Darkcryptomoon Ethereum NFT Con Man

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

MetaMask

Darkcryptomoon is an American father and user of multiple cryptocurrencies, heavily interested in NFTs. On November 13th, 2021, his wallet was emptied of both Ethereum and purchased NFTs. Darkcryptomoon has not publicly provided any evidence of an investigation by law enforcement, provided limited details on the exact nature of the breach, and all indications suggest that no funds have ever been recovered. While Darkcryptomoon has taken on a vocal stance against decentralization and ethereum as a result of the incident, he remains a supporter of blockchain technology and NFTs.

About Darkcryptomoon

Darkcryptomoon is a father who has worked for 10 years for the state as an attorney. His political views are largely democratic. As of December 23rd, 2021, he is still repaying his student loans and also has a mortgage on his house. He feels he's been defrauded by both his hospital and his government. He has been a Reddit user since at least February 20th, 2019.

He has used both Coinbase and GateHub. He still uses is heavily critical of the Coinbase cryptocurrency exchange due to a lack of support and a separate incident where he lost his seed phrase. He has investments in Bitcoin, Ethereum, GoodDollars, Algorand, Solana, and Flow, though he is critical of Ethereum. He is a very strong and persistent advocate and supporter of NFTs. He has investments in NBA Top Shot as his first NFT since late January 2021. He has since purchased others including PaniniNFT, a gambling ape NFT, and a crypto dad NFT. He doesn't believe that NFTs make sense as a tool for money laundering.

It's a way to prove ownership of a digital item. For instance, if you want to flex how much money you own, you may buy a Rolex or really expensive Nikes. But how do you do that in the metaverse? You buy a RTFKT pair of shoes (now part of Nike) or a BAYC/Crypto Punk. Another example would be some clubs and casinos in the MV require you to own one of their NFTs to get in and participate. Why not just require a regular old username and password? Because the NFTs accomplish the same thing, but with much more transparency (being on the Blockchain). Another example would be traditional basketball cards vs digital basketball cards (NFTs). Some people will never want to switch to a digital version if the collectable, because they need to be able to feel the card...similar to traditional books vs ebooks.

It seems like you are saying why even have the Blockchain involved, when you need a third party site to even really decipher the code anyways, since you have to trust the third party site..... I guess I'd say that since it's on the Blockchain, there are so many of these third party sites all saying the same thing, that it would have to be a massive conspiracy to somehow get all of them to unify in a single scam perfectly, which is extremely unlikely (similar to how hacking a Blockchain would be extremely difficult AFAIUI). Or maybe I'm just not understanding what exactly you're saying.... It just all seems like code... Online banking...online stock trading....online anything...it's all code... NFTs/blockchains just add more transparency, right? Is there a much better option that provides the same transparency we should be using?

About MetaMask

MetaMask was developed in 2016 by ConsenSys Labs. MetaMask describes itself as a "the leading self-custodial wallet. The safe and simple way to access blockchain applications and web3. Trusted by millions of users worldwide." The application is available and widely used as a mobile application and browser extension.

"Available as a browser extension and as a mobile app, MetaMask equips you with a key vault, secure login, token wallet, and token exchange—everything you need to manage your digital assets."

The Reality

Self-custody of funds comes with increased responsibility and risks, including the risk of potentially losing all funds if the private keys are not kept secure.

What Happened

While the exact mechanism by which Darkcryptomoon's wallet was breached is unknown, we can determine from the blockchain that the theft of the Ethereum did not happen through a smart contract. Combined with the fact that Darkcryptomoon also reports multiple NFTs have gone missing from the same incident, the most likely cause of the exploit is an exposure of the seed phrase or private keys. Darkcryptomoon reports his MetaMask wallet was hacked and there is no indication that a hardware wallet was used, which allows for the possibility of both malware or entering the seed phrase into a fake wallet.

