TrustWallet Twitter Phishing Attack LouBapMarketing - Revision history

Azoundria: Another 30 minutes complete. Merging in more sources and cleaning up the article further.

2023-11-17T19:28:02Z

Another 30 minutes complete. Merging in more sources and cleaning up the article further.

← Older revision		Revision as of 13:28, 17 November 2023
Line 1:		Line 1:
	{{~~Imported~~ Case Study~~\|source=https://www.quadrigainitiative.com/casestudy/trustwallettwitterphishingattack@dafimaniac0.php~~}}[[File:Trustwallet.jpg\|thumb\|Trust Wallet Logo]]Twitter user "LouBapMarketing" (formerly "DafiManiac0") reported that he lost $90,689.000248 USDT and $154,807.136786 USDC in a phishing attack. He provided blockchain transactions dated July 19th, 2021. He repeatedly requested help to recover ~~their~~ funds. It doesn't appear that any of his several tweets at the time received any response, and it seems unlikely that any of the stolen funds have been recovered.		{{Case Study Under Construction}}[[File:Trustwallet.jpg\|thumb\|Trust Wallet Logo]]Twitter user "LouBapMarketing" (formerly "DafiManiac0") reported that he lost $90,689.000248 USDT and $154,807.136786 USDC in a phishing attack. He provided blockchain transactions dated July 19th, 2021. He repeatedly requested help to recover his funds. It doesn't appear that any of his several tweets at the time received any response, and it seems unlikely that any of the stolen funds have been recovered.

	== About Lou Bap Marketing ==		== About Lou Bap Marketing ==
Line 8:		Line 8:
	The most trusted & secure crypto wallet.		The most trusted & secure crypto wallet.

	Buy, store, collect NFTs, exchange & earn crypto. Join 25 million+ people using Trust Wallet.</blockquote>Wallets within TrustWallet are typically secured by a 12 word seed phrase<ref>[https://trustwallet.com/blog/could-someone-guess-your-mnemonic Could Someone Guess Your Recovery Seed Phrase? - TrustWallet] (Mar 9, 2023)</ref>.<blockquote>Just like your bank account login or email credentials, your recovery phrase needs to be kept in a secure, hidden location. You need to write it on a piece of paper (or engrave it in metal) and ensure that the order of words is followed.</blockquote>		Buy, store, collect NFTs, exchange & earn crypto. Join 25 million+ people using Trust Wallet.</blockquote>Wallets within TrustWallet are typically secured by a 12 word seed phrase<ref name=":4">[https://trustwallet.com/blog/could-someone-guess-your-mnemonic Could Someone Guess Your Recovery Seed Phrase? - TrustWallet] (Mar 9, 2023)</ref>.
	== The Reality ==		== The Reality ==

	Cryptocurrency scammers ~~will go to no end to try~~ to steal seed phrases of wallet users. One common tactic is to create a website which purports to allow you to connect your wallet, such as for support or to participate in an event. When an attempt is made to connect the wallet, the user will ~~either~~ be ~~prompted for~~ the ~~seed phrase,~~ or see a transaction failure, and ~~have the option~~ to enter their seed phrase.		TrustWallet warns about the dangers of sharing your seed phrase on their website<ref name=":4" />.<blockquote>Just like your bank account login or email credentials, your recovery phrase needs to be kept in a secure, hidden location. You need to write it on a piece of paper (or engrave it in metal) and ensure that the order of words is followed.</blockquote>Cryptocurrency scammers have many elaborate ways to steal seed phrases of wallet users. One common tactic is to create a website which purports to allow you to connect your wallet, such as for support or to participate in an event. When an attempt is made to connect the user's wallet, the user will typically be greeted with an error connecting the wallet or see a transaction/wallet failure, and be given a request to enter their seed phrase to resolve the issue.

	Many new cryptocurrency users will believe that the website is securely associated with their wallet, and ~~may not realize~~ the ~~extreme risk~~ of ~~providing~~ the seed phrase.		Many new cryptocurrency users will believe that the website is securely associated with their wallet, and that their seed phrase is only being used for the purposes of resolving the technical issue with their wallet. In reality, these websites typically send their seed phrase information directly to an attacker who can then drain all of their funds.

