The Anatomy of a Crypto Scam

The Anatomy of a Crypto Scam

Speakers: Nick Percoco (Chief Security Officer); Kitboga

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=uLpCI6CV3Uw

Overview

In an engaging and often humorous presentation at DEF CON, Nick Percoco, Chief Security Officer at Kraken, and Kitboga, a renowned scam baiter and YouTuber, delved into the pervasive and increasingly sophisticated world of cryptocurrency scams. Titled "The Anatomy of a Crypto Scam," their talk illuminated the tactics employed by organized crime groups and even nation-states to defraud individuals of billions of dollars. The core focus was on social engineering techniques, which, despite their low-tech nature, prove highly effective in a landscape where irreversible transactions and a lack of robust law enforcement response create a fertile ground for criminals.

The collaboration between a major cryptocurrency exchange like Kraken and a public-facing scam baiter like Kitboga offers a unique lens through which to understand and combat these threats. Percoco brought the institutional security perspective, detailing Kraken's efforts to protect its users and integrate threat intelligence, while Kitboga shared his extensive on-the-ground experience engaging directly with scammers, collecting invaluable data, and raising public awareness through entertainment. Their combined insights underscored the critical need for both individual vigilance and industry-wide collaboration to disrupt these criminal enterprises.

This talk is particularly significant given the rapid global adoption of cryptocurrency and the growing vulnerability of diverse populations, including older generations, to these schemes. By dissecting the methods, motivations, and impact of crypto scams, Percoco and Kitboga provided a comprehensive overview of a pressing security challenge, offering practical advice and demonstrating innovative counter-scamming strategies that prioritize awareness, intelligence gathering, and time-wasting tactics to mitigate financial losses and protect potential victims.

Background

▶ Watch: Humorous scam role-play opening (0:20)

The cryptocurrency landscape, while promising financial innovation, has unfortunately become a significant target for a wide array of criminal actors. Nick Percoco highlighted that the adversaries range from organized crime groups to nation-states, with specific mentions of recent run-ins with North Korean entities targeting crypto investors and industry professionals. The targets are incredibly diverse, spanning from grandmothers and grandfathers new to the space to seasoned crypto executives, indicating a broad and indiscriminate approach by scammers.

These attacks primarily fall into two categories: spray and prey tactics and targeted attacks. Kitboga provided a vivid example of spray and prey, recounting a text message he received just hours before the talk, pretending to be a crypto exchange notifying him of a withdrawal and demanding a call to a specific number. Millions of such texts are sent daily, often leveraging data from past crypto industry breaches to compile extensive lists of potential victims. The objective is simply to cast a wide net, needing only a handful of responses to yield significant returns. Percoco noted that Kraken clients have lost millions of dollars to such convincing schemes.

Targeted attacks, conversely, involve scammers who possess specific information about their victims. Kitboga described grandparent scams, where criminals know family names, addresses, and personal details, fabricating emergencies like a grandchild being in a car accident to induce panic and demand funds. Another prevalent form is investment scams, which can be highly sophisticated. Percoco shared an example of a scam targeting an entire town, where initial investors were given legitimate 10x returns to build trust and encourage widespread participation, only for tens of thousands of dollars to be eventually lost by later, larger waves of investors. These schemes are designed to "feel real," exploiting social proof and community trust.

A crucial point emphasized by the speakers is that the main focus of their discussion is not on smart contract exploits or DeFi attacks, which often require high technical expertise. Instead, they focused on social engineering, which is often "low-tech" and easier for criminals to execute. Scammers simply need a basic understanding of crypto transactions and wallet generation. The aggressive nature of these scams has escalated, moving beyond small gift card demands to targeting victims' entire 401k and other significant assets. Law enforcement faces a daunting challenge, as crypto transactions are largely irreversible, and there is no equivalent of a "Department against Scams" to match the scale of the problem. As Kitboga noted, organized crime groups are increasingly seeing scamming as an easier, less risky, and highly profitable alternative to traditional illicit activities.

