View source for DAWN Internet Twitter/X Account Token Phishing Attacks

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/dawninternettwitterxaccounttokenphishingattacks.php}}
{{Unattributed Sources}}

[[File:Dawninternet.jpg|thumb|Dawn Internet Logo/Homepage]]DAWN is a decentralized wireless network allowing users to buy and sell internet capacity locally, enabling them to act as their own internet providers. It uses a trustless exchange system based on proof of backhaul, location, and frequency. Users can participate by running a DAWN Validator extension and earn rewards for maintaining the network. Recently, DAWN’s Twitter/X account was compromised in phishing attacks involving fake airdrops, a new Solana token, and a Telegram group promoting a malicious phishing plugin. While the account was restored and security measures were implemented, it does not appear that any assistance was offered to affected users, and the full extent of the losses remains unclear. DAWN continues to operate.<ref name="realscamsniffer1-18434" /><ref name="realscamsniffer2-18435" /><ref name="realscamsniffer3-18436" /><ref name="dawninternettweet-18437" /><ref name="coin8exchangetwitter-18438" /><ref name="ahmadmasood94twitter-18439" /><ref name="ezzyeahtwitter-18440" /><ref name="atlasdraggontwitter-18441" /><ref name="xenoncaspiantwitter-18442" /><ref name="solanasapientwitter-18443" /><ref name="0xalladintwitter-18444" /><ref name="thegreatpupdinitwitter-18445" /><ref name="ahmadmasood94twitter-18446" /><ref name="kristopherlukastwitter-18447" />

== About Dawn Internet ==
DAWN is a decentralized wireless network that enables users to buy and sell internet capacity within their local area, effectively allowing individuals to act as their own internet providers. Through a protocol and hardware setup, DAWN fosters a trustless exchange system, relying on proof of backhaul, location, and frequency. Users can participate in the network by running a DAWN Validator extension, earning rewards for helping to maintain the network through proof of bandwidth and coverage. The system integrates with Helium to create a community-owned internet.

== The Reality ==
Unfortunately, it appears that Dawn Internet did not secure their Twitter/X account.

== What Happened ==
A series of phishing attacks were posted against followers of Dawn Internet.
{| class="wikitable"
|+Key Event Timeline - DAWN Internet Twitter/X Account Token Phishing Attacks
!Date
!Event
!Description
|-
|January 14th, 2025 9:51:00 PM MST
|Scam Sniffer Tweet Warning 1
|Scam Sniffer posts a warning about the compromised account on Twitter/X. At this time, they share a screenshot of an airdrop scam, where users are given the chance to check eligibility in an airdrop. That involves connecting their wallet with full approval to drain it.
|-
|January 14th, 2025 11:24:00 PM MST
|Scam Sniffer Tweet Warning 2
|Scam Sniffer posts another warning. It appears that the hackers are now launching a token on Solana. They hold a large quantity of the token, and will ultimately sell once the market cap is large enough.
|-
|January 15th, 2025 1:43:00 AM MST
|Scam Sniffer Tweet Warning 3
|Scam sniffer posts their final warning. It appears that the hacker is requesting the community to join a new Telegram group. The new Telegram group will prompt them to engage with a malicious Safeguard bot, which will attemp to phish their login details.
|-
|January 15th, 2025 3:06:00 PM MST
|DAWN Announces Account Recovery
|Dawn Internet posts an announcement on their Twitter/X to report that they have recovered access to their account.
|}

== Technical Details ==
The attacks consisted of the typical cases.

An airdrop was announced and users could check their eligibility. If users tried to do this, they were required to give full approval to their wallet, which would drain the funds.

There was a new token launched on Solana, which claimed to be related to Dawn Internet. Attackers acquired a large quantity of the token. Once this token gained a large enough market capitalization, the token was dumped on all users.

Finally, the hackers announced a new Telegram group for Dawn Internet followers. When followers attempted to join this Telegram group, they would be greeted by a verification bot. This verification bot required them to provide permissions, which would take over their Telegram account and could potentially by used for spamming.

== Total Amount Lost ==
The full extent of losses from this incident are not well known.

The total amount lost is unknown.

== Immediate Reactions ==
Real Scam Sniffers posted a number of warnings for the community. It appears that many users were affected despite these warnings.

"According to Scam Sniffer's monitoring, the X account of the decentralized autonomous wireless network project DAWN was compromised and used to post phishing tweets."

== Ultimate Outcome ==
"Access to the DAWN account has been restored to the DAWN team and full security measures are in place. Thank you for your cooperation and patience."

== Total Amount Recovered ==
It does not appear that Dawn Internet has done anything to assist any affected users, despite multiple community members inquiring about this possibility.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
Dawn Internet continues to run and launched.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="realscamsniffer1-18434">[https://twitter.com/realScamSniffer/status/1879390837496537466 Real Scam Sniffer - "@dawninternet was compromised and posted phishing tweets." - Twitter/X] (Accessed Mar 7, 2025)</ref>

<ref name="realscamsniffer2-18435">[https://twitter.com/realScamSniffer/status/1879414256665530705 Real Scam Sniffer - "Scammers now post CA instead of phishing links" - Twitter/X] (Accessed Mar 7, 2025)</ref>

<ref name="realscamsniffer3-18436">[https://twitter.com/realScamSniffer/status/1879449209570812385 Real Scam Sniffer - "Now changed to post the Telegram channel that contains malicious Safeguard bots asking you to login to Telegram." - Twitter/X] (Accessed Mar 7, 2025)</ref>

<ref name="dawninternettweet-18437">[https://twitter.com/dawninternet/status/1879651432774992177 Dawn Internet - "Access to the DAWN account has been restored to the DAWN team and full security measures are in place. Thank you for your cooperation and patience." - Twitter/X] (Accessed Mar 7, 2025)</ref>

<ref name="coin8exchangetwitter-18438">[https://twitter.com/Coin8_Exchange/status/1879732306883080364 @Coin8_Exchange Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="ahmadmasood94twitter-18439">[https://twitter.com/Ahmad_Masood94/status/1880024852977066034 @Ahmad_Masood94 Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="ezzyeahtwitter-18440">[https://twitter.com/ezzyeah/status/1879895904104349739 @ezzyeah Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="atlasdraggontwitter-18441">[https://twitter.com/AtlasDraggon/status/1879901982561022197 @AtlasDraggon Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="xenoncaspiantwitter-18442">[https://twitter.com/XenonCaspian/status/1879900147355943126 @XenonCaspian Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="solanasapientwitter-18443">[https://twitter.com/solanasapien/status/1879954085002244498 @solanasapien Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="0xalladintwitter-18444">[https://twitter.com/0xAlladin/status/1879895706384887925 @0xAlladin Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="thegreatpupdinitwitter-18445">[https://twitter.com/TheGreatPupdini/status/1879671167163785622 @TheGreatPupdini Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="ahmadmasood94twitter-18446">[https://twitter.com/Ahmad_Masood94/status/1879749876185203072 @Ahmad_Masood94 Twitter] (Accessed Mar 7, 2025)</ref>

<ref name="kristopherlukastwitter-18447">[https://twitter.com/kristopherlukas/status/1879848198086512822 @kristopherlukas Twitter] (Accessed Mar 7, 2025)</ref></references>