Tay πŸ’– Profile picture
Sep 22, 2020 β€’ 48 tweets β€’ 24 min read β€’ Read on X
understand the power of a telegram group. Even a tele full of non-devs who can't even register a domain name. 🀫
Ffs I get some work done and it went from like 20 ppl without a token name or a domain name or a fucking clue to 600+ people begging for drops.

This is for sure the future of finance folks.

🀫 ImageImageImageImage
The F U T U R E of finance folks. πŸ˜‚πŸ˜‚πŸ˜‚ ImageImage
If you're the type of person who sees a cashtag on twitter and immediately buys it I would strongly recommend burning your computer. It's far less proactively selfdestructive and will hurt less. 😳
lol im caught up in this entire mess because someone was trolling @AlexMasmej πŸ˜‚πŸ˜‚πŸ˜‚πŸ˜‚πŸ˜‚ Image
Okay seriously this was annoying the fuck out of me bc based on what I saw when I looked at the chat for like a literal minute around 2pm PT, there was no way this was or was going to be an actual thing.

Yet an hour later I'm blasted on all sides by outraged anon degen dudes.
The easy answer is frogs are salty cuz they missed out. But. In order to miss out...wait...how the fuck did this thing that maybe had a name, still had no url, no devs, how did it launch a token and give it to people and get it on uniswap and pump the price in an hour?
Everyone in the chat i know & most I've met irl like @AlexMasmej @defidude @sassal0x @Steven_McKie. Sure, some can get a bit defi shilly overly excitable, but never ill willed.

But shit doesn't pump on accident. So I got added to a group by some seriously schemey schemers???!
So I'm looking for this token thats pumping or whatever but I can't find shit. There's no uniswap links. Every uniswap mention is a joke.

Watch this tho. Here's the first 4 uniswap mentions. It's all faces and jokes. ImageImageImageImage
11:45: chat starts
12:55: 50 people
12:58: jokes about $cashtags $antimeme
1:20: jokes. Oops we haz no url.
1:36: literally no one knows what's going on
1:46: no srsly wat is this?
1:58: did everyone get tokens? Everyone: no
2:26: wait how are more ppl joininh?
Now, watch how fucking fast this happens. At 2:30 there are still less than 100 people.

At 2:36 a flood of ppl enter from a link somewhere. And the entire chat is now faceless.

By 3:19, there are 579 people. ImageImageImageImage
Now here's where it gets really weird. At 2:50 I was like "lol this is gunna blow up in my face bc of course it would"

Still no links to Uniswap or anything.

At 3:40 a string of tweets some at me fast with just straight shit talk.

Search again and now there's a link. Sort of.
From Jordan. Who saw it being blasted in the chat. And it's fake.

At 3:11. Image
And so fast forward and I'm going back trying to figure this all out and it's insane.

The outrage faceless dudes are not salty bc they missed out on something. Nothing ever happened.

They're pretending to be salty to create hype to shill their fake #few token in replies. ImageImageImage
Every uni link share is like the above. Not like known folks making jokes.

Bull scammers are creative.

Theres nothing more powerful than greed and FOMO but theres nothing more sharable than outrage.

And y'all fell hard. Even I thought something pumped.
Here's zoom in on the transition from fucking around with friends to "uhhh what"

2:33 pm is earliest I can tell that a link got posted somewhere. 100 people is hit. And um. Yuck. ImageImageImageImage
2:45pm
Fake FEW contract is created. ImageImageImageImage
2:48pm
Fake few contract creator approves on uniswap

2:49
Fake few contract creator creates $15k worth of liquidity

So it took *4 minutes* to create a fake token and add liquidity (aka "get it listed on uniswap") ImageImage
Interestingly, 5 hours after putting it on uniswap (7:29pm my time), contract creator registers an ENS name: fewfi.eth.

Which means he's still shilling this scam somewhere. ImageImage
Whooooa.