Key Findings

▶ Watch: Kitboga shares his motivation for scam baiting (3:10)

The talk unveiled several critical findings regarding the current state of crypto scams and the efficacy of counter-scamming efforts:

• Pervasive Social Engineering: The most significant finding is the dominance of social engineering as the primary vector for crypto scams. Unlike complex technical exploits, these attacks rely on human manipulation, making them accessible to a broader range of criminals and highly effective against unsuspecting individuals. This highlights a fundamental vulnerability in the human element rather than just technological weaknesses.
• Vulnerability of Older Generations: A stark statistic revealed that approximately one-third of all crypto scam victims are aged 60 or older. This challenges the stereotype of crypto being solely for younger, tech-savvy individuals and underscores a critical demographic at risk, often targeted for their life savings or retirement funds.
• Organized and Global Criminal Operations: Scammers are not isolated individuals but often part of sophisticated, organized crime groups, and even state-sponsored entities. Their operations are global, leveraging data breaches for "spray and prey" tactics and employing professional, calm, and knowledgeable individuals to execute targeted attacks.
• Effectiveness of Time-Wasting and Disruption: A central tenet of Kitboga's strategy, supported by Kraken, is that wasting scammers' time at scale is a highly effective disruption technique. By tying up their resources with fake interactions, the opportunity cost for scammers increases, reducing their ability to target real victims.
• Actionable Threat Intelligence from Scam Baiting: The collaboration demonstrated that direct engagement with scammers can yield invaluable threat intelligence, including crypto wallet addresses, IP addresses, email addresses, photos, and even real identities. This data, when shared with platforms like Kraken, can lead to the identification and shutdown of active scammer accounts, as evidenced by 10 active accounts being shut down from a single batch of 1,300 wallets.
• Challenges in Law Enforcement Response: Despite the ability to collect substantial evidence and even "put criminals on a silver platter," both speakers expressed frustration with the limited success of law enforcement in prosecuting scammers. The sheer volume of cases, jurisdictional complexities, and resource constraints mean that many criminals operate with impunity, highlighting a significant gap in the global security ecosystem.

Technical Deep Dive

▶ Watch: Overview of the crypto scam threat landscape (4:40)

The technical core of combating social engineering scams, as presented, revolves around two innovative strategies: honeypot crypto exchanges and AI-powered bot armies.

Honeypot Crypto Exchanges

To gather actionable intelligence, Kitboga, in collaboration with Nick Percoco and Kraken's engineering team, developed a sophisticated honeypot system. This includes a dedicated fake crypto exchange, internally referred to as "mycoin" or "the gauntlet," and a meticulously crafted replica of the actual Kraken exchange interface.

The operational mechanics are as follows:

• Deceptive Interface: The fake Kraken site is designed to be indistinguishable from the real one from a user's perspective. It can be populated with any amount of fake cryptocurrency, such as 10 or 100 Bitcoin, creating the illusion of significant funds. This makes the "victim" (Kitboga) appear as a high-value target to scammers.
• Fake Transactions and Receipts: Scammers are led to believe they are guiding victims through legitimate crypto transactions. Kitboga might present a fake "Bitcoin ATM receipt" with a QR code, implying a successful deposit.
• Data Elicitation: During these interactions, scammers are prompted to provide their own Bitcoin wallet addresses to "receive" the funds. In their desperation to complete the perceived high-value transfer, they sometimes use key wallets where they funnel all their assets.
• Identity Capture: In highly successful instances, scammers are convinced to undergo a fake Know Your Customer (KYC) process on the "Kraken" platform. Because Kitboga or Percoco might have prior visual evidence of the scammer (from webcam feeds), they can identify when a scammer uploads their real identity (e.g., a passport) for verification. This critical information is then packaged and provided to law enforcement.