	One ~~such website~~ was ~~___.~~		One or more individuals created a series of Twitter accounts which were designed to push users to use one of these websites<ref>[https://twitter.com/loubapmarketing/status/1418193580007608325 LouBapMarketing - "that is SCAM" - Twitter] (May 11, 2023)</ref>. In this case, it appears there was an active attempt using the Twitter usernames:

	~~One or more individuals created a series of~~ Twitter ~~accounts~~ which ~~were designed to push users to use one of these websites~~. ~~The accounts would seek out~~		* WaIIetHelpHQ<ref>[https://twitter.com/search?q=WaIIetHelpHQ WaIIetHelpHQ Search - Twitter] (Nov 17, 2023)</ref>, which substituted uppercase Is for the lowercase Ls which are present in the standard username<ref>[https://twitter.com/CdricPoirier3/status/1417633058451230723 Seifer Almazy - "Hehe, don't worry, I noticed that. Bad quality scam try ^^" - Twitter] (Nov 17, 2023)</ref>.
			* Cihanba23827631<ref>[https://twitter.com/search?q=Cihanba23827631 Cihanba23827631 Search - Twitter] (Nov 17, 2023)</ref>.
			* MetaMaskMod<ref>[https://twitter.com/search?q=MetaMaskMod MetaMaskMod Search - Twitter] (Nov 17, 2023)</ref>.
			* Nehar98004383<ref>[https://twitter.com/search?q=Nehar98004383 Nehar98004383 Search - Twitter] (Nov 17, 2023)</ref>.

	~~often create fake accounts the mirror legitimate entities.~~		https://twitter.com/Stayhumble786/status/1417225489639428101

	~~<ref>[https://twitter.com/loubapmarketing/status/1418193580007608325 LouBapMarketing - "that is SCAM" - Twitter] (May 11, 2023)</ref>~~

	~~https://twitter.com/search?q=WaIIetHelpHQ~~

	~~https://twitter.com/search?q=Cihanba23827631~~

	https://twitter.com/Stayhumble786/status/1417225489639428101

	https://twitter.com/Stayhumble786/status/1417224783692025863		https://twitter.com/Stayhumble786/status/1417224783692025863

	~~https://twitter.com/search?q=MetaMaskMod~~

	~~https://twitter.com/search?q=Nehar98004383~~

	https://twitter.com/loubapmarketing/status/1418160593962475529		https://twitter.com/loubapmarketing/status/1418160593962475529
Line 43:		Line 34:

	== What Happened ==		== What Happened ==
	The ~~specific events of the loss~~ and ~~how it came about. What actually happened~~ to ~~cause the loss and some~~ of ~~the events leading up to it.~~		The Twitter user was phished and gave up access to their wallet which contained a total of $250k in USDC and USDT.

	~~"I got hacked (phishing ?)~~ 250k ~~few days ago FROM @AtomicWallet AND @TrustWalletApp~~ and ~~these are the transaction. [Can anyone] help me if I have chances to recover it? I'M DEVASTED~~.~~" "Any tip what should I do?"~~
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - TrustWallet Twitter Phishing Attack LouBapMarketing		\|+Key Event Timeline - TrustWallet Twitter Phishing Attack LouBapMarketing
Line 135:		Line 124:
	\|Yet Another Request For Help		\|Yet Another Request For Help
	\|Having not gotten any response from amanusk_, LouBapMarketing then requests the help of famous American entrepreneur Anthony Pompliano, this time sharing a transaction on the ethereum blockchain<ref name="loubapmarketingtwitter-9992" />.		\|Having not gotten any response from amanusk_, LouBapMarketing then requests the help of famous American entrepreneur Anthony Pompliano, this time sharing a transaction on the ethereum blockchain<ref name="loubapmarketingtwitter-9992" />.
			\|-
			\|January 16th, 2022 2:47:00 AM MST
			\|Report On Scam Group
			\|LouBapMarketing reports on a "fake and scam group from dafi protocol with a fake website" to Telegram<ref name=":5">[https://twitter.com/loubapmarketing/status/1482650697212563457 loubapmarketing - "This is a fake and scam group from dafi protocol with a fake website. Please check it out" - Twitter] (Jan 11, 2023)</ref>.
	\|}		\|}

Line 156:		Line 149:
	== Immediate Reactions ==		== Immediate Reactions ==
	There don't appear to have been any reactions between the transfers being made on July 19th and a large series of Twitter posts on July 22nd. TBD check more history on Twitter.		There don't appear to have been any reactions between the transfers being made on July 19th and a large series of Twitter posts on July 22nd. TBD check more history on Twitter.

