‌DEFI Scam Check (🔗Telegram)[🌐RU🔀EN] How to Masterfully Decorate $243m and Get Caught This is the story of how Grievis (Malone Iam), Wiz (Veer Chetal) and Box (Jandiel Serrano) stole $243m at the victim in August using a sophisticated social engineering…

‌DEFI Scam Check (🔗Telegram)[🌐RU🔀EN]

How to Masterfully Decorate $243m and Get Caught

This is the story of how Grievis (Malone Iam), Wiz (Veer Chetal) and Box (Jandiel Serrano) stole $243m at the victim in August using a sophisticated social engineering attack.

On August 19, 2024, attackers targeted one Genesis lender:

1) Call pretending to be Google support from a fake number to hack personal accounts

2) Call to Gemini support about account hacking

3) Social engineering forced the victim to reset 2FA and send Gemini funds to the hacked wallet

4) Victim used AnyDesk to screen sharing and leaked private keys from Bitcoin Core.

Gemini txn hash
59.34 BTC - August 19 at 1:48 UTC

e747b963a463334c164b0a8fff844f73693272bb2b331adbe2147d70ec196360

14.88 BTC - August 19 at 2:30
UTC

7c7ebed785f0b4d4335d559b14b8215862fbe29db329e3ee0f2a7e64a16ce9e3

txn hash
4064 BTC - August 19 at 4:05 UTC

4b277ba298830ea538086114803b9487558bb093b5083e383e94db687fbe9090

Initial analysis showed that $243m was divided between each party, after which the funds were quickly distributed to over 15 exchanges where they were instantly exchanged between Bitcoin, Litecoin, Ethereum and Monero.

Viz (Vir) received a large percentage of the theft but his dementia and courage allowed him to make a mistake during the screen sharing, revealing his full name during the theft.

Accomplices called him Vir in audio recordings and in chats, special respect to them for their conspiracy

$34.5m
0x3c7a5f2795e73d2b94a9120a643f608cfc45c935

6Friend Visa Light/Dark (Aakaash ) helped him launder money using eXch and Thorswap.

Like Wiz, he also revealed his name during the screen sharing.

Wiz TC address confirmed in the video
0xa212d7441fed6db9ab666ba34e8c4

Greavis (Malone) lives a luxurious lifestyle, buying more cars with stolen money and going to clubs in Los Angeles and Miami with friends, spending $250-500k a night and giving girls Birkin bags.< br />
In videos and chats, many called him Malone and said that he was trading stolen funds on Discord.

Currently $3.5m tied to Grievis is here
0x21d7d256be564191a43553e574c06a4d0

Grivis was found through OSINT in Los Angeles/Miami thanks to friends/girls who posted his location every night on social media.

He also has Instagram account, where he posted photos of himself under his own name earlier this year.

Box (Jandiel/John) played his part by identifying the victim as a representative of the Gemini exchange.

On Discord, Telegram and other Box platforms reuse the same PFP.

Currently $18m is here
0x98b0811e2cc7530380caf1a17440b18f71f51f4e

Danny Trauma (Dane) was active in the internal Telegram chat under the pseudonym Mitch, although his exact role is not entirely clear, although he is known to have access to several bankruptcy databases.

However, his ex-girlfriend leaked all his photos on social media network, so his information became public.

Over the past few weeks, a cluster of Ethereum addresses tied to Box/Wiz received more than $41m from two exchanges that trade luxury goods.

Although most of the funds were converted to XMR, both Box and Wiz accidentally linked the laundered funds.

a) During the screen sharing, Wiz showed the address to which he sent funds for designer clothes

b) Box linked dirty money with clean funds, accidentally reusing the deposit address.

0x6d865235ebb2504d3478fc1dd839100d210144df

12/ With the assistance of the security team, the cyber crimes department and Binance, over $9m was frozen, and over $500k has already been returned.

As a result of the investigation, Box and Grievis were arrested last night in Miami and Los Angeles.

Law enforcement is believed to have seized additional funds during the arrests due to large transfers to that period

https://x.com/zachxbt/status/1836753473343259058&t=0kEtp7M29ov5I RUYfIeIlQ

老朋友鸭嘴兽platypus

https://twitter.com/BlockSecTeam/status/1712445197538468298

https://vxtwitter.com/anciliainc/status/1647374021745606656 [AI Smart Contract Auditor]'s contract rekt

X (formerly Twitter)

Ancilia, Inc. on X

.@0x0Audits You probably want to take a look at a tx ending with 65429927a6c9bdbec, Contact us for details.

Exactly Protocol Exploiter 1: 0x3747DbBCb5C07786a4c59883E473A2e38F571af9
exploiter 2: 0xE4f34a72d7c18b6f666d6cA53fBC3790bc9da042
exploiter 3 大部分交互都是3发出的 0x417179df13bA3ed138B0A58eaA0C3813430a20e0
contract: https://optimistic.etherscan.io/address/0x6dd61c69415c8ecab3fefd80d079435ead1a5b4d
给他装到了，操作太多我看不懂呀

Optimism Network Explorer

Contract Address 0x6dd61c69415c8ecab3fefd80d079435ead1a5b4d | Optimistic Etherscan

The Contract Address 0x6dd61c69415c8ecab3fefd80d079435ead1a5b4d page allows users to view the source code, transactions, balances, and analytics for the contract address. Users can also interact and make transactions to the contract directly on Optimistic…