This honeypot approach is a powerful tool for intelligence gathering. For instance, Kitboga recently provided Kraken with a file containing 1,300 crypto wallets obtained through "mycoin." Kraken's analysis of this data identified 63 matching accounts on their platform, with 10 of these found to be still active and subsequently shut down. This demonstrates the direct, tangible impact of this intelligence-sharing mechanism in protecting real clients.

AI-Powered Bot Armies

Recognizing the limitations of human scam baiting in addressing the sheer volume of scam calls, Kitboga spearheaded the development of an AI-powered bot army. The motivation was to scale disruption, creating a "sea of people talking to these scammers" to effectively waste their time.

The technical evolution of the bot army is notable:

• Early Stages: Initially, the system was rudimentary, built with simple if-else statements in Python. It could respond to basic phrases like "Hello" with pre-recorded audio.
• Current State with LLMs: Today, the bot army leverages Large Language Models (LLMs) to generate highly realistic and dynamic conversations. This allows the bots to engage scammers for extended periods, mimicking human interaction and adapting to conversational flow. The voices are sophisticated enough that they don't sound like generic text-to-speech engines, enhancing their credibility.
• Scalability: The system is designed for massive scalability, with tests demonstrating the ability to run hundreds of bots concurrently using containerized setups (like Docker). The ambitious goal is to run 2,000-3,000 bots for a week, effectively saturating scammer call centers and preventing them from reaching real victims.
• Dual-Purpose Operation: The bots serve both entertainment and intelligence-gathering purposes. While some bots are programmed for humorous interactions (e.g., making scammers perform "shocked YouTube faces" for "verification"), others maintain serious conversations, focusing on eliciting information such as Zelle accounts or crypto wallets. Scammers, unaware they are speaking to AI, will often provide sensitive financial details, believing they are close to defrauding a vulnerable target.

Kraken's Internal Defenses and Intelligence Integration

Nick Percoco detailed Kraken's internal strategies for leveraging this intelligence and protecting users:

• Proactive Monitoring: Kraken employs advanced systems to monitor account activity, particularly for vulnerable demographics like users aged 90, to detect signs of scam involvement before funds are lost.
• Disruption within Platform: Percoco mentioned ongoing efforts to develop internal mechanisms to "waste a scammer's time" if an account takeover or scam attempt is identified within the Kraken platform. This could involve leading scammers through convoluted, time-consuming processes.
• Infiltration of Criminal Forums: Kraken's security team actively infiltrates criminal forums to understand new tactics, trade tools, and identify individuals involved in illicit activities. This proactive intelligence gathering, combined with data from Kitboga, helps Kraken stay ahead of evolving threats.

The synergy between Kitboga's direct engagement and Kraken's institutional security infrastructure creates a formidable, multi-layered defense against crypto scams, transforming raw scammer interactions into actionable threat intelligence and effective disruption.

Demo / Proof of Concept

▶ Watch: Real-world example of 'spray and prey' scam (6:00)

The talk included several compelling demonstrations of both the fake Kraken exchange in action and the capabilities of Kitboga's bot army, showcasing the innovative methods used to disrupt scammers and gather intelligence.

Fake Kraken Exchange in Action

The speakers shared video clips of Kitboga and Nick Percoco interacting with scammers on their meticulously crafted fake Kraken exchange. In one instance, they pretended to be an older individual and their son attempting to withdraw a significant sum – $2 million or $39,000 – from the fraudulent platform.

• Scammer Manipulation: The scammers, believing they were guiding a real victim, grew increasingly agitated as Kitboga and Percoco intentionally "misunderstood" instructions or "mistyped" Bitcoin wallet addresses. The objective was to get the scammer to input their own wallet address, which was then captured.
• Emotional Rollercoaster: One particularly dramatic clip showed scammers cheering wildly in the background, believing they were minutes away from receiving $2 million, only to realize they had been tricked. Another scammer, visibly distressed, exclaimed, "I am dead now," highlighting the intense emotional investment criminals have in these schemes.
• Intentional Frustration: The speakers demonstrated how deliberately messing up the long and complex Bitcoin addresses, or feigning confusion about the withdrawal process, could drive scammers to extreme frustration. One scammer was heard repeatedly pleading, "You have the wrong wallet, ma'am! You have the wrong wallet!" while another was almost brought to tears. This tactic, dubbed "the customer is always right" (ironically applied), proved highly effective in wasting the scammer's time and exposing their true intentions.