			"I got hacked (phishing ?) 250k few days ago FROM @AtomicWallet AND @TrustWalletApp and these are the transaction. [Can anyone] help me if I have chances to recover it? I'M DEVASTED." "Any tip what should I do?"

	=== Warning By kfrazine ===		=== Warning By kfrazine ===
Line 171:		Line 166:
	== Ultimate Outcome ==		== Ultimate Outcome ==
	While LouBapMarketing reached out to multiple celebrities on Twitter, it is unclear what law enforcement entities have been contacted, and whether any investigation may be underway.		While LouBapMarketing reached out to multiple celebrities on Twitter, it is unclear what law enforcement entities have been contacted, and whether any investigation may be underway.

			The account WaIIetHelpHQ was ultimately suspended<ref>[https://twitter.com/WaIIetHelpHQ WaIIetHelpHQ Suspended Account - Twitter] (Nov 17, 2023)</ref>. The accounts MetaMaskMod<ref>[https://twitter.com/MetaMaskMod MetaMaskMod Account Deleted - Twitter] (Nov 17, 2023)</ref>, Nehar98004383<ref>[https://twitter.com/Nehar98004383 Nehar98004383 Deleted Account - Twitter] (Nov 17, 2023)</ref>, and Cihanba23827631<ref>[https://twitter.com/Cihanba23827631 Cihanba23827631 Deleted Account - Twitter] (Nov 17, 2023)</ref> were deleted.

			LouBapMarketing ultimately switched his Twitter account handle from DafiManiac0<ref>[https://twitter.com/dafimaniac0 DafiManiac0 Twitter Account (Deleted)] (Nov 17, 2023)</ref> to LouBapMarketing

	== Total Amount Recovered ==		== Total Amount Recovered ==
Line 177:		Line 176:
	== Ongoing Developments ==		== Ongoing Developments ==
	While LouBapMarketing reached out to multiple celebrities on Twitter, it is unclear what law enforcement entities have been contacted, and whether any investigation may be underway.		While LouBapMarketing reached out to multiple celebrities on Twitter, it is unclear what law enforcement entities have been contacted, and whether any investigation may be underway.

			LouBapMarketing continues to take extra time to warn others. For example, in January 2022, LouBapMarketing reported on a "fake and scam group from dafi protocol with a fake website"<ref name=":5" />.

	== General Prevention Policies ==		== General Prevention Policies ==

Azoundria: Another 30 minutes complete.

2023-05-15T21:02:34Z

Another 30 minutes complete.

← Older revision		Revision as of 15:02, 15 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/trustwallettwitterphishingattack@dafimaniac0.php}}[[File:Trustwallet.jpg\|thumb\|Trust Wallet Logo]]Twitter user "LouBapMarketing" (formerly "DafiManiac0") reported that ~~they~~ lost $90,689.000248 USDT and $154,807.136786 USDC in a phishing attack. He provided blockchain transactions dated July 19th, 2021. ~~They~~ repeatedly requested help to recover their funds. It doesn't appear that any of ~~their~~ several tweets at the time received any response, and it seems unlikely that any of ~~their~~ stolen funds have been recovered.		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/trustwallettwitterphishingattack@dafimaniac0.php}}[[File:Trustwallet.jpg\|thumb\|Trust Wallet Logo]]Twitter user "LouBapMarketing" (formerly "DafiManiac0") reported that he lost $90,689.000248 USDT and $154,807.136786 USDC in a phishing attack. He provided blockchain transactions dated July 19th, 2021. He repeatedly requested help to recover their funds. It doesn't appear that any of his several tweets at the time received any response, and it seems unlikely that any of the stolen funds have been recovered.

	== About Lou Bap Marketing ==		== About Lou Bap Marketing ==
Line 11:		Line 11:
	== The Reality ==		== The Reality ==

			Cryptocurrency scammers will go to no end to try to steal seed phrases of wallet users. One common tactic is to create a website which purports to allow you to connect your wallet, such as for support or to participate in an event. When an attempt is made to connect the wallet, the user will either be prompted for the seed phrase, or see a transaction failure, and have the option to enter their seed phrase.

