New SpaceX Giveaway: BitOK Exposes Scammers Who Raised $165,000 in Crypto Through Fake Donations
The BitOK team has uncovered a scheme where scammers, posing as American entrepreneur Elon Musk, organized a fake cryptocurrency giveaway to coincide with the launch of a SpaceX Starship. This was accompanied by live streams on YouTube featuring a deepfake version of Musk. The campaign began on November 18, 2023.
Context
According to information on the website (accessed through the QR code in the broadcast), participants in the giveaway were initially required to send cryptocurrency to the contribution addresses and wait for the transaction to be processed. Afterward, they were promised a return of cryptocurrency to their wallets, but with a 200% bonus.
Fake cryptocurrency giveaway broadcasts from SpaceX emerged on YouTube and a fake SpaceX channel with 180,000 subscribers.
To convince victims, the perpetrators employed "deepfake" technology and generated Elon Musk's voice. At the time of writing this material, all videos about the fake giveaways have been removed, but we managed to make a recording available through this link.
Perpetrators' successful social engineering led multiple news outlets to share links to the fake broadcasts on their social media.
Perpetrators' successful social engineering led multiple news outlets to share links to the fake broadcasts on their social media.
Analysis of BTC Donations
● BTC address used by the perpetrators to receive donations: bc1qc4rwqqf0q75rn032knwkvxtrdm4vurkusr8s4k.
● A total of 2.48 BTC was received (~$91,566 at the current exchange rate), after which all funds were transferred to the address: bc1q6yjkfe0edtyn4luwskx30gg35r7eclllfsp3jg.
● A total of 2.48 BTC was received (~$91,566 at the current exchange rate), after which all funds were transferred to the address: bc1q6yjkfe0edtyn4luwskx30gg35r7eclllfsp3jg.
○ From the address bc1q6…sp3jg a portion of the funds (1.25 BTC) was sent to the deposit address of the KuCoin exchange 3NcPowGtnnUxsgFSeCUoiaXW2MtcHUjXF4.
○ The remaining balance (1.22 BTC) was sent to the change address bc1qwyrv7wkuqh79gk9uu9zjhc2sutyw80ksk4qjug, and then directed to the deposit address of the KuCoin exchange 3NcPowGtnnUxsgFSeCUoiaXW2MtcHUjXF4.
Analysis of ETH and USDT_ETH Donations
● ETH Address used by the perpetrators to receive donations in ETH and USDT (ERC-20): 0xa2eafea8E9BD6fB1F5c77C70Ac6Eb078905ed7A3.
● Approximately $2,339 in USDT stablecoin and 33.36 in ETH ( ~$65,449 at the current exchange rate) were received.
● All USDT funds remained inactive at the same address as of the investigation on November 20, 2023, at 9:00 (GMT+2).
● The majority of ETH (32.83 ETH) was sent to the address 0x96b5eF32C0d80290F9f25f4Fb321CD104B545939 (TXID: 0x0c36ab37867b3ce53e660eca12e32b9aaf6471204a7816d24d27542928e9399c). The funds were then fully directed to the address 0x8ab772fBa1bCEd5A780744698C16De118FF55D5a, where they were mixed with funds from the address 0xda31943c26b03E245369Dc35e1ca76545366547d. Subsequently, 44.68 ETH was sent to the deposit address of the KuCoin exchange 0x45300136662dD4e58fc0DF61E6290DFfD992B785 (TXID: 0xb35b851ae2c93bb63df34fdba8599137858d2f38c072288082b0043c765f0247.
● The remaining portion of ETH (0.35 ETH) was sent to three addresses:
● Approximately $2,339 in USDT stablecoin and 33.36 in ETH ( ~$65,449 at the current exchange rate) were received.
● All USDT funds remained inactive at the same address as of the investigation on November 20, 2023, at 9:00 (GMT+2).
● The majority of ETH (32.83 ETH) was sent to the address 0x96b5eF32C0d80290F9f25f4Fb321CD104B545939 (TXID: 0x0c36ab37867b3ce53e660eca12e32b9aaf6471204a7816d24d27542928e9399c). The funds were then fully directed to the address 0x8ab772fBa1bCEd5A780744698C16De118FF55D5a, where they were mixed with funds from the address 0xda31943c26b03E245369Dc35e1ca76545366547d. Subsequently, 44.68 ETH was sent to the deposit address of the KuCoin exchange 0x45300136662dD4e58fc0DF61E6290DFfD992B785 (TXID: 0xb35b851ae2c93bb63df34fdba8599137858d2f38c072288082b0043c765f0247.
● The remaining portion of ETH (0.35 ETH) was sent to three addresses:
○ 0,01 ETH to the address 0xd3F7E21a95c113D705d11D6c9756232F59FC686B;
○ 0,12 ETH to the address 0xFEF68a732705892522ccCf003F1883f07220e063 (deposit address of an unidentified service with a master account 0x4C77eFCB44eeED89AB54Cc0aeba64b2ddF919096);
○ 0,21 ETH to the address 0xd7dB33024Af51A93C04F5EeD73468351B6F8a971 (deposit address of the cryptocurrency exchange Binance).
○ 0,12 ETH to the address 0xFEF68a732705892522ccCf003F1883f07220e063 (deposit address of an unidentified service with a master account 0x4C77eFCB44eeED89AB54Cc0aeba64b2ddF919096);
○ 0,21 ETH to the address 0xd7dB33024Af51A93C04F5EeD73468351B6F8a971 (deposit address of the cryptocurrency exchange Binance).
Analysis of USDT_BSC and USDT_Polygon Donations
● The scammers did not specify an address for donations in the BNB Chain and Polygon blockchains. However, people still sent funds in BEP-20-based USDT and USDT on the Polygon sidechain to the address 0xa2eafea8E9BD6fB1F5c77C70Ac6Eb078905ed7A3.
● Approximately $207 in USDT BEP-20 and around $1,093 in USDT on the Polygon sidechain were received.
● As of the investigation on November 20, 2023, at 9:00 (GMT+2), the funds remain inactive at the same address.
● Approximately $207 in USDT BEP-20 and around $1,093 in USDT on the Polygon sidechain were received.
● As of the investigation on November 20, 2023, at 9:00 (GMT+2), the funds remain inactive at the same address.
Analysis of DOGE Donations
● Address for DOGE donations: DMEP9NXY6oGu2aADWtW7Y9TARQ8k1quMRh.
● Received 58,164 DOGE (~$5,045 at the current exchange rate).
● All funds were sent to the deposit address of KuCoin cryptocurrency exchange D7H8teN2Y97dJYE6z9MLZ3xkExpNsNTDLx (TXID: ebfcae3344c44b8836ff4dc721baf224444441ef78f712864c7d2ca2ca1b97c936259).
The BitOK team will continue to closely monitor the development of this situation and is ready to provide assistance to all those affected by this fraud.
● Received 58,164 DOGE (~$5,045 at the current exchange rate).
● All funds were sent to the deposit address of KuCoin cryptocurrency exchange D7H8teN2Y97dJYE6z9MLZ3xkExpNsNTDLx (TXID: ebfcae3344c44b8836ff4dc721baf224444441ef78f712864c7d2ca2ca1b97c936259).
The BitOK team will continue to closely monitor the development of this situation and is ready to provide assistance to all those affected by this fraud.
