2024-01-18 | Bhupendra Acharya, Muhammad Saad, Antonio Emanuele Cinà, Lea Schönherr, Hoang Dai Nguyen, Adam Oest, Phani Vadrevu, Thorsten Holz
This paper presents a comprehensive analysis of cryptocurrency-based technical support scams, focusing on how scammers exploit social media platforms to target users with wallet-related issues. The study introduces HoneyTweet, an automated system that generates and posts honey tweets to lure scammers, followed by interactions to analyze their behavior. Over three months, HoneyTweet successfully lured over 9,000 scammers by posting 25,000 honey tweets. The system then tracked scammers across multiple communication channels, including email, Instagram, and Telegram, to uncover their payment methods and scam tactics.
The analysis revealed two main categories of scammers: those who requested private key submissions and those who requested payments to their cryptocurrency wallets. Scammers often used Twitter as a starting point for their scams, then pivoted to other platforms to complete the fraud. The study also validated scam activities by setting up honey wallet addresses and observing private key theft. Collaboration with PayPal confirmed the effectiveness of the findings, as PayPal verified fraudulent activities linked to scammer accounts.
Key findings include the use of NFTs and cloned exchange logos in scammer profiles to appear legitimate. Scammers frequently used email-based platforms to continue fraud activities even if their Twitter accounts were suspended. The study also identified that scammers often targeted specific cryptocurrency wallets, such as MetaMask, TrustWallet, and Coinbase. The analysis of blockchain transactions showed that scammers successfully transferred funds from stolen private keys and cryptocurrency addresses, with Bitcoin addresses showing a higher success rate than Ethereum addresses.
The study concludes that cryptocurrency-based technical support scams are a growing threat, and HoneyTweet provides a robust method for detecting and analyzing these scams. The findings highlight the need for improved security measures and awareness among cryptocurrency users to prevent falling victim to such fraud. The research also emphasizes the importance of collaboration between researchers, payment service providers, and social media platforms to combat these emerging threats effectively.This paper presents a comprehensive analysis of cryptocurrency-based technical support scams, focusing on how scammers exploit social media platforms to target users with wallet-related issues. The study introduces HoneyTweet, an automated system that generates and posts honey tweets to lure scammers, followed by interactions to analyze their behavior. Over three months, HoneyTweet successfully lured over 9,000 scammers by posting 25,000 honey tweets. The system then tracked scammers across multiple communication channels, including email, Instagram, and Telegram, to uncover their payment methods and scam tactics.
The analysis revealed two main categories of scammers: those who requested private key submissions and those who requested payments to their cryptocurrency wallets. Scammers often used Twitter as a starting point for their scams, then pivoted to other platforms to complete the fraud. The study also validated scam activities by setting up honey wallet addresses and observing private key theft. Collaboration with PayPal confirmed the effectiveness of the findings, as PayPal verified fraudulent activities linked to scammer accounts.
Key findings include the use of NFTs and cloned exchange logos in scammer profiles to appear legitimate. Scammers frequently used email-based platforms to continue fraud activities even if their Twitter accounts were suspended. The study also identified that scammers often targeted specific cryptocurrency wallets, such as MetaMask, TrustWallet, and Coinbase. The analysis of blockchain transactions showed that scammers successfully transferred funds from stolen private keys and cryptocurrency addresses, with Bitcoin addresses showing a higher success rate than Ethereum addresses.
The study concludes that cryptocurrency-based technical support scams are a growing threat, and HoneyTweet provides a robust method for detecting and analyzing these scams. The findings highlight the need for improved security measures and awareness among cryptocurrency users to prevent falling victim to such fraud. The research also emphasizes the importance of collaboration between researchers, payment service providers, and social media platforms to combat these emerging threats effectively.