View source for Emblem Vault Jake Gallen Goopdate Malware Via Zoom Call

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/emblemvaultjakegallengoopdatemalwareviazoomcall.php}}
{{Unattributed Sources}}

[[File:Emblemvault.jpg|thumb|Emblem Vault Logo/Homepage]]Emblem Vault CEO Jake Gallen reports losing over $100,000 in digital assets—including Ethereum, Bitcoin, and NFTs after his computer was compromised, likely during a Zoom interview with someone posing as a YouTube content creator. The attacker exploited Zoom’s default remote access settings to install malware called “GOOPDATE,” which enabled access to his hardware and web extension wallets. Within 24 hours, his assets were drained, including prized collectibles like his profile picture. Gallen has since regained control of his accounts and publicly shared the compromised wallet addresses. He is now seeking help from security experts, including @zachxbt, to confirm the source of the attack and investigate the individual known as "Elusive Comet," as part of an ongoing effort to trace the stolen funds and raise awareness in the Web3 community.<ref name="panewslab-19672" /><ref name="cointelegraph-19673" /><ref name="jakegallentweet1-19674" /><ref name="emblemvaulttweet-19675" /><ref name="circuitsofvalue-19676" /><ref name="dappradar-19677" /><ref name="tyuponzimedium-19678" /><ref name="stacksgammaio-19679" /><ref name="emblemwiki-19680" /><ref name="jakegallenhomepage-19681" /><ref name="Jake Gallen - Miami NFT Week 2023-19682" /><ref name="compromisedbitcoin-19683" /><ref name="compromisedethereum-19684" /><ref name="approveamooncat-19685" /><ref name="etherscan-19686" /><ref name="etherscan-19687" /><ref name="etherscan-19688" /><ref name="etherscan-19689" /><ref name="jakegallentweet2-19690" /><ref name="jakegallentweet3-19691" /><ref name="jakegallentweet4-19692" /><ref name="calendly-19693" /><ref name="jakegallentwitter-19694" /><ref name="jakegallentwitter-19695" /><ref name="jakegallentwitter-19696" /><ref name="jakegallentwitter-19697" />

== About Emblem Vault ==
Emblem Vault is a Web3 platform that enables users to store and trade digital assets across multiple blockchains without the need for traditional bridges. By wrapping assets from various blockchains—such as Bitcoin, Dogecoin, Namecoin, and Tezos—into ERC-721 or ERC-1155 NFTs, Emblem Vault allows these assets to be traded on Ethereum, Polygon, and Binance Smart Chain marketplaces like OpenSea. This functionality has been particularly valuable for collectors of historical NFTs, including early Bitcoin Ordinals and Counterparty-based assets.

The platform operates by creating a vault as an ERC-721 token, which contains a series of blockchain addresses generated from a single secret phrase. While assets can be sent to these addresses, they cannot be accessed without the private keys, ensuring security until the vault is "unvaulted." Unvaulting involves revealing the private keys to the vault's owner, allowing them to import the assets into a native wallet of their choice. This process is designed to maintain the integrity and security of the assets during their time within the vault.

Emblem Vault has facilitated over 40,000 ETH in transactions and has been instrumental in bringing historical digital assets into the modern NFT ecosystem. Through its innovative approach, Emblem Vault bridges the gap between legacy blockchains and contemporary NFT marketplaces, offering a secure and efficient means for users to manage and trade their digital assets.
== About Jake Gallen ==
Jake Gallen is the CEO of Emblem Vault, a pioneering platform that enables users to trade digital assets across multiple blockchains without the need for traditional bridges. His journey into the blockchain space began in 2016 when he first discovered Ethereum. Despite facing significant setbacks, including losing all his assets in 2018, Gallen's resilience led him to notable achievements such as auctioning MoonCats at Sotheby's in 2021. By 2024, he had ascended to the role of CEO at Emblem Vault, where he focuses on expanding the platform's reach and capabilities.