Bot Army Demonstrations

Audio examples of Kitboga's AI-powered bot army were played, illustrating their realistic conversational abilities and their capacity to frustrate scammers at scale:

• Realistic Voices: The bots engaged scammers with natural-sounding voices, making it difficult for the criminals to discern they were speaking to AI.
• Humorous and Disruptive Interactions: Some clips showcased bots engaging in absurd conversations, such as asking a scammer to make a "shocked YouTube face" for "human verification" – a requirement programmed into Kitboga's fake system to complete a transfer. This not only provided entertainment but also served to waste significant scammer time.
• Anger Elicitation: The bots' ability to maintain a conversation while intentionally being unhelpful or confusing led to scammers becoming incredibly angry and resorting to expletives and threats, demonstrating the emotional toll these interactions take on the criminals.
• Covert Intel Collection: Beyond the entertaining interactions, the bots were shown to be effective at covertly collecting information. While maintaining a convincing dialogue, they could prompt scammers to volunteer sensitive data like Zelle accounts or crypto wallet addresses, which are then harvested for threat intelligence.

These demonstrations underscored the dual utility of Kitboga's methods: providing engaging content for his audience while simultaneously acting as a powerful, scalable tool for intelligence gathering and operational disruption against scam networks. The raw, unscripted reactions of the scammers provided undeniable proof of the efficacy of these counter-scamming tactics.

Defensive Implications

▶ Watch: Example of a targeted grandparent crypto scam (6:50)

The insights shared by Nick Percoco and Kitboga offer critical defensive implications for individuals, cryptocurrency platforms, and even law enforcement agencies.

For Individuals

• Prioritize Awareness and Education: The most crucial defense is understanding how these scams operate. Individuals, especially those new to crypto or older generations, must be educated on the common tactics, such as fake withdrawal alerts, investment promises, and grandparent scams. Never assume you are immune; scammers target everyone.
• Do Not Engage Unsolicited Contact: The general advice from security experts and even Kitboga's legal counsel is to avoid engaging with unsolicited calls or text messages from unknown sources, particularly those claiming to be from financial institutions or law enforcement. Responding confirms you are a "live body" and can lead to your number being sold to other scammers.
• Verify Independently: If you receive a suspicious message or call about your crypto account, do not use the contact information provided by the caller. Instead, independently look up the official contact details for your exchange or financial institution and reach out directly through verified channels.
• Be Skeptical of "Too Good to Be True" Offers: Exorbitant returns (e.g., "10x returns") or high-paying, easy-to-get job offers that require an upfront investment are almost certainly scams.
• Protect Personal Information: Be mindful of data breaches. Scammers often use publicly available or stolen personal information to make their attacks more convincing. Limit what you share online and use strong, unique passwords for all accounts.
• Community-Level Education: Consider participating in local initiatives, such as seminars at libraries or retirement homes, to educate vulnerable populations on privacy and security basics. Even simple advice on Facebook privacy settings or recognizing phishing can make a significant difference.

For Cryptocurrency Platforms (like Kraken)

• Robust KYC/AML and Fraud Detection: Platforms must implement and continuously enhance their Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures to prevent scammers from creating accounts with stolen or fake identities. Advanced fraud detection systems are essential to identify suspicious transaction patterns, especially for accounts linked to vulnerable users.
• Integrate External Threat Intelligence: Collaborating with researchers, scam baiters, and other external entities to receive and integrate threat intelligence (e.g., scammer wallet addresses, IP ranges) is vital. This data allows platforms to proactively block transactions, flag suspicious accounts, and shut down criminal infrastructure.
• Proactive User Protection: Implement mechanisms to protect users who might be falling victim to scams. This could involve temporary holds on suspicious withdrawals, direct outreach to users showing signs of being manipulated, or even "time-wasting" features within the platform to delay scammers while users are alerted.
• Internal Disruption Strategies: Explore ways to disrupt scammers who manage to gain access to accounts (e.g., through account takeovers). By making them believe they are making progress while actually delaying them, platforms can buy time to intervene and secure the user's assets.
• Continuous User Education: Actively educate users through in-app notifications, blog posts, and support resources about current scam trends and best practices for security.

For Law Enforcement

• Allocate Greater Resources: The sheer volume and financial impact of crypto scams necessitate a significant increase in dedicated law enforcement resources, including investigators trained in cryptocurrency forensics and social engineering tactics.
• Enhance International Cooperation: Given that many scam operations are transnational, effective prosecution requires stronger international collaboration between law enforcement agencies to overcome jurisdictional challenges.
• Streamline Prosecution Processes: Efforts are needed to simplify the legal and procedural hurdles that currently impede the prosecution of cybercriminals, even when compelling evidence is provided by entities like Kraken.
• Focus on Organized Crime: Recognize that many crypto scams are run by sophisticated organized crime groups and treat them with the same priority as other serious criminal enterprises.

By adopting a multi-faceted defense strategy that combines individual vigilance, robust platform security, and improved law enforcement capabilities, the security community can collectively work towards mitigating the devastating impact of crypto scams.

Key Takeaways

• Social Engineering is the Primary Threat: Crypto scams predominantly leverage social engineering tactics, making them a low-tech yet highly effective method for criminals to defraud victims of billions of dollars.
• Older Generations Are Highly Targeted: A significant portion of scam victims are individuals aged 60 and above, underscoring the critical need for targeted education and protective measures for vulnerable populations.
• Time-Wasting Disrupts Criminal Operations: Innovative techniques like AI-powered bot armies and honeypot exchanges can effectively waste scammers' time, reducing their operational efficiency and capacity to target real victims.
• Intelligence Sharing is Crucial for Disruption: Collaboration between security entities (e.g., Kraken) and scam baiters (e.g., Kitboga) generates actionable threat intelligence, such as scammer crypto wallets and identities, which can be used to shut down active criminal accounts and infrastructure.
• Law Enforcement Faces Significant Challenges: Despite substantial evidence and intelligence being provided, law enforcement struggles with the volume and international nature of crypto scams, leading to limited prosecutions and a sense of impunity for many criminals.
• Vigilance and Education are Paramount for Individuals: Individuals must remain highly skeptical of unsolicited communications, verify information independently, and actively participate in educating themselves and their communities to prevent falling victim to these pervasive schemes.

About the Speaker(s)

Nick Percoco serves as the Chief Security Officer at Kraken, one of the leading cryptocurrency exchanges. With an impressive career spanning over 30 years in security, Percoco is a seasoned veteran of the industry. He has been a consistent presence at DEF CON, marking his 26th year attending the conference and his 11th time speaking. Beyond his corporate role, he is also the founder and creator of Thought Con, a hacker conference based in Chicago. His seven years in the crypto industry, all spent at Kraken, provide him with deep insights into the unique security challenges of the digital asset space.

Kitboga is a widely recognized YouTuber and streamer known for his unique approach to combating online scams through scam baiting. His journey began nearly a decade ago after his grandparents, both suffering from dementia and Alzheimer's, were repeatedly exploited by scammers. Kitboga's motivation is to waste scammers' time, preventing them from targeting other vulnerable individuals, particularly the elderly. Over the past 8-9 years, he estimates he has engaged with approximately 50,000 scammers. His content, which combines humor with education, has garnered close to 4 million YouTube subscribers and billions of views, making him a significant voice in raising public awareness about various scam tactics, including tech support, grandparent, and investment scams.