View source for Ai16z ElizaOS Founder Shaw Twitter/X Wallet Drain Phish

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/ai16zelizaosfoundershawtwitterxwalletdrainphish.php}}
{{Unattributed Sources}}

[[File:Elizaosai.jpg|thumb|ElizaOS Logo/Homepage]]<ref name="panewslabreport-19278" /><ref name="s4mmyethtweet-19279" /><ref name="shawmakesmagictweet-19280" /><ref name="soysaltoretweet-19281" /><ref name="0xjiumutweet-19282" /><ref name="rennevermindtweet-19283" /><ref name="arasthormtweet-19284" /><ref name="doodlely213tweet-19285" /><ref name="elizaosnethomepage-19286" /><ref name="osintdaotweet-19287" /><ref name="elizaosframework-19288" /><ref name="shawmakesmagictweet-19289" /><ref name="kannumehta750twitter-19290" /><ref name="aiflowmltwitter-19291" /><ref name="colejj3twitter-19292" /><ref name="blockbyblockbytwitter-19293" /><ref name="09pzkuqbsa91kq3twitter-19294" /><ref name="alphastackktwitter-19295" /><ref name="msvdzx0twitter-19296" /><ref name="xiroshibatwitter-19297" /><ref name="0xjiumutwitter-19298" /><ref name="justforfunlntwitter-19299" /><ref name="0xtitipumptwitter-19300" /><ref name="emmm486twitter-19301" /><ref name="fabi0xethtwitter-19302" /><ref name="atownbrowntwitter-19303" /><ref name="0xwitchytwitter-19304" /><ref name="m4tnfttwitter-19305" /><ref name="0xjunkdoggtwitter-19306" /><ref name="chosenryottwitter-19307" /><ref name="investmenthantwitter-19308" /><ref name="tungthuocnotwitter-19309" /><ref name="riotboy2024twitter-19310" /><ref name="rmrkablewavintwitter-19311" /><ref name="nanmolayotwitter-19312" /><ref name="katexbttwitter-19313" /><ref name="gmryottwitter-19314" /><ref name="joestarcryptotwitter-19315" /><ref name="llcryptojtwitter-19316" /><ref name="m4tnfttwitter-19317" /><ref name="unnamed-19318" />

== About ElizaOS ==
"Eliza is a powerful multi-agent simulation framework designed to create, deploy, and manage autonomous AI agents. Built with TypeScript, it provides a flexible and extensible platform for developing intelligent agents that can interact across multiple platforms while maintaining consistent personalities and knowledge."

== The Reality ==
Unfortunately the ShawMakesMagic account was able to be hacked.

== What Happened ==
ShawMakesMagic posted about the "Phase 1 Distribution" of the $ElizaOS token. Users who attempted to check their allocation would find their wallet drained.
{| class="wikitable"
|+Key Event Timeline - Ai16z ElizaOS Founder Shaw Twitter/X Wallet Drain Phish
!Date
!Event
!Description
|-
|February 16th, 2025 5:13:00 AM MST
|Arasthorm/Dooly Warnings
|Twitter users @Arasthorm and @doodlely213 warn about the shawmakesmagic account being hacked. Apparently there is already a warning on the official discord.
|-
|February 16th, 2025 5:14:00 AM MST
|Jui-mu/Ren Warning Tweets
|Twitter users @ren_Nevermind and @0xjiumu warn about the shawmakesmagic account being hacked.
|-
|February 16th, 2025 5:16:00 AM MST
|SoysalTore Warning Hacked
|Twitter users @SoysalTore and @0xjiumu warn that the shawmakesmagic account has been hacked.
|-
|February 16th, 2025 5:36:00 AM MST
|OSINTDAO Screenshot Of Flow
|OSINTDAO shares a screenshot video of the tweet and content of the resulting website.
|-
|February 16th, 2025 5:39:00 AM MST
|S4mmyEth Issues Warning
|S4mmyEth reports that Shaw's account has been hacked, and users are strongly advised not to interact with it. A fake Eliza scam link is circulating, so it's important to spread awareness and avoid clicking on any suspicious links.
|-
|February 16th, 2025 5:55:00 AM MST
|PANews Report Published
|PANews reports that, on February 16, community users disclosed that the X account of Shaw, the founder of ai16z, appeared to have been hacked. Users have been advised to exercise caution and avoid interacting with any suspicious links.
|-
|February 16th, 2025 1:29:00 PM MST
|ShawMakesMagic Addresses Hack
|ShawMakesMagic shares that they are unsure what happened with the hack, despite having two-factor authentication, a password manager, and a strong password. They believe the attack was well-designed and targeted. They apologize to anyone who lost funds and express frustration with the challenges in the space.
|}

== Technical Details ==
It appears that the tweet led users to a wallet drainer which was pretending to be an official ElizaOS site.

