A few days ago a single victim lost about 850K in DEGEN tokens.

Apparently, DEGEN is a community token for the Farcaster social network. I'm guessing the token is similar to what MOONs once were on Reddit.

• Victim wallet - 0x5ea86da791f30c233c70e55be744b74a0e0cc2c3 - 850K Degen VICTIM
• Scammer wallet - 0xc7aba6484782bb9e187a1de73d50fff649344bb5 - 850K Degen Scammer

A DEGEN Scam

This was a clear phishing scam.

According to Scam Sniffer, the attack vector was a malicious ERC20 Permit Signature. Someone phished users through fake DEGEN ads in Google.

Above is what one of the fake Degen Google Ads looks like. Thankfully the ad is removed but the damage is done.

I followed the transactions and came across two wallets holding a total of about 2.6M ETH in stolen funds. So far those two wallets have not interacted with any exchanges.

• 0xED7827cd7Fc27888CDd0C00E91ACc7Ce1C9463b7 - 850K Degen Scammer 2 (1.4M)
• 0x7d068e0a946eE885Ed1aE07D8629a59364259a92 - 850K Degen Scammer 3 (1.2M)

Additionally I found a few other outgoing interesting wallets.

• 0x7C9EB6dF2349820D27D69805193d7806A7689ade - fatfee.eth (Wallet of interest)
• 0x9e483b96e18473E062588423ab4b852522291Ae3 - 850K Degen Scammer 4
  • 0xf6e2EAd0146Cf84ABCe7549282985fBFa257A516 - HTX Deposit

I would monitor these for future movement to deposit addresses. About 1.1 ETH went into 850K Degen Scammer 4 where it was sent to a HTX Deposit address.

I found a telegram and Github for 0x7C9EB6dF2349820D27D69805193d7806A7689ade - fatfee.eth

Apparently he acts as a middle man taking a 5% cut for his services. I can see this wallet connected to a number of hacks and scams.

He posts all over Blackhatworld offering mass DM services for Twitter and Discord and proxy servers.

Above is a look inside 0xc7aba6484782bb9e187a1de73d50fff649344bb5 - 850K Degen Scammer. About 2M in ETH flowed to 0xED7827cd7Fc27888CDd0C00E91ACc7Ce1C9463b7 - 850K Degen Scammer 2.

I also pulled out another victim who lost about 1.2M in the AERO token. Yikes!

There's some tiny deposits of about $60 into a couple of ChangeNOW deposit addresses. Presumably those were used to buy proxies or pay for some other small service.

Scamception!

Unfortunately, most phishing scammers who successfully steal millions through innovative tactics have been doing it for a while. It's common to link other scams and hacks through the same bad actor based on common wallet addresses

I noticed 0x9E09Dc51ad3B33464093F5505b81bc96E2eccDe0 - 850K Degen Scammer 3 FUNDED 1 sent 0x7d068e0a946eE885Ed1aE07D8629a59364259a92 - 850K Degen Scammer 3 about 1.04M in ETH on April 7th.

Above is a look inside 0x9E09Dc51ad3B33464093F5505b81bc96E2eccDe0 - 850K Degen Scammer 3 FUNDED 1. There's currently about 3.4M stolen ETH in this wallet.

A few months ago I posted about another phishing scam where 1.7M+ was stolen in about 3 days. Here's the link to the post - https://www.reddit.com/r/CryptoCurrency/comments/1ajx16d/17m_stolen_in_3_days/

I found direct connections to the above Zerolend phishing scam and this one. The below wallets link to a user I found providing an escrow service to Phishing Drainer Groups.

• 0x86e9F9802c261e5cC0f4B839E04C2200293eefF4
• 0x8df8F914419eaCD304578d8bA6FA6316Fd07a58A

Both of those wallets also interacted with 0x7C9EB6dF2349820D27D69805193d7806A7689ade - fatfee.eth.

Lastly, a quick twitter search of 0x9E09Dc51ad3B33464093F5505b81bc96E2eccDe0 - 850K Degen Scammer 3 FUNDED 1 brings up yet another scam.

The victims posting on Twitter appeared to of engaged with a fake Blur NFT scam back in late January.

​

​