This Week in Crypto Fraud - 01 July 2022 (#4)
This week in Crypto Fraud focuses on each weeks developments in crypto asset crime, fraud and investigations.
This week has seen Ruja Ignatova AKA Cryptoqueen added to the FBI Top 10 Most Wanted for her role in the OneCoin scam, further reporting on so-called ‘Pig Butchering’ frauds and a rise in Celebrity endorsed cyber frauds in the UK.
We can’t cover everything so just the most interesting or noteworthy highlights, with some general reporting. Check out our recent in-depth review of the Axie Infinity hack.
RUJA IGNATOVA added to the FBI Top 10 Most Wanted
(US FBI - https://www.fbi.gov/wanted/topten/ruja-ignatova)
The FBI have added Ruji Ignatova to the Top 10 Most Wanted list. Ignatoa has been reported as the ‘Crypto Queen’ for her involvement in OneCoin a major $4bn crypto fraud.
Further details are available in the US indictment which sets out the various charges.
Notes for investigators
There are limited public reports on Ignatova and her associates. She is likely still wealthy and accessing banking facilities through associates or other means.
The FBI report includes that she may travel on a German passport to the United Arab Emirates, Bulgaria, Germany, Russia, Greece and/or Eastern Europe.
During the scam victims moved money into accounts under the name of OneCoin Ltd in various jurisdictions.
Pig-butchering or Sha Zhu Pan continue
(Financial Times - https://www.ft.com/content/b325b37a-ae62-4af1-ba56-568598d2dbe7, Metro - https://metro.co.uk/2022/04/17/in-focus-from-fraud-to-pig-butchering-the-dark-side-of-crypto-16416504/ and APB Live - https://news.abplive.com/business/crypto/crypto-romance-scam-pig-butchering-what-is-it-how-are-scammers-reaping-millions-on-silicon-valley-dating-apps-avoid-1535378)
“Sha Zhu Pan” (殺豬盤) romance scams prey on those looking for love to deceive them into sending crypto currency.
Fraudsters find their victims on dating apps or websites, moving the conversation onto messaging apps such as WhatsApp. These scams are sometimes regionally or ethnically focused such as against Chinese-speakers.
The fraud sees the ‘pig’ being ‘fattened’ over a period of weeks or months before the fraudster leads them into making a payment of cryptocurrency, a fake cryptocurrency investment or other payment.
Scams often follow a similar process. First presenting themselves as a wealthy and attractive business person. Then grooming their victims with daily messages and communication, before pressuring them into making investments or payments in cryptocurrency. Finally the fraudster cuts off all communications.
Notes for investigators
Romance scams are not new, but cryptocurrency makes extracting money easier than before. Investigators should be alert to the main fraud typology, which can manifest itself in different variations on the surface.
Victims will need support and investigations must be aware of the potential personal issues that victims face. These can include a reluctance to come forwards, through embarrassment or a continued belief that the relationship is real.
Fake investment schemes often have similar names to real exchanges or to actual coins.
Celebrity-endorsed cryptocurrency scams in the UK are on pace to almost double
(Bloomberg - https://www.bloomberg.com/news/articles/2022-06-28/celebrity-endorsed-crypto-scams-soaring-in-uk-santander-says and https://www.santander.co.uk/about-santander/media-centre/press-releases/santander-warns-about-celebrity-endorsed-crypto-scams)
Influencers and celebrities are having their personal brands misused to push cryptocurrency frauds.
Santander sets out case study in their reporting:
• Mr G saw a post on Facebook advertising a cryptocurrency investment opportunity, which was seemingly endorsed by Martin Lewis. Mr G clicked on the link to register his interest and was then contacted by someone purporting to be his personal ‘account manager’ from the cryptocurrency platform, who promised him high returns on his investment.
• Mr G followed his ‘account manager’s’ advice and opened a separate bank account and transferred money from his Santander account to the new account.
• He was then encouraged to allow his ‘account manager’ to access his computer remotely to assist him in making the payments from his newly opened bank account to his cryptocurrency wallet. Mr G was able to see the money leaving his bank account and being credited to his cryptocurrency wallet, but he did not have control over the wallet.
• The fraudster told Mr G to lie to his bank about the payment reason because his bank wouldn’t want him investing in cryptocurrency. As such, when Mr G was contacted by Santander to verify the payments to the new bank account, he followed his so called ‘account manager’s’ advice and provided a false reason as to the purpose of the payment.
• After receiving a number of follow up calls from his ‘account manager’ asking him to deposit more money into his account and talking with family, he realised he was being scammed and contacted Santander to report it.
These attacks are interesting as they blend techniques seen in other cyber frauds such as ‘Microsoft Support’ attacks where victims receive calls seemingly from Microsoft or others to fix a specific issue, and then download software onto the victims systems.
These attacks often targeted online banking, and this development seems to capitalise on the popularity of crypto to build target lists for the same attackers
Notes for investigators
These frauds should be treated as cyber incidents. There is likely to be digital evidence on the systems of victims, as well as potential links to other similar attacks previously.
Celebrities are highly likely to be innocent in connection to the scams, especially where they are high-profile public figure. There have been several instances of influencers allegedly being part of the marketing of the scam in return for payment in tokens or cryptocurrency, which is often sold quickly.