	~~Scammers~~ will often create fake accounts the mirror legitimate entities.		Many new cryptocurrency users will believe that the website is securely associated with their wallet, and may not realize the extreme risk of providing the seed phrase.

			One such website was ___.

			One or more individuals created a series of Twitter accounts which were designed to push users to use one of these websites. The accounts would seek out

			often create fake accounts the mirror legitimate entities.

	<ref>[https://twitter.com/loubapmarketing/status/1418193580007608325 LouBapMarketing - "that is SCAM" - Twitter] (May 11, 2023)</ref>		<ref>[https://twitter.com/loubapmarketing/status/1418193580007608325 LouBapMarketing - "that is SCAM" - Twitter] (May 11, 2023)</ref>
Line 47:		Line 54:
	\|July 19th, 2021 1:44:06 AM MDT		\|July 19th, 2021 1:44:06 AM MDT
	\|Tether Tokens Transfered		\|Tether Tokens Transfered
	\|A blockchain transaction occurred for 90.689.000248 Tether<ref name="tronscan-9990" /> from LouBapMarketing's tron wallet<ref>[https://tronscan.org/#/address/TB4PCZPHnhBn7qTVFxxM8exWAxDusT6yAv LouBapMarketing's Tron Wallet - TronScan] (Mar 22, 2023)</ref> to the thief's wallet<ref>[https://tronscan.org/#/address/TWrPe7MrFJFPkMU68HKFitKawfHxB3tXXB Thief's Tron Wallet - TronScan] (Mar 22, 2023)</ref>.		\|A blockchain transaction occurred for 90,689.000248 Tether<ref name="tronscan-9990" /> from LouBapMarketing's tron wallet<ref>[https://tronscan.org/#/address/TB4PCZPHnhBn7qTVFxxM8exWAxDusT6yAv LouBapMarketing's Tron Wallet - TronScan] (Mar 22, 2023)</ref> to the thief's wallet<ref>[https://tronscan.org/#/address/TWrPe7MrFJFPkMU68HKFitKawfHxB3tXXB Thief's Tron Wallet - TronScan] (Mar 22, 2023)</ref>.
	\|-		\|-
	\|July 19th, 2021 2:20:12 AM MDT		\|July 19th, 2021 2:20:12 AM MDT
Line 138:		Line 145:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost has been estimated at $245,000 USD.		The total loss breaks down as follows:

			* 90,689.000248 USDT (Tether) from LouBapMarketing's Tron wallet<ref name="tronscan-9990" />.
			* 154,807.136786 USDC from LouBapMarketing's Ethereum wallet<ref name="etherscan-9991" />.

			The total amount lost adds up to 245496.137034, which has been estimated at $245,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

	== Immediate Reactions ==		== Immediate Reactions ==
	~~How did~~ the ~~various parties involved (firm, platform, management,~~ and~~/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?~~		There don't appear to have been any reactions between the transfers being made on July 19th and a large series of Twitter posts on July 22nd. TBD check more history on Twitter.

	=== Warning By kfrazine ===		=== Warning By kfrazine ===
Line 158:		Line 170:

	== Ultimate Outcome ==		== Ultimate Outcome ==
	~~What was the end result? Was~~ any investigation ~~done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?~~		While LouBapMarketing reached out to multiple celebrities on Twitter, it is unclear what law enforcement entities have been contacted, and whether any investigation may be underway.

	== Total Amount Recovered ==		== Total Amount Recovered ==
	There do not appear to have been any funds recovered in this case.		There do not appear to have been any funds recovered in this case.

	~~What funds were recovered? What funds were reimbursed for those affected users?~~

	== Ongoing Developments ==		== Ongoing Developments ==
	~~What parts of this case are still remaining~~ to be ~~concluded?~~		While LouBapMarketing reached out to multiple celebrities on Twitter, it is unclear what law enforcement entities have been contacted, and whether any investigation may be underway.