In addition to his role at Emblem Vault, Gallen is the host of "Jake Gallen's Guest List," a podcast that has featured over 250 guests and garnered more than 100,000 downloads since its inception in 2020. The podcast delves into topics related to blockchain technology, Web3, and digital collectibles, reflecting Gallen's deep engagement with the crypto community. He has also been featured in various media outlets and has spoken at numerous industry events, further establishing his presence in the blockchain space.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
Jake Gallen was hacked after a suspicious Zoom video call, resulting in the loss of over $100,000 worth of Bitcoin and Ethereum.
{| class="wikitable"
|+Key Event Timeline - Emblem Vault Jake Gallen Goopdate Malware Via Zoom Call
!Date
!Event
!Description
|-
|April 9th, 2025 2:39:47 PM MDT
|AcclimatedMoonCat Trade Approval
|The very first transaction in the compromised Ethereum wallet approves the AcclimatedMoonCat NFT for trading on OpenSea:Conduit. This is believed to be the first transaction by the attacker.
|-
|April 10th, 2025 3:00:00 PM MDT
|Jake Gallen Tweet About Loss
|Jake Gallen tweets he suffered a major computer compromise in the past 24 hours that resulted in the loss of over $100,000 in digital assets, including Ethereum, Bitcoin, and NFTs—most notably his profile picture. Multiple wallets were affected, and his Twitter and Gmail accounts were also accessed. The breach reportedly left him devastated, especially given how long he’s been active in the space.
|-
|April 14th, 2025 11:28:00 AM MDT
|Seal Team Finds Malware
|Jake Gallen reports that, in collaboration with the SEAL team, he was able to isolate the malware which was installed and used to drain his funds. The software is known as GOOPUPDATE.
|-
|April 14th, 2025 10:57:00 PM MDT
|PaNewsLab Article Published
|PaNewsLab publishes an article about the incident.
|}

== Technical Details ==
The attacker posed as a YouTube content creator with over 90,000 subscribers and exploited Zoom’s default remote access settings during the interview to install malicious software named “GOOPDATE” on Gallen’s computer.

Jake believes the attack may have originated from a recent Zoom interview, where the guest—whose camera was turned off—asked him to screen share details about a project. He now suspects that this may have been the point of entry for the attacker to gain access to his machine. The individual involved has a large social media following and shared mutual connections, which made the request seem legitimate at the time.

Within 24 hours of that interaction, the exploitation began. Both his Ledger-connected hardware wallet and a Bitcoin web extension wallet were accessed.

== Total Amount Lost ==
Losses were reported as $100,000 USD. Jake Gallen described his losses as "$100k+ in purchased digital assets being lost, including my pfp."

The total amount lost has been estimated at $100,000 USD.

== Immediate Reactions ==
Jake has since regained control of his Twitter and Gmail accounts. He has shared the compromised wallet addresses publicly and is seeking help from security experts, including @zachxbt, to better understand the full scope of what happened before pointing fingers. Despite the setback, Jake says he will recover and urges others to stay vigilant.


== Ultimate Outcome ==
Jake was able to isolate the issue to particular malware called Goopdate, and determine when and how he was infected through the Zoom call and the remote access feature, which Zoom enables by default.

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
An investigation into where the funds went and who Elusive Comet is, is ongoing.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="panewslab-19672">[https://www.panewslab.com/en/articles/8uw580kk Encryption platform Emblem Vault CEO suffered a Zoom conference phishing attack, losing more than $100,000 - PANewsLab] (Accessed May 20, 2025)</ref>

<ref name="cointelegraph-19673">[https://cointelegraph.com/news/emblem-vault-ceo-loses-75-assets-in-elusive-comet-scam Crypto exec warns of ‘ELUSIVE COMET’ threat after losing 75% of assets - CoinTelegraph] (Accessed May 20, 2025)</ref>

<ref name="jakegallentweet1-19674">[https://twitter.com/jakegallen_/status/1910437715671474512 Jake Gallen - "The past 24 hours I've been battling a complete computer compromise that ended up with a loss of ETH and BTC assets from different wallets. Unfortunately, this lead to $100k+ in purchased digital assets being lost, including my pfp." - Twitter/X] (Accessed May 20, 2025)</ref>

<ref name="emblemvaulttweet-19675">[https://twitter.com/EmblemVault/status/1884630744368349671 Emblem Vault - "Emblem's Founder Vault collection is now live and available for purchase and trading!" - Twitter/X] (Accessed May 21, 2025)</ref>

<ref name="circuitsofvalue-19676">[https://circuitsofvalue.com/about Emblem Vaults - Circuits Of Value] (Accessed May 22, 2025)</ref>

<ref name="dappradar-19677">[https://dappradar.com/blog/what-is-emblem-vault-trading-bitcoin-ordinals-nfts-ethereum What is Emblem Vault: Trading Bitcoin Ordinals NFTs on Ethereum - Dappradar] (Accessed May 22, 2025)</ref>

<ref name="tyuponzimedium-19678">[Emblem & $COVAL — A Play on Historical NFTs Emblem & $COVAL — A Play on Historical NFTs - Tyu_Ponzi - Medium] (Accessed May 22, 2025)</ref>

