How to Stop Crypto Scams from impacting your Community and Users with Nikita Varabei

safety around if you're building in like an NFT project, a DeFi project, any sort of layer one, you probably have a community of users and I'm just going to give a chat on how you can improve your personal safety and the safety of all of your users. Uh so I'm Nikita. Um I'm currently the founder of Chain Patrol. Uh we're actually a company focused on take preventing malicious links and scams and kind of that that area in the space like all those fake airdrops. Uh previously I worked on Coinbase um and before that was running another startup.

Uh we actually started chain patrol because uh through discord me and one of my other co-founders we lost an NFT worth quite a lot of money uh due to some impersonation scams. They were impersonating a founder of another project that we thought we were working with and you know I got so angry I decided to start Train Patrol. Um so you know we we'll jump through the intro stuff very quick but basically you know what are what are these types of scams try to do? They'll try to get your users to enter their seed phrase. They'll impersonate your support or support from other companies.

Um, they'll attempt to get you to sign a malicious transaction that usually has a bad allowance or tries to transfer all of your funds away. Um, or they'll just try to send your assets to an impersonator where it's just, you know, a simple uh, you know, with with our case it was sending NFT to somebody. We thought it was a founder, but they actually, you know, they were somebody else. Uh, some common attacks, you know, you've probably seen all these on Twitter. There's a lot of uh you know basically don't trust anything you're tagged in on Twitter or DMs or Discord DMs.

Um almost every single NFT project, DeFi project has these. It's you know we are launching a free mint. Uh and they basically just lead you to a website that will try to scam you. There's admin impersonation. Never trust DMs on Discord even though if it looks like it's coming from a founder.

Uh they'll use the same profile picture. Um, in our case, even using the same Discord ID was a um, you know, Discord has an internal ID that is actually unique, but the names that they use, uh, like their name and those numbers can actually be spoofed and copied over across users. So, don't trust that. Um, and then there's hacked accounts. So you know even something like uh Twitter verify check mark or even like this like golden check mark which is only meant for businesses is actually not safe.

Uh many businesses get hacked then they'll swap over for example what happened with cool cats. Another big business was uh hacked like not cool cats themselves that had the golden check mark. They swapped over all their assets to impersonate Cool Cats uh and basically stole a couple hundred thousand dollars from uh from Cool Cat's owners. And if you're uh if you're running your own uh you know you're running your own community or you have discord admins you uh are a founder or somebody within this community um be very careful on your personal security and we'll go into some tips on that in a second but make basically you know here what happened with looping uh you know one of their admins was hacked and started uh spreading this looping.gg GG um announcement in their channel that went out to all of their users.

And basically they were getting their funds stolen from them. Um and this is especially difficult because it's coming from a trusted source rather than from you know like kind of an obvious scam on Twitter. Uh so the first step is like protecting yourself. Um the fir one thing I'd recommend is there's a lot of great security extensions out there. I mean, everybody's probably heard of Revoke.

cash by now. Uh, but there's a lot of really great extensions out there as well. There's Pocket Universe, Fire, Wallet Guard, Stell. All of them have a bit of different takes, so you'll you can try out which one you like, but a lot of them have things like transaction simulation, uh, blocking out malicious addresses, um, also finding things like bad allowances you've set on your account. Uh, I highly recommend having at least one of these installed.

Some I I have like multiple just because uh they they're kind of like some are great in one area, some are great at transaction simulation, other artists are really good at fishing sites. Um so I'd recommend trying out a bunch of these. Um Discord personal security, just turn off DMs from every server you join. You know, there's no reason to have them on. Um, if you like really really need to, um, there's probably other channels you can like contact people on or you can maybe like temporarily turn them on if it's really necessary with somebody you've been chatting with, but generally turn them off by default.

Um, and we're going to go into some like strategies for protecting your own community as well. So, something I I've seen like very like not used enough in a lot of both NFT and DeFi projects is like a good use of Discord bots. I'd highly recommend this one called Wick. Um, it's, you know, it has some of the most like I'd say thorough protection. They do everything from protecting you against nukes.

