Michael Saylor Giveaway Scam

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

YouTube

A Coinbase customer was tricked into sending 26 BTC to a scammer who created a convincing-looking MicroStrategy website and live-stream on YouTube. There is no indication any funds were recovered. The specific website and channel were taken down within a few hours, however the scammers continue to break into more accounts.

The country for this case study is not yet known.

About MicroStrategy

"MicroStrategy is the largest crypto investor in the world. The company is developing software for data analysis using artificial intelligence algorithms. MicroStrategy turnkey solutions are used for business decision making and mobile software development."

"The company has more than 124,000 BTC worth over $5,000,000,000."

The Reality

“One of the most popular and effective types of scams in which the scammer promises to return multiple times the amount of cryptocurrency the victims sends to them. Giveaways scammers will pretend to be a famous person or to represent a trusted company in order to gain the victim’s trust and are mostly active on Youtube, Telegram and Twitter.”

Social media scammers often introduce themselves as Michael Saylor and offered investors to double their investment.

"Details from Scam Alert reported that this was a very effective ploy frequently carried out by scammers promising high returns on cryptocurrencies sent to their addresses using the faces of popular individuals. Furthermore, it was revealed that the 26 BTC was sent over five transactions."

What Happened

One gullible user "pecked" at an offer from "Michael Saylor" of "doubling" their 26 bitcoin. "A payment of 26 #BTC (1,124,191 USD) was just made to a confirmed Michael Saylor Giveaway scam!" "It represents the single largest payment made to this kind of scheme."

Key Event Timeline - Michael Saylor Giveaway Scam

Date	Event	Description
October 20th, 2021 8:00:00 AM MDT	Google Blog Post	Google Blog reports about phishing campaigns targeting YouTube creators with cookie theft malware.
October 21st, 2021 2:08:18 AM MDT	HiTechGlitz Report	HiTechGlitz reports a summary of the Google Blog article.
January 15th, 2022 8:10:00 AM MST	Whale Alert On Twitter	Whale Alert notes the payment made on the blockchain.
January 16th, 2022 10:43:11 PM MST	BeInCrypto Article	BeInCrypto reports on the incident.
January 17th, 2022 2:07:15 AM MST	FXEmpire Article	FXEmpire reports the breach. This was reposted on Yahoo Finance.
January 17th, 2022 2:30:00 PM MST	The Market Periodical Article	The Market Periodical reports on the incident.

Technical Details

"Speaking of the attacks, which he has been following for two years, Google says that fraudsters sent emails to content creators on YouTube with a proposal for cooperation. Once the channel owner agreed, the scammers sent a link to malware that appeared to be a legitimate URL." "Google provided an example of one of the phishing emails, and it shows that the hackers will ask the YouTube creator to try the product. In reality, the product is a ploy to trick the victim into installing malware on their computer."

"The attackers created more than 1,000 websites to increase the chances of fraud, including some that were presented as company sites that actually exist, including sites with Cisco VPN and Steam games. One of the websites was presented as a site with “Covid19 news software”. Google has linked to fraudsters about 15,000 accounts registered for this campaign alone and used to send phishing emails to YouTube channel owners, with links to victims to download malware."

"We suspect this payment was made through a #Coinbase address."

Total Amount Lost

The total amount lost has been estimated at $1,124,000 USD.

Immediate Reactions

"A payment of 26 #BTC (1,124,191 USD) was just made to a confirmed Michael Saylor Giveaway scam!" "It represents the single largest payment made to this kind of scheme."

"Whale Alert reported the incident using their official Twitter handle at about 3 p.m. UTC, stating that a user had lost about 26 BTC to scammers that had created a fake giveaway posing as MicroStrategy head and Bitcoin Evangelist Michael Saylor."

Ultimate Outcome

"We suspect this payment was made through a #Coinbase address."

"YouTube has since shut down the channel operated by the scammers. The website has also stopped functioning and reports an error message when opened. The loss represents one of the largest single payments for this kind of scheme."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

According to Michael Saylor, "489 of these scams were launched on YouTube last week. We report them every 15 minutes and they are taken down after a few hours, but the scammers just launch more…" "According to the businessman, MicroStrategy is trying to track them and send complaints, after which YouTube removes the videos."

Individual Prevention Policies

Individuals need to take care to ensure that any offer they receive is legitimate and makes sense. In this case, it would not have taken much digging to determine that this was a fraud.

Any time that you are promised any profit or benefit in exchange for an initial payment, smart contract approval, or deposit, pay special care as to whether the entity making that offer is trustworthy, actually who they say they are, and has the means to fulfill what they're promising. There are no magic algorithms providing guaranteed returns from trading or mining. Trading on average will lose money. Mining is expensive and complex. No one is going to immediately send back more than you sent them. NFT projects will rarely announce a surprise mint in only a single location. Are you fully prepared for the event your money is kept and nothing is delivered in return?

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Better education for new cryptocurrency users could prevent this situation. For example, a simple quiz to explain common types of scams. If this could be standardized, then users would do it once and it would apply to all platforms. Platforms could also delay withdrawals to check outgoing addresses, as these types of scams are typically uncovered within a few hours.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.