Beware of crypto scams

The crypto world can be pretty daunting. For non-technical people, all the talk about blockchains, coins, tokens, DeFi, NFTs, etc can be pretty overwhelming. The industry is incredibly young and most companies have not been around for long. Half of them haven’t yet shipped a working product and instead start trading based on a multi-phase roadmap of promises (that they will hopefully deliver on). Add the occasional scam like a pump-and-dump, rug pull or some news of plain old crypto wallet thefts and you start questioning whether investing in crypto is worth the risk.

High risks tend to lead to high rewards though. When you see 18 year old TikTok’ers raving about their $100,000+ gains in a weekend, driving fancy cars and having boat parties, you can’t blame people for getting curious and wanting their share of those quick wins for themselves. Which is where things get dangerous…

MrCoin🚀’s opinions (not financial advice)

TikTok is full of opinions on crypto. From well established and trusted influencers to the “wanna be” kid next door, they all have their opinions on the market direction, technical indicators, or newest crypto coins that will turn you into a billionaire. And in the midst of all that, are the fake scam accounts like @mrrcoins aka “MrCoin🚀” with 134K followers and 883K likes… after a mere 17 videos posted.

A fake TikTok account called MrCoin

“MrCoin🚀” caught my eye because the videos show a tool “finding” BTC in abandoned wallets. Easy money! Or a little too easy?!

I also recognised the person in one of the videos as another TikTok’er @foundblanc so at a minimum there was some content stealing going on here.

The MrCoin🚀 profile info had a link to a Telegram account, which isn’t exactly uncommon these days, but makes @mrrcoins virtually impossible to trace back to a real person.

Always think twice about trusting anything said or requested by someone that doesn’t want to reveal who they are in real life.

DarkMine BTC wallets with mnemonic (seed) phrases

The telegram account belongs to a differently named user @dark364 aka “DarkMine” with 9294 subscribers. It claims to offer a free and paid version of the tool we saw in the TikTok videos.

The messages showed a history of tool updates, up to V7, with seemingly useful feature additions that help build the trust that is a long-running and trustworthy project. They also offer a free version so you can trial it before committing to the $60 private version.

Given BTC trades at USD$50,864 today, $60 would be a bargain if the tool found even a single wallet!

It also provides a detailed explanation on how the tool supposedly works:

• A seed-phrase is a list of random 12 words (taken from 2048 words known as the BIP-39 word list), for example: ocean powder train melody shield license keen moment hidden elephant palace trial
• The seed-phrase can be used to recover your BTC wallet in case you loose your password or the device that holds your wallet.
• The tool attempts to brute-force the seed-phrase for wallets, at 20 million combinations a day

If it really was this easy, would we have a multi-billion dollar crypto industry today?!?

The instructions claim that anti-virus tools interfere with the software and you should turn off your AV before running DarkMine.

This should be a massive red flag. Always run an anti-virus and never turn it off!

My favourite part is when they try to convince you that this is totally legal because “whoever owns the digital signature is the owner” and “it is impossible to prove ownership of a wallet”. So when you do find the seed-phrase to a wallet “the decision to take or not to take, it is up to you”.

If you need to write a one-page FAQ about the legalities, it probably isn’t completely above board or all that honest and straightforward.

There is a contact page linked to obtain the paid version, which goes to another Telegram account by a user @dmsup or “MaxDM”.

A Telegram search also reveals a second Russian “DarkMine” account by @coin364 (which is running behind schedule and offers only V5.2 of the software).

That’s 4 different accounts with completely different handles, which isn’t how branding is typically done. This is rather likely done to obfuscate that these are owned by the same individuals and avoid take-down of all accounts at once.

Agent Tesla and the entire malware family

Suspicions aside, we are still blindly hoping to make millions, right!? So let’s have a look at this DarkMine software up-close.

I grabbed the downloads for all DarkMine versions offered on the Telegram account. All the downloads follow a similar folder structure, but the specific files present and folder names vary slightly. There is often a Guide.txt file present with instructions on how to start the app (and to make sure you turn off anti-virus first!) and a DStart.bat to start the tool.

I tested each DarkMine version in a secure sandbox environment(with anti-virus turned on of course). As expected, the anti-virus wasn’t too happy with DarkMine as each version of DarkMine is loaded with malware [links to VirusTotal]:

DarkMine-V4.rar

• DarkStart.exe
• DriverUpdate.exe
• WalletUpdate.exe

DarkMineV5–1.rar

• DarkStart.exe
• DriverUpdate.exe
• WalletUpdate.exe

DarkMineV5–2.rar

• DarkStart.exe
• DriverUpdate.exe

DarkMineV5–3.rar

• Ch2.exe
• softain.exe

DM v5.4.rar

• RTCore.exe
• VCEAMF.exe

DM v5.7.rar

• RTCre.exe
• VCEAMF.exe

DM v6.1.rar

• qt_ko.exe
• VCEPreset0.exe

DM v6.4.1.rar

• wabimp.exe
• QSV.exe

DM v7.rar

• VCEAM.exe
• qtlt.exe

Across the various malware are included key loggers, Remote Access Tools (RATs), and Crypto miners.

In short, if you run this software, they will steal your BTC and use your computer for crypto mining to boot.

Mesmerising streams of BTC

The anti-virus killed the software immediately so we didn’t get to see the tool in action. With AV turned off, we are shown a never-ending stream of crypto wallet addresses and mnemonic seed phrases. I didn’t let the software run for long but according to the sales brochure it should recover a BTC wallet seed phrase eventually.

Let’s think back to that sales brochure though. We have 2048 words and need to discover 12 words to make up a seed phrase. That’s 2048¹² or 5.444517870735015e39 potential combinations. If you are not familiar with scientific notation, that is 5,444,517,870,735,015,000,000,000,000,000,000,000,000 possible combinations to test a single BTC wallet.

The tool promises 20,000,000 million combinations per day which is well short of the prior number. Despite this, the tool shows us new BTC addresses flashing before our eyes indicating each brute-force attempt took less than a second (let alone a day!) to complete.

Quite simply, the math just doesn’t add up. This is totally impossible.

Even if the tool could theoretically work, why would they share the money with you? Especially if you are using the free version? It is much more likely they would send the discovered seed phrases back to HQ and claim the BTC wallets for themselves.

Remember, if it’s too easy and too good to be true, it’s probably a scam.

Digging deeper

I have not had (and probably never will have) the time to reverse the malware or software and see what IoCs are present that might reveal the actors underlying infrastructure. If you are a whiz at x86 and MSIL reversing and want to have a closer look, let me know.

I have reported the accounts to TikTok and Telegram but at the time of writing no action has been taken and all accounts are still active. Don’t get duped!