	== General Prevention Policies ==		== General Prevention Policies ==
Line 174:		Line 184:

	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individuals:~~Placeholder~~}}		{{Prevention:Individual:Never Share Private Keys}}

			{{Prevention:Individual:Double Check Transactions}}

			{{Prevention:Individuals:Store Funds Offline}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}
	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}
	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Cryptocurrency Education Mandate}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: more updated

2023-05-15T20:23:31Z

more updated

← Older revision		Revision as of 14:23, 15 May 2023
Line 10:		Line 10:
	Buy, store, collect NFTs, exchange & earn crypto. Join 25 million+ people using Trust Wallet.</blockquote>Wallets within TrustWallet are typically secured by a 12 word seed phrase<ref>[https://trustwallet.com/blog/could-someone-guess-your-mnemonic Could Someone Guess Your Recovery Seed Phrase? - TrustWallet] (Mar 9, 2023)</ref>.<blockquote>Just like your bank account login or email credentials, your recovery phrase needs to be kept in a secure, hidden location. You need to write it on a piece of paper (or engrave it in metal) and ensure that the order of words is followed.</blockquote>		Buy, store, collect NFTs, exchange & earn crypto. Join 25 million+ people using Trust Wallet.</blockquote>Wallets within TrustWallet are typically secured by a 12 word seed phrase<ref>[https://trustwallet.com/blog/could-someone-guess-your-mnemonic Could Someone Guess Your Recovery Seed Phrase? - TrustWallet] (Mar 9, 2023)</ref>.<blockquote>Just like your bank account login or email credentials, your recovery phrase needs to be kept in a secure, hidden location. You need to write it on a piece of paper (or engrave it in metal) and ensure that the order of words is followed.</blockquote>
	== The Reality ==		== The Reality ==


	Scammers will often create fake accounts the mirror legitimate entities.		Scammers will often create fake accounts the mirror legitimate entities.

Line 129:		Line 131:

	== Technical Details ==		== Technical Details ==
			A history of connected accounts can be uncovered through Twitter, which suggests multiple accounts colluded together. From the available information, it appears that they would trick potential victims into visiting an official support website for their wallet, targeting both MetaMask and TrustWallet users. The names of the official accounts mimicked legitimate sounding names. Users were provided the same information from multiple accounts, increasing it's credibility. Once users visited that website, they would be tricked into providing their seed phrase, which could then be used to drain their account.

	This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?		This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Azoundria at 17:27, 15 May 2023

2023-05-15T17:27:52Z

← Older revision		Revision as of 11:27, 15 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/trustwallettwitterphishingattack@dafimaniac0.php}}[[File:Trustwallet.jpg\|thumb\|Trust Wallet Logo]]Twitter user "LouBapMarketing" (formerly "DafiManiac0") reported that they lost $90,689.000248 USDT and $154,807.136786 USDC in a phishing attack. ~~Referenced~~ blockchain transactions ~~appeared on~~ July 19th, 2021. They repeatedly requested help to ~~resolve~~ their ~~situation~~. It doesn't appear that any of their several tweets at the time received any response, and it seems unlikely that any of their stolen funds have been recovered.		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/trustwallettwitterphishingattack@dafimaniac0.php}}[[File:Trustwallet.jpg\|thumb\|Trust Wallet Logo]]Twitter user "LouBapMarketing" (formerly "DafiManiac0") reported that they lost $90,689.000248 USDT and $154,807.136786 USDC in a phishing attack. He provided blockchain transactions dated July 19th, 2021. They repeatedly requested help to recover their funds. It doesn't appear that any of their several tweets at the time received any response, and it seems unlikely that any of their stolen funds have been recovered.