Key Event Timeline - Darkcryptomoon Ethereum NFT Con Man

Date	Event	Description
March 18th, 2021 11:26:16 PM MDT	First Ethereum Wallet Funding	Darkcryptomoon's ethereum wallet is used for the first time, with a micro-transfer of 0.00742926 ETH.
September 4th, 2021 9:23:35 AM MDT	Minting of OneDayPunk NFT	The first time that Darkcryptomoon's wallet minted it's first non-fungible token, OneDayPunk #702.
September 5th, 2021 11:11:36 PM MDT	Withdraw and Mint GamblingApe NFTs	Darkcryptomoon withdraws an additional 0.36482706 ETH from Coinbase and mints 3 GamblingApe #1639, #1640, and #1641.
September 7th, 2021 10:26:36 PM MDT	Minting CryptoDads NFTs	Darkcryptomoon mints CryptoDads #1464, #1465, and #1466.
September 9th, 2021 7:25:53 PM MDT	CryptoDads #1466 Transfer 1	CryptoDads #1466 is transferred from Darkcryptomoon's hot wallet to a second wallet under his control.
September 9th, 2021 7:54:14 PM MDT	CryptoDads #1465 Transfer 1	CryptoDads #1465 is transferred from Darkcryptomoon's hot wallet to a third wallet under his control.
September 10th, 2021 4:50:22 PM MDT	CryptoDads #1466 Transfer 2	CryptoDads #1466 is transferred from Darkcryptomoon's second wallet back to his hot wallet.
September 10th, 2021 4:56:18 PM MDT	CryptoDads #1466 Transfer 3	CryptoDads #1466 is transferred from Darkcryptomoon's hot wallet back to his second wallet
October 10th, 2021 4:07:12 PM MDT	CryptoDads #1466 Transfer 4	CryptoDads #1466 is transferred from Darkcryptomoon's second wallet back to his hot wallet.
October 10th, 2021 5:06:48 PM MDT	Sale of CryptoDads #1466	CryptoDads #1466 is sold to another NFT collector for 1.32 ETH, presumably by Darkcryptomoon.
October 15th, 2021 8:02:11 AM MDT	Thief Creates Wallet Initially	The reported thief first transfers funds to their wallet. There hasn't been any interaction between the thief and Darkcryptomoon yet.
October 20th, 2021 8:49:00 PM MDT	CryptoDads #1465 Tranfered Back	The CryptoDads #1465 is transferred back from Darkcryptomoon's second wallet back to his original wallet.
October 20th, 2021 11:39:49 PM MDT	Sale of CryptoDads #1465	CryptoDads #1465 is sold to another NFT collector from his original wallet for 0.635 ETH, presumably by Darkcryptomoon.
October 26th, 2021 9:22:21 PM MDT	Sale of CryptoDads #1464	CryptoDads #1464 is sold to another collector for 0.98 ETH, also presumably by Darkcryptomoon.
October 27th, 2021 4:01:55 AM MDT	Funds Transferred From Binance	It appears that the thief has withdrawn a small quantity of funds from Binance, suggesting that they my have an account with KYC information.
November 2nd, 2021 3:28:26 PM MDT	First Remitano Transfer	The thief moves some funds (not related to this specific theft) into their Remitano account.
November 5th, 2021 9:57:24 PM MST	Assisting drdrew450	Darkcryptomoon assists another Reddit user drdrew450, who accidentally overpaid for an NFT.
November 13th, 2021 9:38:16 AM MST	Theft Transaction	A blockchain transaction transfers 0.969052970191778852 ETH to the reported thief address.
November 13th, 2021 11:58:37 AM MST	GamblingApe #1639 Stolen	The GamblingApe #1639 was transferred from Darkcryptomoon into the thief's wallet.
November 17th, 2021 1:18:34 AM MST	Reddit Bounty Offer Posted	Darkcryptomoon posts details of the theft on Reddit, and additionally offers a "reward if the funds were recovered". It does not appear that anyone responded to his, post except another scammer.
November 24th, 2021 2:28:55 PM MST	Funds Moved To Another Wallet	The thief moves the ethereum from the main wallet to their Remitano wallet.
November 26th, 2021 4:01:23 PM MST	Final Transfer To Remitano	The thief moves the funds into a Remitano service wallet address.
December 15th, 2021 12:12:00 AM MST	Discussion About Scams	Darkcryptomoon posts a long list of ways that users can get scammed including NFT airdrops, Discord links, fake support staff, one related to sending transactions, and a hardware wallet linking scam.
December 28th, 2021 9:18:51 AM MST	More Discussion About Scams	Darkcryptomoon posts in response to another user's losses that it's "[o]ne of the thousands of scams" and that "the majority of new scams don't require your password or seed phrase to wipe your account".
December 29th, 2021 7:34:45 PM MST	Speaking Out Against Decentralization	Darkcryptomoon posts against decentralization and describes Ethereum as a "scammers paradise". "There are zero deterrents and zero punishments for people stealing your money".
December 31st, 2021 8:28:43 AM MST	Still In Favor of Blockchain	Darkcryptomoon posts that he's still in support of the blockchain "[b]ecause there's much more transparency".
December 31st, 2021 10:13:36 PM MST	Speaking Out Against Ethereum	Darkcryptomoon responds to a post about Solana with a heavy bash against Ethereum. In this post, he reveals that the NFTs taken were all ethereum-based.
March 3rd, 2022 6:39:19 PM MST	Scammer Replies To Reddit Post	A fraudster named Thuokl responds to recommend contacting a "proficient recovery expert".
March 3rd, 2022 6:44:14 PM MST	Response To Scammer	Darkcryptomoon responds to the fraudster in a less than nice manner.
March 5th, 2022 5:41:56 PM MST	Warning To Billyfudpucker	Darkcryptomoon responds to Billyfudpucker's post to warn him about not responding to any private messages from individuals as they are likely also scammers.
July 16th, 2022 11:05:34 PM MDT	Response To Another Theft Case	Darkcryptomoon describes the thefts as "a major con of decentralization. Endless new scams. Endless new exploits. Endless new hacks."

