domain impersonating @binance Vault: 🌐 Domain: liveness-binance[.]com 📅 Registered: 12 October The site serves a single-page application built to harvest credentials and siphon crypto assets. Technical breakdown 👇 @BinanceHelpDesk
Image from CryptoINT_Researcher (@CryptointR)
Image from CryptoINT_Researcher (@CryptointR)
1
70
2/3 🔍 Attack Flow: • Access Gate: Demands 6-digit code or auto-bypasses targets via ?sessionTransfer= • Seed Harvesting: Steals 12-word recovery phrases via /api/vault/restore-seed • Spoofed Dashboard: Fakes incoming balances and sets withdrawal hold timers to trap funds.
1
44
3/3 🛠 C2 & Live Social Engineering: The site connects back to operators using real-time WebSockets (/ws) with an SSE fallback (/api/vault/events). Operators track victim activity via /api/vault/audit and can dynamically trigger live chat or fake KYC popups to manipulate victims.
19
🚨 Phishing & Web3 Alert: EIP-2612 USDT Drainer on Arbitrum One usdtverify[.]online Phishing lure masquerading as an official "USDT Verification" page. The campaign leverages off-chain EIP-712 Permit signatures to steal funds gas-free without an upfront on-chain approve() alert
Image from CryptoINT_Researcher (@CryptointR)
1
1
281
more replies
Attacker Spender:0x464a32310881825508993415E21f58F0CA0C9C16 Target Token (Arbitrum USDT):0xFd086bC7CD5C481DCC9C85ebE478A1C0b69FCbb9 Exfil Channel ID: 1471216429197164617 Hosting Platform: Netlify (Site ID: 77482f08-ea9e-4f27-9611-8d8225934da3)
1
35
@realScamSniffer @PocketUniverseZ @blowfishxyz @CertiKAlert
28
1/7 🧵 Fake @Ledger Proposal Drops ScreenConnect via DocuSign Decoy A Web3 phish on ledgerproporsal[.]com lures targets with a fake proposal. Runs a real DocuSign installer as a decoy while silently installing weaponized ScreenConnect RMM backdoor. 👇 @Ledger_Support
Image from CryptoINT_Researcher (@CryptointR)
2
1
1
968
more replies
6/7 🛡️ File Hashes (SHA-256) • ZIP: 39438314580cd65e73c02d664df8183e218ec409021b327aff317df4c584fbec • BAT Dropper: 1abf3f6ac62e8f1f390ecf062a9a154c10eaf3a2c8f2b962ad02e37e5a6ddab9 • ScreenConnect MSI: c0fb7911a2ca099632e39172a5dce9356d4aa960afa5b90bc8479bc31a6793e5
1
86
7/7 🌐 IOCs • Lure: ledgerproporsal[.]com • C2: vitmass[.]com • IP: 188.253.11.18 • Cert CN: FRZGNU0NTD6EDPD.549121
32
🚨 SCAM ALERT: XRPL wallet drainer targeting @XamanWallet • Domain: ledger-allocation[.]app • Lure: Spoofed "Xaman Airdrop / XRPL Allocation" • Vector: Malicious Web3 modal targeting Xaman, WalletConnect, Ledger, Crossmark Triggers malicious signing payloads to drain assets
Image from CryptoINT_Researcher (@CryptointR)
Image from CryptoINT_Researcher (@CryptointR)
Image from CryptoINT_Researcher (@CryptointR)
166
🚨 SCAM ALERT: Campaign impersonating @Ledger_Support with a fake "2026 Exploit" advisory claiming $150M in losses. • exploits2026-ledger[.]app Lure: Claims older @Ledger devices have weak-entropy seeds via a fake MicroPython/Yasmarang bug to push a "risk scan."
Image from CryptoINT_Researcher (@CryptointR)
Image from CryptoINT_Researcher (@CryptointR)
Image from CryptoINT_Researcher (@CryptointR)
2
1
3
3,709
The scam flow: Prompts hardware selection (Nano, Flex, Stax) Simulates a failed connection Triggers "Use alternative method" Prompts manual entry of 12, 18, or 24-word recovery phrases
Image from CryptoINT_Researcher (@CryptointR)
Image from CryptoINT_Researcher (@CryptointR)
288
Load more