Okay so fake FEWunderstand (aka fake few) on Etherscan: etherscan.io/dextracker?q=F…

Find first trade: etherscan.io/tx/0xd3e4a74cf…

See this contract thing that doesn't hit the router like normal? etherscan.io/address/0xebb4…
so thats weird. but yeah i wanted a scam token list.



apparently no one has a scam token list.

so i made a scam token list using 0xebb4 and his buddies.
its a fucking list tho. ImageImageImage
like a fucking serious ass list. Image
and most, if not all, of these were created and liquidity was added to uniswap after 7/1/2020. and most, if not all, appear to be scam tokens.

theres prob more, i just stayed in the etherscan.io/txs?a=0x93438e… bubble and he didnt exist 78 days ago.
because if you go outside the 0x9343 bubble you find shit like this: etherscan.io/address/0x54db…

1. fresh addy grabs 1100 eth from okex (i think)

2. creates new token: etherscan.io/address/0xacd0…

3. provides liquidity on uniswap for 5 mins

4. exits to fresh address

5. 2 eth richer.
i found that happening over and over. how?

we'll i'd end up looking at a page like etherscan.io/token/0xacd049…

which i found from our buddy etherscan.io/address/0xebb4… (the guy 5 tweets up trading few) Image
so thats fucking insane af. dunno what it is or means tho. 🀷

address dump

center: 0x93438e08c4edc17f867e8a9887284da11f26a09d

contracts of his:
0x21e479e62603a3ea0b6dc687cb86b9938d39a3dd
0xa23636dd7b1517e12088fb8c5b364c735111f979
0x1c72e0fbf8beb4e933c86cbb5d7b84879cd0fe69
...
0xb73815f5f055073c93d4332fb53dc01d82778dde
0xb88a1b2ab0deb0df1d62cef5176deb3bb5488d11
0x2d32705504e6baddf3cfe13409a07b60a320a48d
0x4c3a9e1ddf2eae499b60374b6415c9dedbb70991
0x354576b4b0a56bdc5af677e5cba04b2eec6d4778
0xf2f8b15133973fce4ce30ec2989ff0bcf0052e0d
...
0x7098c1c07e313a3c3be616f82119cd22ddcc796c
0xa96e2806a6fb7f504b04f6df549c4c7b0a100b2e
0x5410dd15121b7e26b04470b57dcf11bc1ea4602e
0x950543e41294700e8a249a5e692bd5325bb87228
0xebb4d6cfc2b538e2a7969aa4187b1c00b2762108
.
controllers/holders for 0x9343:

0xacb78b259f5edb9746baf5c13e9a59439418f8da
0xcde19c6a93ba8bd102bdb5fae0a8ea2ba203a89c
0x21067d95d4c157904be5380194325d0e93619d6b
0x17083be979a080e80d158218b5c17b118fc0a4cb
🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷🀷
token list gist.github.com/tayvano/aa4759…

its NOT edited to remove non-scam tokens. there are some they use as pairs (e.g. tether, weth, uni, etc.)
shit and like random ass names dont always help so heres the token list with tx hash so you can find a scamcoin, visit the tx hash, and then explore from there.

gist.github.com/tayvano/676f10…

e.g.
, = etherscan.io/token/0x6afde9…
okay heres how to explore.

1. pick random line. like line 46:
0x1a01145b2fb2253311f9231534c872f69a34c1fa2bb1bef255e30dc601bf6c96,ABSOLUTELY NO DUMPS,AND
2. go to the tx hash provided:
etherscan.io/tx/0x1a01145b2…

3. look at token: etherscan.io/token/0xc64f78…

4 holders, 12 transfers

4. find creator / lp:
etherscan.io/address/0x3984…

5. dump other contract creation txs.

etherscan.io/tx/0xb2a174e87…

etherscan.io/tx/0xa974a9c1c…
6. see more scamtokens

NFR - 1 day ago - 1 holder - 3 transfers etherscan.io/token/0x109400…

YFN - 1 day ago - 2 holders - 8 transfers
etherscan.io/token/0x02cbd1…

7. read contracts, find owner:

etherscan.io/address/0xa07b…

more fucking scam tokens!
one TX hash from the above list will give you 5 or 10 or 100 random ass scamtoken thingies and a pile of new LPs and creators and fund sources.

im so beyond bewildered at the scope of this.
New token list from same data with new data:

Token contract address
Token name (etherscan)
Token symbol (etherscan)
Holder count
Transfer count
# of times appears in list
Notes

Sorted by holder count.

gist.github.com/tayvano/7f8373…
hello darkness my old friend 🎡

okay but seriously i just legit bought these Astro tokens AND I DO NOT BUY TOKENS to get the full features and in 5 minutes it zelda sounded me abt a new listing and BAM LOOK WHO IT IS?!

Our buddy 0xebb4!!!!!!! Daamn @Astro_Tools serves my needs. ImageImageImage
Okay so I'm now watching what I saw happen last night except now its in real time and happening right now and my gosh all you poor thirsty souls searching for a quick buck and getting rekt. 😭😭😭😭😭😭😭😭 ImageImageImageImage
TBH I feel like @Astro_Tools knows me or something. This is my jam.

Anyways. In the last hour 0xebb4 has created

SEX: 0xf64b9b18960c880bf644b6935943ded700f265b6
ISN: 0x321e1dee2c4593f0b74435f3eec35716fe1004f7
APPL: 0xf79fd7cb710513e76b9cdc079da89cff10846efb Image
And 0xebb4 has also created

MINI: 0x00d81f53505e1b9486aff9ec916a419786a29057
FACE: 0xab847caefdb4e925efc32eff4716a1d3e8f3b464
GOG: 0xd0a8b4ff60023745e9f02ad4723d405445a88c72
COPE: 0x28ad99d6929709c11fc85e6c3636373fe63e5415

So 0xebb4 is 7/9 new tokens on uni in the last HOUR. ImageImageImage
LOL this other scammer 0xb13fe3ed1557359ebdf856278576bdb0c2de9df5 has created 4 separate fake ISN scams with the same-same-but-different-name in the last couple hours

etherscan.io/tx/0xcc1268b44…

etherscan.io/tx/0x796f2ab68…

etherscan.io/tx/0x00f1edd5a…

etherscan.io/tx/0x75e58ca20…
If you guys havent had a chance to check out @etherscan's latest kickass feature, you can now see how much an account spends on tx fess.

Also, our scammer buddy 0xebb4's controller 0x9343 spends ~8ETH / day on TX fees. ~232 ETH aka ~$90,000 since july 7 2020. ImageImageImage
Last update for a bit. 3 more scam tokens, all from 0xebb4.

scamMANY
0x750fb06c7e160b5efdee53696ca327bd37fa62b4

scamROMG
0xf89d14675c227390f9e2329f26a70db65b6336bd

scamYFMS <-got some bites?
0x6413be89fcd25050fd6d51b4e04e4e22b16848ea

1 hour. 14 new tokens. 11 by 0x9343/0xebb4 ImageImageImageImage

β€’ β€’ β€’

Missing some Tweet in this thread? You can try to force a refresh
γ€€

Keep Current with Tay πŸ’–

Tay πŸ’– Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @tayvano_

Apr 10
🧡Highlights from the UN Security Council's 2023 report on DPRK

This one was a whopping 615 pages 😳

These reports are always like a birds eye view of random, raw, deep intel. They're amazing and shed light on attribution, irl banking networks, etc.

un.org/securitycounci…
re: MaybachsImage
Image
Image
Read 25 tweets
Jan 1
Orbit Bridge Hack looking v methodical πŸ‘€

Looks like 2024 is going to be another year of handing DPRK billions of dollars on a silver platter. πŸ™„

embarrassing af. Image
Attacker
0x9263e7873613ddc598a701709875634819176aff

Funds Holders
0x009b60aab8e64c8f5fe449bd96fa78b1a7fffcc5
0x3a886a63c768665a9830886e608d6f9dc6b4f730
0x817bb1761b715a08a9142f99fa7d0ccf73f4c0ef
0x157a409c2bfff38209a32e55d3eac1bfc93dd664
0x5e22cb028865d6a93080d7ab42d2fe9a0e8dc085
0xd283fa3bd85887725c8982f539cc404a450f7fd9
0xf49de491e1c0d84a0e0bd2d57a841825fcf179fd
0x589257e07e11e761f31956d54b2323f63ee36b7d