	== About Lou Bap Marketing ==		== About Lou Bap Marketing ==
	LouBapMarketing was formerly known as DafiManiac0<ref name="loubapmarketingtwitter-10010" />, a reference to his passion for the Dafi protocol<ref name=":0">[https://twitter.com/loubapmarketing/status/1403064602678681602 LouBapMarketing - "Welcome to the #DafiSummer Proud to announce to all our beloved dPARTNERS" - Twitter] (May 11, 2023)</ref>. He first joined Twitter in March 2013<ref name=":2">[https://web.archive.org/web/20230511183547/https://twitter.com/loubapmarketing LouBapMarketing Profile - Twitter Archive May 11th, 2023 12:35:47 PM MDT] (May 11, 2023)</ref>. Presently, he appears to be running a business designing various graphics for the cryptocurrency space<ref name=":2">[https://web.archive.org/web/20230511183547/https://twitter.com/loubapmarketing LouBapMarketing Profile - Twitter Archive May 11th, 2023 12:35:47 PM MDT] (May 11, 2023)</ref>.<blockquote>Create website, crypto projects, memes, pre sale, apps and evertyhing about GRAPHIC DESIGN</blockquote>He appears to have investments in both Dafi Protocol<ref name=":0">[https://twitter.com/loubapmarketing/status/1403064602678681602 LouBapMarketing - "Welcome to the #DafiSummer Proud to announce to all our beloved dPARTNERS" - Twitter] (May 11, 2023)</ref> and Secret Network<ref>[https://twitter.com/loubapmarketing/status/1351118288768659461 Lou Bap Marketing - "Now people can SEND and RECEIVE @SecretNetwork" - Twitter] (May 11, 2023)</ref>.		LouBapMarketing was formerly known as DafiManiac0<ref name="loubapmarketingtwitter-10010" />, a reference to his passion for the Dafi protocol<ref name=":0">[https://twitter.com/loubapmarketing/status/1403064602678681602 LouBapMarketing - "Welcome to the #DafiSummer Proud to announce to all our beloved dPARTNERS" - Twitter] (May 11, 2023)</ref>. He first joined Twitter in March 2013<ref name=":2">[https://web.archive.org/web/20230511183547/https://twitter.com/loubapmarketing LouBapMarketing Profile - Twitter Archive May 11th, 2023 12:35:47 PM MDT] (May 11, 2023)</ref>. Presently, he appears to be running a business designing various graphics for the cryptocurrency space<ref name=":2">[https://web.archive.org/web/20230511183547/https://twitter.com/loubapmarketing LouBapMarketing Profile - Twitter Archive May 11th, 2023 12:35:47 PM MDT] (May 11, 2023)</ref>.<blockquote>Create website, crypto projects, memes, pre sale, apps and evertyhing about GRAPHIC DESIGN</blockquote>He appears to have had investments in both Dafi Protocol<ref name=":0">[https://twitter.com/loubapmarketing/status/1403064602678681602 LouBapMarketing - "Welcome to the #DafiSummer Proud to announce to all our beloved dPARTNERS" - Twitter] (May 11, 2023)</ref> and Secret Network<ref>[https://twitter.com/loubapmarketing/status/1351118288768659461 Lou Bap Marketing - "Now people can SEND and RECEIVE @SecretNetwork" - Twitter] (May 11, 2023)</ref>.

	== About TrustWallet ==		== About TrustWallet ==
	TrustWallet is a wallet available as a browser extension or mobile download for IOS or Android<ref name="trustwallet-10015" />. The wallet was originally released in November 2017<ref name=":1">[https://golden.com/wiki/Trust_Wallet-K46X4E8 Trust Wallet - Golden.com Wiki] (Mar 9, 2023)</ref>. TrustWallet was acquired by Binance on July 31, 2018<ref name=":1" />.<blockquote>The most trusted & secure crypto wallet		TrustWallet is a wallet available as a browser extension or mobile download for IOS or Android<ref name="trustwallet-10015" />. The wallet was originally released in November 2017<ref name=":1">[https://golden.com/wiki/Trust_Wallet-K46X4E8 Trust Wallet - Golden.com Wiki] (Mar 9, 2023)</ref>. TrustWallet was acquired by Binance on July 31, 2018<ref name=":1" />.<blockquote>
			The most trusted & secure crypto wallet.

	Buy, store, collect NFTs, exchange & earn crypto. Join 25 million+ people using Trust Wallet.</blockquote>Wallets within TrustWallet are typically secured by a 12 word seed phrase<ref>[https://trustwallet.com/blog/could-someone-guess-your-mnemonic Could Someone Guess Your Recovery Seed Phrase? - TrustWallet] (Mar 9, 2023)</ref>.<blockquote>Just like your bank account login or email credentials, your recovery phrase needs to be kept in a secure, hidden location. You need to write it on a piece of paper (or engrave it in metal) and ensure that the order of words is followed.</blockquote>		Buy, store, collect NFTs, exchange & earn crypto. Join 25 million+ people using Trust Wallet.</blockquote>Wallets within TrustWallet are typically secured by a 12 word seed phrase<ref>[https://trustwallet.com/blog/could-someone-guess-your-mnemonic Could Someone Guess Your Recovery Seed Phrase? - TrustWallet] (Mar 9, 2023)</ref>.<blockquote>Just like your bank account login or email credentials, your recovery phrase needs to be kept in a secure, hidden location. You need to write it on a piece of paper (or engrave it in metal) and ensure that the order of words is followed.</blockquote>

Azoundria: Another 30 minutes complete.

