What You Need to Know About Telegram’s HoneyPot Scam

Telegram’s huge popularity has led to the messenger becoming a breeding ground for “cryptoscammers.” One of the most popular HoneyPot scams allows attackers to trick new and existing crypto community members or ordinary users into giving them money, writes RBC Crypto.

What is HoneyPot, what factors contribute to this scheme, how to protect yourself from it – explains Grigory Osipov, Director of Investigations at Shard.

What is HoneyPot

Translated from English, HoneyPot means “bait”. The idea behind this scheme is that a fraudster creates a cryptocurrency project on attractive terms for potential victims. At the same time, the project has one goal – to steal money, personal data or confidential information from victims.

Let’s look at several factors that contribute to this type of fraud:

From a psychological point of view, most HoneyPot projects are based on scammers playing on the feelings of users.

• Lost Profit — “All my friends have long since gotten involved and made money on crypto projects, but I haven’t figured it out yet.”
• Greed and the desire to increase one’s capital — especially when this is supported by aggressive advertising from famous bloggers who suggest investing in supposedly safe projects.

The key factor that attackers exploit is complete ignorance of the principles of functioning of investments, blockchain projects and smart contracts. Many “digital investment products” are advertised as mass projects or are designed to attract inexperienced users or teenagers with simple game mechanics. This is how they attract those who have never dealt with this before.

As a rule, the scheme begins with the user being convinced that investments are easy and safe. You can play a little for a small amount, which is not so bad to lose. However, then the scammers start psychological manipulations, put pressure on the user. As a result, the victim not only voluntarily gives them all their funds, but also takes out loans.

Even more experienced users can fall for the scammers’ bait. Here, the total failure to observe digital hygiene and neglect of basic safety rules becomes critical.

In addition, the pseudo-anonymity of both the messenger itself and cryptocurrency transactions contributes to the growth of fraud in Telegram using cryptocurrency.

How Scammers Trick Users into HoneyPot

There are several common ways to get involved in fraudulent schemes.

• The “promoted” nature of the Telegram messenger itself — since the project was created on the basis of coins associated with such a large project, there can be no risks.
• Aggressive advertising campaign of many coins and projects; pushy and sales advertising, calling through several channels to invest in a new, “very promising crypto project”.
• Mass “processing” of subscribers of target Telegram channels who are interested in trading, mining, investments. Fraudsters lure victims with the possibility of direct contact with project managers in separate chats or add users to a group where they will be processed.
• The closed nature of groups with projects creates a sense of individuality, an atmosphere of a community “for one’s own”, which only fuels the desire to part with hard-earned money.
• Transition to the HoneyPot project through related topics. For example, through training in trading, cryptocurrency basics, financial literacy. As part of the courses, those interested are offered to simultaneously invest in a new promising project.

HoneyPot Project Mechanics and Examples

Let’s look at how scammers implement the HoneyPot scheme.

Own coin

The most typical case of HoneyPot is the creation of its own cryptocurrency token (coin). The token is called the same as any global project that major market players plan to launch.

The purchase of fake tokens is facilitated by an advertising campaign conducted by the creators of real coins. Victims expect to the last to earn well if they invest, for example, in a coin before its official release. When the real token comes out, the victims understand that all the funds have been transferred to the scammers and are left with a fake coin.

It is possible that you will even purchase a token and it will be displayed in your wallet. The illusion of owning an asset is created. But you will not be able to sell or exchange it.

Recent examples include: fake ZKSync token. The real token of this project was listed on exchanges in June and was widely covered in the media due to the excitement around it in the cryptocurrency community. The scammers claimed to have financial information and, amid the general excitement, offered traders to buy the token before the listing. Specifically to involve people in the fraud, the attackers bought the Mensa_trader Telegram channel, which they promoted for about a month.

The scam consisted of traders allegedly under the control of “insiders” through the PancakeSwap exchange purchasing a fake ZKSync token and waiting for June 17, 2024, to list the coins and receive the airdrop. However, the traders did not receive any payments.