The hacker disabled comments on the main post, which caused many users to become suspicious.

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
The community has expressed concern and frustration over the hack, with many showing empathy for Shaw and others affected. Users have been sharing warnings about potential scams and phishing attempts related to the incident. There's also a general sense of disbelief, as many recognize the sophistication of the attack despite Shaw’s strong security measures. Some have accused Shaw of faking the hack.

== Ultimate Outcome ==
Shaw issued a notice that he didn't know what happened and is sorry to anyone who lost funds. However, he has not offered any assistance for affected users.

== Total Amount Recovered ==
It is believed that there was no recovery in this case.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
There is limited information available, but it should be possible to determine who received the funds from draining the wallets and bring them to justice.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="panewslabreport-19278">[https://www.panewslab.com/zh/sqarticledetails/8722ekeb.html ai16z Founder’s X Account Suspected of Being Hacked, Users Should Exercise Caution - PaNews Lab] (Accessed Mar 20, 2025)</ref>

<ref name="s4mmyethtweet-19279">[https://twitter.com/S4mmyEth/status/1891105222346371120 S4mmyEth - "Shaw is hacked. Do NOT interact. This is a fake Eliza scam link. Spread for awareness." - Twitter/X] (Accessed Mar 21, 2025)</ref>

<ref name="shawmakesmagictweet-19280">[https://twitter.com/shawmakesmagic/status/1891098273097666676 ShawMakesMagic - "Introducing v2. The Phase 1 Distribution of $ElizaOS is open to $ai16z holders and members of the greater ai16z ecosystem. Very excitedf for v2. I'll be releasing the updated roadmap soon. Check your allocation below." - Twitter/... Post] (Accessed Mar 21, 2025)</ref>

<ref name="soysaltoretweet-19281">[https://twitter.com/SoysalTore/status/1891099369278976400 SoysalTore - "HACKED CAREFULL" - Twitter/X] (Accessed Mar 21, 2025)</ref>

<ref name="0xjiumutweet-19282">[https://twitter.com/0xjiumu/status/1891098729936998413 Jiu-mu - "SCAM , SHAW GOT HACKED" - Twitter/X] (Accessed Mar 21, 2025)</ref>

<ref name="rennevermindtweet-19283">[https://twitter.com/ren_Nevermind/status/1891098711805095948 ren_Nevermind - "Shaw is hacked" - Twitter/X] (Accessed Mar 21, 2025)</ref>

<ref name="arasthormtweet-19284">[https://twitter.com/Arasthorm/status/1891098671879463277 Arasthorm - "Do not interact! Shaw has been hacked! Check official discord." - Twitter/X] (Accessed Mar 21, 2025)</ref>

<ref name="doodlely213tweet-19285">[https://twitter.com/doodlely213/status/1891098525154295881 Dooly - "shaw is hecked" - Twitter/X] (Accessed Mar 21, 2025)</ref>

<ref name="elizaosnethomepage-19286">[https://web.archive.org/web/20250216150109/https://www.eliza-os.net/ ElizaOS - Homepage Archive] (Accessed Mar 21, 2025)</ref>

<ref name="osintdaotweet-19287">[https://twitter.com/OSINTDAO/status/1891104380784398519 OSINTDAO - "thx @ddillann1 for clip.. @shawmakesmagic acct is hacked.. DO NOT OPEN THE LINK IN THIS TWEET" - Twitter/X] (Accessed Mar 21, 2025)</ref>

<ref name="elizaosframework-19288">[https://www.elizaos.ai/framework ElizaOS Framework] (Accessed Mar 21, 2025)</ref>