2023-05-11T21:33:23Z

Another 30 minutes complete.

@@ Line 1: / Line 1: @@
-{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/trustwallettwitterphishingattack@dafimaniac0.php}}[[File:Trustwallet.jpg|thumb|Trust Wallet Logo]]Twitter user @LouBapMarketing (formerly @DafiManiac0) reports that they lost $90,689.000248 USDT and $154,807.136786 USDC in a phishing attack with transactions appearing on July 19th, 2021. They repeatedly requested help to resolve their situation. It doesn't appear that any of their several tweets at the time received any response, and it seems unlikely that any funds have been recovered.
+{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/trustwallettwitterphishingattack@dafimaniac0.php}}[[File:Trustwallet.jpg|thumb|Trust Wallet Logo]]Twitter user "LouBapMarketing" (formerly "DafiManiac0") reported that they lost $90,689.000248 USDT and $154,807.136786 USDC in a phishing attack. Referenced blockchain transactions appeared on July 19th, 2021. They repeatedly requested help to resolve their situation. It doesn't appear that any of their several tweets at the time received any response, and it seems unlikely that any of their stolen funds have been recovered.
 == About Lou Bap Marketing ==
-LouBapMarketing was formerly known as DafiManiac0. TBD fill in more description of who he is.
+LouBapMarketing was formerly known as DafiManiac0<ref name="loubapmarketingtwitter-10010" />, a reference to his passion for the Dafi protocol<ref name=":0">[https://twitter.com/loubapmarketing/status/1403064602678681602 LouBapMarketing - "Welcome to the #DafiSummer  Proud to announce to all our beloved dPARTNERS" - Twitter] (May 11, 2023)</ref>. He first joined Twitter in March 2013<ref name=":2">[https://web.archive.org/web/20230511183547/https://twitter.com/loubapmarketing LouBapMarketing Profile - Twitter Archive May 11th, 2023 12:35:47 PM MDT] (May 11, 2023)</ref>. Presently, he appears to be running a business designing various graphics for the cryptocurrency space<ref name=":2">[https://web.archive.org/web/20230511183547/https://twitter.com/loubapmarketing LouBapMarketing Profile - Twitter Archive May 11th, 2023 12:35:47 PM MDT] (May 11, 2023)</ref>.<blockquote>Create  website, crypto projects, memes, pre sale, apps and evertyhing about GRAPHIC DESIGN</blockquote>He appears to have investments in both Dafi Protocol<ref name=":0">[https://twitter.com/loubapmarketing/status/1403064602678681602 LouBapMarketing - "Welcome to the #DafiSummer  Proud to announce to all our beloved dPARTNERS" - Twitter] (May 11, 2023)</ref> and Secret Network<ref>[https://twitter.com/loubapmarketing/status/1351118288768659461 Lou Bap Marketing - "Now people can SEND and RECEIVE @SecretNetwork" - Twitter] (May 11, 2023)</ref>.
 == About TrustWallet ==
@@ Line 9: / Line 9: @@
 Buy, store, collect NFTs, exchange & earn crypto. Join 25 million+ people using Trust Wallet.</blockquote>Wallets within TrustWallet are typically secured by a 12 word seed phrase<ref>[https://trustwallet.com/blog/could-someone-guess-your-mnemonic Could Someone Guess Your Recovery Seed Phrase? - TrustWallet] (Mar 9, 2023)</ref>.<blockquote>Just like your bank account login or email credentials, your recovery phrase needs to be kept in a secure, hidden location. You need to write it on a piece of paper (or engrave it in metal) and ensure that the order of words is followed.</blockquote>
 == The Reality ==
-Twitter account Nehar98004383 was not a verified account, and asked for money<ref name="nehar98004383twitter-10012" />. TBD there are limited details here.<blockquote>"It is not verified, not offical from @TrustWalletApp and they ask money. So probably is your the scammer. People report this NEHAR profile."</blockquote>
+Scammers will often create fake accounts the mirror legitimate entities.
 == What Happened ==
@@ Line 84: / Line 105: @@
 |Lou Bap Marketing Contacts Scammer
 |Lou Bap Marketing sends a private message to (what's believed to be) a scam account, which has since been suspended, in an attempt to get help<ref name="loubapmarketingtwitter-10014" />.
 |-
 |July 22nd, 2021 5:27:00 AM MDT

Azoundria: 30 more minutes. All sources are resolved now.