The fake ZKSync token was bought by about 1,000 people. Due to the fact that the coin cannot be sold, the damage from the actions of fraudsters amounted to at least $1 million.

Bookmark in smart contract

Another variant of the scheme is when scammers create and promote their own cryptocurrency coin with a so-called bookmark in the smart contract itself. It contains conditions under which confirmation of transactions and withdrawal of funds are carried out only by the owner of the contract, and not by the owners of the coins. At the same time, changes to the smart contract can be made not from the moment of creation of the token, but only after some time.

With such an ace up their sleeve, scammers not only involve as many participants as possible in their project, but also pump up the price of the coin as much as possible. Then they get rid of it at the peak of its value, collapse it, which does not allow any of the users to sell the “left” token. As a result, the scammer earns money both by purchasing his token and by selling it at the maximum price.

A striking example of this type of HoneyPot is a project from a year and a half ago trader Issy (@issatrade, @issatraderbt) He spent several months to build up his own Telegram channel audience of 57 thousand people and gain their trust.

To do this, the blogger:

• analyzed the crypto market;
• gave restrained forecasts about the quotes of major currencies and tokens;
• He insisted that he was not calling on anyone to enter into specific transactions that could be risky.

At some point, Issa offered his audience to purchase their own TECH, X100 and ISC tokens through the Pancakeswap exchange, the price management of which, as well as the withdrawal of funds, was available only to the creators of the contracts. The project’s investors, apparently, neglected security measures: the contracts were designed to make it impossible to withdraw coins. This was taken advantage of by the fraudulent creators, who zeroed out the liquidity pool of the contracts and withdrew funds mainly through the FixFloat ($1.3 million) and Binance exchanges.

In general, events in a HoneyPot scheme often follow the following sequence:

1. Fraudsters buy an existing, popular Telegram channel with a certain audience using the auction model through exchanges. The lots specify the number of participants, the current audience, and the price. The larger the audience, the higher the price of the channel. Sometimes about 100 thousand people on the channel are enough to not worry about the reliability of the resource.
2. The channel administrator usually acts as the contact person for the scammers. Most often, this may be a front person. However, in fact, a whole group of scammers is working on the scheme.
3. When a certain audience is already “warmed up”, the attackers create or buy a similar channel with the same audience. Only now, instead of an administrator, bots work.
4. At the last moment, the user name of the main channel is transferred to the channel with bots. A fake token is placed on the main channel. And access to it for other users is limited. Accordingly, even if the user wants to file a complaint about the scam, it will arrive on the channel with bots.

How to Protect Yourself from HoneyPot

To avoid becoming a victim of such schemes in Telegram, follow the recommendations.

• Conduct an audit of the smart contract of the coin you want to invest in through free or paid audit services.
• Check out the official websites or social media pages responsible for the token you want to purchase.
• Check out verified trader ratings.
• Check the information about the channel’s creation time: are comments disabled on it, is any information deleted.
• Analyze the information posted on the channel via Google or Yandex Images – this will help you distinguish real data from fake.
• Check the channel administrator to see when their page was created, for example through the Nicegram resource.
• Even if you were provided with copies of passport data, do not think that this is some kind of security guarantee. Such copies can be drawn through special services and even forged through regular Photoshop.
• For greater security guarantees, ask the channel administrator to record a voice message for you and take a photo with a piece of paper and your initials. This will help verify the reality of the person on the other side of the screen. Subsequently, such data can help to deanonymize the scammer.
• Document all your actions: take screenshots, collect any information about your own and other people’s transactions. If you are deceived, you yourself or with the help of a specialist will be able to fully restore the picture of what happened and use the data to identify the fraudster.

If you do fall for the scammers’ tricks and lose your funds, contact digital asset security specialists and law enforcement agencies as soon as possible. Prompt action can often help block funds stolen by scammers. However, after a while, there will be nothing left to block.

Stay up to date! Subscribe to World Stock Market on Telegram.