Total Amount Lost

Darkcryptomoon described his losses as 0.97 ETH in addition to $2,300 worth of NFTs. A blockchain transfer for 0.969052970191778852 ETH to the reported thief's address was located.

He stole 0.97 ETH from me. Looks to just be sitting there. He also stole some NFTs valued at about $2,300.

The closing market price for ethereum on November 13th, 2021 was $4,651.46 USD. This approximates the value of the ethereum taken at $4,507.51.

The NFTs are described by Darkcryptomoon as ethereum-based with a value of "about $2,300". The following NFTs have been noted as removed from Darkcryptomoon's wallet at the time of the attack:

• Gambling Ape #1639. This item was resold multiple times since, however is presently no longer available on OpenSea.
• Knights of Degen #3673.
• OpenSea Shared Storefront.
• 2545 By Gr4y #3509.
• One Day Punk #702 - This is presently owned by OpenSea user 6897 and has never been sold.
• CryptoMom #602.

Combining the ethereum with the reported $2,300 in NFTs, the total amount lost has been estimated at $7,000 USD.

Immediate Reactions

Very little is known about the immediate reaction of Darkcryptomoon. He reports having filed a report with the FBI through their "IC3" interface, however the specific timing of that is presently unknown.

"My MM got hacked. Filed a report with the FBI, never heard anything back. It's a hackers/scammers paradise right now...no one can do anything as far as I found.... Just a bunch of people saying they want to help, but trying to scam me for even more of my money."

Darkcryptomoon posted to Reddit 4 days after the theft transaction, offering a bounty to help trace the funds. He reports receiving no legitimate offers to help, and multiple scams from people claiming they want to assist him.

The con man's eth address is 0x9A4d2F9E0A2BBBaDA7161fB5A053a6BDDcD06897

He stole 0.97 ETH from me. Looks to just be sitting there. He also stole some NFTs valued at about $2,300.

I have the Twitter account, website, email he used also, if needed. And yeah, there would be a reward if the funds were recovered, but I understand it's probably not enough to make it worthwhile for anyone. Thought I'd try anyways.

Ultimate Outcome

Since the incident, Darkcryptomoon has been extensively researching other types of scams. He has repeatedly spoken out about Ethereum and decentralization in general. However, he is still in support of blockchain technology. He has expressed preference for centralized chains and Proof of Stake.