Receivers
0x009b60aab8e64c8f5fe449bd96fa78b1a7fffcc5
0x3a886a63c768665a9830886e608d6f9dc6b4f730
0xa70f8917a957757f5505a5535df1591c54f65b9d
0x9ca536d01b9e78dd30de9d7457867f8898634049
0xdadfa3ccd40fc3d5a0164c6f9444f60163ccbf3b

Intermediaries
0x0c43edeb2ee69c27d689e912ab5b8e8eef128d4c
0x42839f4423985b5ef989498b0605b1dcca8f0df1
0xe03d37392255fd1dae5476b04388315cc70b78c2

Attacker Funder (from TC)
0x70462bfb204bf3ccb0560f259072f8e3a85b3512

Instaswapper Depo from Attacker
0xbad82ca05bd3d40b783d39e52abc1446f33aae12

Instaswapper Receiver on XRP
rN7EFW25YcGG6nzRY4W7TbX5tRyngW1Dj1
happy new year
Read 9 tweets
Jul 10, 2023
When it comes to financial crime, money laundering, etc. everyone goes thru a phase of thinking that the solution is knowing the identity of the account holder.

"if only we knew who moved these assets! then we would be able to catch them and stop crime!"

N O . twitter.com/i/web/status/1…
Literally NO.

It doesn't work at any scale. It's never worked at any scale. It never will work at any scale.

AML laws and all the related shit don't stop crime or money laundering. And it never has.

And it's really important to note that the implementation is NOT the issue.
The laws are *designed* to detect and block people from accessing the financial system.

And they do exactly that. Really well. So well in fact that like 1/4th of the world's population doesn't have a basic ass bank account.

And the impact of this is horrifying.
Read 25 tweets
Jun 14, 2023
A thread of misc. interesting things related to the Atomic Wallet hack, Lazarus, and especially what sprawling hacks look like on-chain.

(this thread is gunna get into the weeds. i suggest the other thread if you want something shallow and easy-to-digest πŸ˜‰)
On Fri June 2nd, thousands of Atomic Wallet users had their wallets drained across basically every chain.

Each theft involved 1-3 new addies. Initially we were only able to link thefts on-chain if they sent gas to multiple addresses.

(green guys are what we put alerts on first) Image
The lack of consolidation means the majority of addresses collected so far came direct from users sharing their info w/ folks like @zachxbt or w/ Atomic, @elliptic, @SlowMist, etc.

We have no idea how complete our lists are currently, or how long the long tail will be.
Read 23 tweets
May 24, 2023
⚠️ Heads up y'allβ€”we're seen a huge increase in the # of ultra-targeted spearphishes lately.

The most deadly one? A Google Doc share that appears to come from *someone you know* about *something you're interested in*

It won’t be flagged and looks super legit.

DO NOT CLICK! πŸ™ Image
This campaign is the work of #Lazarus / #APT38 / #DangerousPassword / #T444

aka the same crew that compromised Ronin, Harmony, bZx, Bondly, EasyFi, mngr, Arthur0x, Hugh Karp, etc. etc. etc.

Their spear-phishing methods are diverse, targetted, and hard-to-detect. Image
Recent subject lines / filenames:

Fast Changes in NFT Price (Protected)
Investor Demo Day-Animoca Brands (Protected)
Jump Crypto Investment Agreement
New Credit Investment Opportunity
Spirit Blockchain Capital 2023 - Pitch Deck

Opening the file *may* result in something like: ImageImageImage
Read 10 tweets
Apr 18, 2023
For the past 48hrs I've been unwinding a massive wallet draining operation 😳😭

I don't know how big it is but since Dec 2022 it's drained 5000+ ETH and ??? in tokens / NFTs / coins across 11+ chains.

Its rekt my friends & OGs who are reasonably secure.

No one knows how. Image
Specifically we are in contact with a handful of victims from July and August who each individually lost between $400k and $4m.

In fact, the amount stolen per victim seem to be increasing over time.

Where the average amt stolen per victim was ~$50k in April, it's now $300k+
The victim profile remains the most striking thing.

They truly all are reasonably secure.

They are also deeply integrated into this ecosystem: employees of reputable crypto orgs, VCs, people who build defi protocols, deploy contracts, run full nodes, and have ENS name*s*
Read 23 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(