So, for example, if somebody does get admin privileges in your Discord, they can actually protect you from your whole server getting deleted, which would suck. Um they also have you know automatically blocking uh impersonators of your admins um uh locking down your server if somebody was hacked. They'll basically prevent anybody from sending messages. Um, and they also have kind of like um an interesting way of like kind of group immunity where if somebody was a known bad actor in another server and they try to join your server, they'll automatically be blocked or at least highlighted to you that they uh have been kind of banned from other servers. Um, also highly recommend doing a Discord audit.

So, this is like something that I've seen very few places do, but it's getting more popular. Uh, is there's actually professionals out there that know all the steps it takes to make a really secure audit. They'll look at all your roles, your permissions, um how your team is set up. Uh and I recommend a place called Server Forge. They've got a b they basically train a bunch of people have like certified auditors on this stuff and they're just a really good um overall a good team to uh kind of work with.

Um and then there's educating your own community, right? I think a lot of people like even like seasoned crypto people like don't have certain best practices in mind or don't know like how to kind of live within this space. Um there's you know announcements you can make yourself. Uh you should definitely have a scam report channel but now almost every Discord server does but some some don't. Um, bots can also give your users automatic notifications.

Like for example, there uh I think Wick and other bots have an option where they won't let your server you let your user join your server until they've turned off uh DMs. So it basically kind of gates them until they've set up their own best practices. Um adding just simple stuff like we'll never DM you in your uh in your admin's names. Uh, and then also like I'd recommend just checking out Boring Security Dow. Uh, they've been doing like a ton of they basically kind of run classes.

They partner with like NFT projects, DeFi projects. They basically invite everybody from your community and run like a session on like how to stay safe for themselves. And this is something like we've seen a lot of community uh, you know, a lot of uh, users get really excited about because they feel like you know, they appreciate when like you're you show that you actually care. You know, you're not because There are some projects, you know, we we've talked to and they're like, "Oh, like if our users get rugged, it's not our problem." And those those projects to be honest do have some outrage from their community that come that comes up.

Um yeah, so basically I think on education and just basically understand like spreading out the you know, how do you actually um keep yourself safe? Uh now I'll just jump quickly into what we do at at Chain Patrol to like there's some other areas of security that um that we kind of build on. So you know there's areas that you can control and areas that you kind of can't control. Uh you can control what happens in your own Discord, but it's hard to control what DMs your users receive. You can keep track of your own Twitter security, but you can't keep track of uh fake accounts impersonating you and DMing your users on Twitter.

Um, and so what we've seen large projects like for example, we work with companies like Optimism and Lido and others right now. And what they do is, you know, they have teams that try and go, let's say somebody you're running um you have some like optimism, your optimism, and there's sites targeting you like optimismairdrop.com. They message your user, they get them to go there, and they try to basically get them to sign a malicious transaction thinking they're receiving free internet money, right? Um, what do you do about this?

Right now, the best thing you could probably do is try and find who the hosting provider is, ask them to take it down. That will take like a day or two, maybe more. Um, and sometimes weeks, and some hosting providers just don't care. They'll they'll just be like, not a problem as well. Uh, similar challenges with Twitter to be honest.

We've been trying to reach them a lot, but uh it's very it's very difficult. uh especially with all the restructuring they mostly also like I don't want to say they don't care they do take they do take some measures but I mean there's just so many issues on there right now it's hard it's hard for them to deal with everything um and you know some projects are do say like well why is it a problem if some somebody within our community loses money to a fake website like that's not our money that's that's they messed up right uh but it actually does hurt your project in many ways Uh it for example another project we worked with was a DeFi project. They had a lot of scam Google ads targeting them. Uh a couple hundred,000 was lost by users within a couple of weeks. And that's money that just would have been inside of their protocol.

Uh and now that money is just not in your protocol. You're not getting revenue off of it. There's users in your chat complaining. Um it's user churn. Many you we've talked to other projects and also wallets and basically once a user um gets hit by a massive scam that could be all the money they had and that user is just gone.

That's a user you've just lost and they're never coming back. Um and it's brand damage. you know, it just it looks bad if you're if there you go to Twitter and there's like 30 different impersonators or you search on Google and the first five links are fake sites. Um, and so we try to help with this. Uh, we what we do is one, we do automated scam detection.

We're not the only ones I also want to say that do this. There's a lot of traditional web two companies you can go to that, you know, handle this kind of thing. But we basically track down a lot of the scams. