Analysis of Trending Scammer Chatter on the Dark Web

THE CHATTER: After scammers successfully commit a crime, what do they do with the money? Most often, they invest it in cryptocurrency. That’s because transactions in crypto are anonymous and it’s an easier and safer place for scammers to store their ill-gotten gains than a traditional bank account. Though nowadays many regular retail and even institutional investors invest in crypto, it largely got its start in the criminal community. Scammers use channels on Telegram and similar services to get and dispense advice on which cryptocurrencies to invest their stolen money in. Criminals –unlike the average investor – by and large have a better understanding of crypto because they’ve been dealing with it for eight to 10 years and they’re better able to anticipate and take advantage of the massive price fluctuations that are common with crypto. Unless regulation kills crypto - cybercriminals are better situated to make money in this area than most regular investors or speculators. 

As anyone who invests in the space knows, we are in the midst of what is being called a “crypto winter.” Prices for every coin have dropped dramatically over the past several months. Bitcoin, for example, was worth nearly $45,000 at the beginning of April and prices are now hovering around $20,000. This crypto crash has hindered the ability for regular investors and fraudsters to withdraw their money; during this crypto crach many exchanges – including the largest, Coinbase – restricted or outright denied their clients from withdrawing money as prices collapsed. 

Here are the top cryptocurrencies (based on dark-web conversations) where scammers are parking their money….

1. Bitcoin - The original, and by far most valuable, cryptocurrency. While all cryptocurrencies are prone to potentially massive price fluctuations, bitcoin could be said to be the most “stable” among all of them. 
2. Ethereum - Where most scammers keep their investments. Along with bitcoin, a generally stable and valuable coin among cryptocurrencies.

      …and washing their money

1. Monero - Popular with cybercriminals because it is fully anonymous, as it uses privacy technology to obfuscate transactions. Among the criminal crypto community, there are expectations the price will shoot up massively in the next 12-18 months. 

The most chatted about cryptocoins amongst the scammer set in dark web investment communities:

1. Solana: Has been around since April 2020, which is fairly lengthy in crypto terms. It is among the top 10 cryptocurrencies by market cap. Its utility is to build other tokens, trade NFTs, and facilitate an NFT marketplace (which is the same utility as Ethereum, except Solana is faster and cheaper, trading at around $40 versus $1,500 for Ethereum)
   1. “I already put everything into Solana,” says one scammer on Telegram. Many are expecting Solana to go through the roof because it is an Ethereum competitor, with some speculating it could reach as high as $500, reaching that goal once the crypto winter ends.. 
2. Flokinomics 2.0: This coin has been around since the fall of 2021. It doesn’t have a utility (like virtually all cryptocurrencies) but sentiment is a big play here and powers its popularity. It is a clone of another popular memecoin, Dogecoin. Flokinomics 2.0 is on the BSC blockchain and a decentralized network that rebuilds the payments stack on the blockchain. It is used primarily in NFT transactions. 
3. Parsiq: Parsiq helps build Web3 protocols. It calls itself “the glue” that connects blockchain applications and real world applications. Has been around since April 2022. It is an Ethereum-based token and its utility is that it allows users to initiate various workflows or notifications if and when a certain event takes place. 
4. FOTA: An acronym that stands for “Fight of the Ages” and was launched just in May. Its utility is that it uses the BSC smart chain to build a gaming platform in the metaverse; where each user can create their own avatar to use in the game. There is a lot of chatter about this coin among cybercriminals on Telegram with one saying “a little bird tells me a FOTA pump starts soon.” What this means to the scammers: get in now while you can. 

WHO’S BUYING: 740 people in this Telegram investment group. 

VERIFICATION: This is a verified seller. The lead cybercriminal has been advising on crypto investments for at least three years.

HOW IT WORKS: When cybercriminals cash out from their online scams, like phishing, account takeover attacks, return fraud, ransomware, and inventory hoarding, they then take those “earnings” and invest in crypto. Cybercriminals are advising other scammers where to invest, similar to how retail investors use Reddit or other forms of crowdsourcing for investing advice. 

STAT of the WEEK: $100,000: How much one cybercriminal is investing in Flockinomics. 

Here are a few companies cybercriminals are talking about on the dark web, when it comes to investing their ill-gotten gains: 

1. Coinbase: 

1. 1. Users got spooked when they were unable to withdraw to a bank. Even though the situation was fixed, users remain cautious waiting to see if Coinbase has stabilized.  

2. Crypto.com

1. 1. 1. Slashed earn rates for the 5th time by lowering its stablecoin earn rate.
      2. Transfer fees were 15x and 154x higher than Coinbase this week
      3. Slashed card cashback rates
      4. Scammers are wondering how liquid crypto.com is as it slashes rates and increases fees.

3. Binance:

• Dealing with Iran
• Failed to deliver on money laundering prevention promises

QUOTE: Arkose Labs Chief Criminal Officer Brett Johnson: “Many crypto investors –which includes scammers – are crypto rich but cash poor. We’re seeing this now. We are also seeing large exchanges limiting or denying the withdrawal of money. They don’t have the liquidity. Being an unregulated industry, cryptos are allowed to do that. 60% of new legitimate investors have dropped out because they’re scared of the industry.”