<ref name="shawmakesmagictweet-19289">[https://twitter.com/shawmakesmagic/status/1891223290233897315 ShawMakesMagic - "I don't know wtf happened with the hack. I have 2FA, password manager, strong password, etc. It was obviously well designed and targeted. Sorry to anyone who lost funds. This space is so tiring tbh." - Twitter/X] (Accessed Mar 21, 2025)</ref>

<ref name="kannumehta750twitter-19290">[https://twitter.com/Kannumehta750/status/1891099520034889876 @Kannumehta750 Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="aiflowmltwitter-19291">[https://twitter.com/AIFlow_ML/status/1891109102303994236 @AIFlow_ML Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="colejj3twitter-19292">[https://twitter.com/coleJJ3/status/1891100423575990626 @coleJJ3 Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="blockbyblockbytwitter-19293">[https://twitter.com/blockbyblockby/status/1891099875418223002 @blockbyblockby Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="09pzkuqbsa91kq3twitter-19294">[https://twitter.com/09pZKuQbSA91Kq3/status/1891106401071554818 @09pZKuQbSA91Kq3 Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="alphastackktwitter-19295">[https://twitter.com/alphastackk/status/1891099968787665105 @alphastackk Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="msvdzx0twitter-19296">[https://twitter.com/MSvdZx0/status/1891107420752973952 @MSvdZx0 Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="xiroshibatwitter-19297">[https://twitter.com/XiROSHiBA/status/1891104986496475378 @XiROSHiBA Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="0xjiumutwitter-19298">[https://twitter.com/0xjiumu/status/1891099368540835998 @0xjiumu Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="justforfunlntwitter-19299">[https://twitter.com/justforfunl_n/status/1891100584289112420 @justforfunl_n Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="0xtitipumptwitter-19300">[https://twitter.com/0xtitipump/status/1891100212472537522 @0xtitipump Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="emmm486twitter-19301">[https://twitter.com/emmm486/status/1891099585126281650 @emmm486 Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="fabi0xethtwitter-19302">[https://twitter.com/Fabi0xeth/status/1891107626273984710 @Fabi0xeth Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="atownbrowntwitter-19303">[https://twitter.com/AtownBrown/status/1891105327459819943 @AtownBrown Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="0xwitchytwitter-19304">[https://twitter.com/0xwitchy/status/1891099568999108949 @0xwitchy Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="m4tnfttwitter-19305">[https://twitter.com/M4T_NFT/status/1891104106455962069 @M4T_NFT Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="0xjunkdoggtwitter-19306">[https://twitter.com/0xjunkdogg/status/1891105514873909299 @0xjunkdogg Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="chosenryottwitter-19307">[https://twitter.com/chosenryot/status/1891105639939665997 @chosenryot Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="investmenthantwitter-19308">[https://twitter.com/investmentHan/status/1891106835379192163 @investmentHan Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="tungthuocnotwitter-19309">[https://twitter.com/Tungthuocno/status/1891103065710768551 @Tungthuocno Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="riotboy2024twitter-19310">[https://twitter.com/riotboy2024/status/1891105828884631982 @riotboy2024 Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="rmrkablewavintwitter-19311">[https://twitter.com/RMRKableWavin/status/1891107044922458333 @RMRKableWavin Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="nanmolayotwitter-19312">[https://twitter.com/Nan_molayo/status/1891104353320124588 @Nan_molayo Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="katexbttwitter-19313">[https://twitter.com/katexbt/status/1891099827745808574 @katexbt Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="gmryottwitter-19314">[https://twitter.com/gmryot/status/1891105889953726681 @gmryot Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="joestarcryptotwitter-19315">[https://twitter.com/JoestarCrypto/status/1891100583286669427 @JoestarCrypto Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="llcryptojtwitter-19316">[https://twitter.com/LLcryptoJ/status/1891107573224427985 @LLcryptoJ Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="m4tnfttwitter-19317">[https://twitter.com/M4T_NFT/status/1891100203920331087 @M4T_NFT Twitter] (Accessed Mar 21, 2025)</ref>

<ref name="unnamed-19318">[https://x.com/shawmakesmagic/status/1891701289165136083 https://x.com/shawmakesmagic/status/1891701289165136083] (Accessed Mar 21, 2025)</ref></references>