2023-05-03T18:22:40Z

30 more minutes. All sources are resolved now.

Show changes

Azoundria at 17:57, 3 May 2023

2023-05-03T17:57:03Z

← Older revision		Revision as of 11:57, 3 May 2023
Line 110:		Line 110:
	\|Having not gotten any response from amanusk_, LouBapMarketing then requests the help of famous American entrepreneur Anthony Pompliano, this time sharing a transaction on the ethereum blockchain<ref name="loubapmarketingtwitter-9992" />.		\|Having not gotten any response from amanusk_, LouBapMarketing then requests the help of famous American entrepreneur Anthony Pompliano, this time sharing a transaction on the ethereum blockchain<ref name="loubapmarketingtwitter-9992" />.
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 139:		Line 142:
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?

	== Prevention Policies ==		== General Prevention Policies ==
	It appears that the wallet worked on the basis of requesting a seed phrase. When installing a new wallet, it is important to ensure that the wallet comes from an official source. As even official sources could be tampered with, it is best practice to use a wallet with a smaller amount of money initially, and to keep the majority of funds fully offline whenever possible. Using hardware wallets or multi-signature setups can further reduce the risk. With a hardware wallet, the seed phrase should only be entered in separate hardware, which is significantly more expensive and difficult to tamper with or forge. With a multi-signature setup, you can use a combination of different wallets that all must sign a transaction, meaning that all keys would need to be breached simultaneously to perform an attack.		It appears that the wallet worked on the basis of requesting a seed phrase. When installing a new wallet, it is important to ensure that the wallet comes from an official source. As even official sources could be tampered with, it is best practice to use a wallet with a smaller amount of money initially, and to keep the majority of funds fully offline whenever possible. Using hardware wallets or multi-signature setups can further reduce the risk. With a hardware wallet, the seed phrase should only be entered in separate hardware, which is significantly more expensive and difficult to tamper with or forge. With a multi-signature setup, you can use a combination of different wallets that all must sign a transaction, meaning that all keys would need to be breached simultaneously to perform an attack.

	Once an attack has happened, it is important that the wallet addresses get flagged as soon as possible, so funds can be returned if the thief decides to cash them out through a compliant exchange. Filing a police report is important as most exchanges will only freeze and return funds at the request of law enforcement.		Once an attack has happened, it is important that the wallet addresses get flagged as soon as possible, so funds can be returned if the thief decides to cash them out through a compliant exchange. Filing a police report is important as most exchanges will only freeze and return funds at the request of law enforcement.

			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}
			{{Prevention:Individuals:End}}
			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}
			{{Prevention:Platforms:End}}
			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}
			{{Prevention:Regulators:End}}

	== References ==		== References ==

Azoundria: Undo revision 4154 by Azoundria (talk)

2023-05-03T17:52:14Z

Undo revision 4154 by Azoundria (talk)

Show changes

Azoundria at 17:51, 3 May 2023

2023-05-03T17:51:21Z

Show changes

Azoundria at 18:40, 1 May 2023

2023-05-01T18:40:49Z

← Older revision		Revision as of 12:40, 1 May 2023
Line 68:		Line 68:
	\|July 22nd, 2021 1:55:00 AM MDT		\|July 22nd, 2021 1:55:00 AM MDT
	\|Request For Help From CryptoMichNL		\|Request For Help From CryptoMichNL
	\|Lou Bap Marketing attempts to get assistance from Twitter user @CryptoMichNL<ref~~>[https://twitter.com/dafimaniac0/status/1418127027178192898 LouBapMarketing~~ - "~~I got hacked (phishing ?) 250k few days ago FROM @AtomicWallet AND @TrustWalletApp and these are the transaction." - Twitter] (Dec 12, 2022)<~~/~~ref~~>.		\|Lou Bap Marketing attempts to get assistance from Twitter user @CryptoMichNL<ref name="loubapmarketingtwitter-10004" />.
	\|-		\|-
	\|July 22nd, 2021 2:33:00 AM MDT		\|July 22nd, 2021 2:33:00 AM MDT