One of the thousands of scams. This is the problem with decentralized chains like Ethereum... There are no deterrents/punishments for scammers, so scammers are incentivized to come up with more and more effective scams. The same people making fun of you could very likely fall for a future scam and get made fun of by new users. No one can do anything about it. No one will do anything about it. All you can do is watch how the scammer spends your money. Don't fall for anyone trying to help you get your money back. White hat hackers are a myth unless you've lost millions and willing to pay them millions. Ethereum is becoming a cess pool.

You do realize that the majority of new scams don't require your password or seed phrase to wipe your account, right? And dear gawd I hope you realize the scams will only continue to get more sinister and wipe more and more people's account clean. You can keep laughing and ignoring the reality until it's your turn.

Decentralization comes with its own problems though... Ethereum is becoming a scammers paradise. There are zero deterrents and zero punishments for people stealing your money. And this incentivizes these thieves to come up with more elaborate ways to steal your money... It's not just about accidentally giving up your seed phrase anymore, there's all sorts of new scams hitting the chain. I fear that soon there will be so many new scams the chain will ultimately fail leaving only centralized ones.

Sorry OP.... Many many people have had the same thing happen. It's a major con of decentralization. Endless new scams. Endless new exploits. Endless new hacks. Because there's no way to punish these evil people they will just come up with more ways to steal people's money and there's nothing anyone can do except know all the different ways to protect yourself at all times no matter the new ones that come out. Ethereum is becoming a wasteland.

Ethereum has some major problems that people know about, but choosing to not pay heed to. 1) The ridiculous gas fees. 2) The complete lack of any deterrents or punishments for scammers. There's absolutely nothing anyone can do if a scammer steals all of your ETH/Eth-based NFTs... So there's a big incentive to keep coming up with more elaborate and believable scams. It's not just giving up your seed phrase anymore, and the scams will constantly become more numerous and nefarious. Ethereum will also play a part in the crypto community, but when more adoption happens, I think people will ultimately prefer a more centralized chain that can offer more support and customer service, along with near zero fees, instead of upwards of $4,000 in fees you have with peak gas wars on Ethereum. Ethereum badly needs to be dethroned, and Solana is a top contender (along with Flow and Cardano IMO).

"There's zero punishments for scammers and hackers... These decentralized chains incentivize thieves to come up with more and more hacks, because they get off with your money scot free. Sad stuff."

Darkcryptomoon has spent some time reaching out and assisting other fraud victims, warning them not to respond to private messages.

Anyone DMing you offering to help or telling you to contact "this person" is trying to scam you again. There is not going to be anyone that can actually help you, I know from first hand experience. File a report with the FBI (https://www.ic3.gov/) and try and track the movements of your stolen crypto...when they move it to an exchange,.contact the exchange and have the crypto frozen (most likely they will ignore you).

There does not appear to have been any response to their bounty thread. Darkcryptomoon reports that there was no response from the FBI.

OpenSea Delisting

Some of the stolen assets have been delisted on OpenSea, and now display the warning:

The item you tried to visit is no longer available on OpenSea. It will not be visible or accessible to anyone browsing the marketplace

Total Amount Recovered

As of July 17th, 2022, it does not appear that any recovery has been obtained.

Ongoing Developments

There does not appear to be any investigation nor recovery in progress. Darkcryptomoon did not respond to a request for further information via Reddit.

Individual Prevention Policies

The exact nature of the theft is not disclosed. Thefts of this nature can be defended against by storing funds offline, not sharing private keys, and verifying executables.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

Private keys can be obtained through seed phrases, mnemonics, private key files, mobile synchronization screens, wallet export features, wallet backups, etc... Never ever send these to anyone else who you do not intend to allow to take all of your money. Attackers will use a wide variety of tactics to convince you like pretending to be your wallet software, pretending they work for the wallet software, or asking you to screen share. Don't fall for them.

Any time untrusted software is being run is an opportunity for abuse. It is recommended to always interact with cryptocurrency in a fully controlled environment, which is an environment where you have understanding of every piece of software running there. Using a hardware wallet, spare computer with all software wiped, and/or virtual machine with only the needed software greatly reduces your attack surface. Take the time to verify downloaded files come from the correct and expected source and match available hashes if provided. Any time you encounter a new file, always check if it can contain executable code prior to using it.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.