<ref name="stacksgammaio-19679">[https://stacks.gamma.io/learn/ordinals/inscriptions/emblem-vault-for-ordinals Emblem Vault for Ordinals - Stacks.Gamma.Io] (Accessed May 22, 2025)</ref>

<ref name="emblemwiki-19680">[https://docs.emblem.wiki/how-it-works/unvaulting Unvaulting - Emblem Vault Wiki] (Accessed May 22, 2025)</ref>

<ref name="jakegallenhomepage-19681">[https://www.jakegallen.com/ Jake Gallen Homepage] (Accessed May 22, 2025)</ref>

<ref name="Jake Gallen - Miami NFT Week 2023-19682">[https://miaminftweek.com/speakers/jake-gallen/ Jake Gallen - Miami NFT Week 2023] (Accessed May 22, 2025)</ref>

<ref name="compromisedbitcoin-19683">[https://www.blockchain.com/explorer/addresses/btc/bc1p7ntehzvzm8e6r5nw0rrfmnerk7ryf6ws8gnf6dkxpk0njqzfqlps3t2vy5 Compromised Wallet On Bitcoin - Blockchain.com] (Accessed May 22, 2025)</ref>

<ref name="compromisedethereum-19684">[https://etherscan.io/address/0x1Fe026F91200CaC4dc5aC5Af7814808CEcba1836 Compromised Wallet On Ethereum - Etherscan] (Accessed May 22, 2025)</ref>

<ref name="approveamooncat-19685">[https://etherscan.io/tx/0x48bc179a07e9aa31f7dc899a93f1cbff94ca60fada30177063e7a0ffd6e07be6 Approval Of AcclimatedMoonCat For Trading On OpenSea: Conduit - Etherscan] (Accessed May 22, 2025)</ref>

<ref name="etherscan-19686">[https://etherscan.io/tx/0xc222345abd2d36f2540f122565474312d5bb959f34923faa7b11da8fd4901cea Ethereum Transaction Hash: 0xc222345abd...] (Accessed May 22, 2025)</ref>

<ref name="etherscan-19687">[https://etherscan.io/tx/0x2b8aad22d28e5406da4dc6fd132183c073b50c6a753541e482c71e4d81158b2c Ethereum Transaction Hash: 0x2b8aad22d2...] (Accessed May 22, 2025)</ref>

<ref name="etherscan-19688">[https://etherscan.io/tx/0x9a52e783c58196e9c5c202e13158e2750c08ebecf534e3fd3751e85076b46625 Ethereum Transaction Hash: 0x9a52e783c5...] (Accessed May 22, 2025)</ref>

<ref name="etherscan-19689">[https://etherscan.io/tx/0x75c635996ab17c6f20ef2b3c0b3efea08feea1f5820a97ab4512eb8e097e86dd Ethereum Transaction Hash: 0x75c635996a...] (Accessed May 22, 2025)</ref>

<ref name="jakegallentweet2-19690">[https://twitter.com/jakegallen_/status/1911834004690751955 Jake Gallen - "Working with @_SEAL_Org we were able to retrieve a malware file that was installed on my computer during a @Zoom call with a youtube personality of over 90k subs." - Twitter/X] (Accessed May 22, 2025)</ref>

<ref name="jakegallentweet3-19691">[https://twitter.com/jakegallen_/status/1910704743019667882 Jake Gallen - "If you are an active @Zoom user please read this!" - Twitter/X] (Accessed May 22, 2025)</ref>

<ref name="jakegallentweet4-19692">[https://twitter.com/jakegallen_/status/1910445829535784981 Jake Gallen - "Nope last access was 33 days before. They must have has accessed to the seed phrase as they initiated token approvals on behalf of the account to list and sell the NFTs. I was in my car when the attack began." - Twitter/X] (Accessed May 22, 2025)</ref>

<ref name="calendly-19693">[https://calendly.com/tacticalinvesting/ Calendly] (Accessed May 22, 2025)</ref>

<ref name="jakegallentwitter-19694">[https://twitter.com/jakegallen_/status/1911834009577168904 @jakegallen_ Twitter] (Accessed May 22, 2025)</ref>

<ref name="jakegallentwitter-19695">[https://twitter.com/jakegallen_/status/1911834006699852015 @jakegallen_ Twitter] (Accessed May 22, 2025)</ref>

<ref name="jakegallentwitter-19696">[https://twitter.com/jakegallen_/status/1911884594846335363 @jakegallen_ Twitter] (Accessed May 22, 2025)</ref>

<ref name="jakegallentwitter-19697">[https://twitter.com/jakegallen_/status/1910465023044206714 @jakegallen_ Twitter] (Accessed May 22, 2025)</ref></references>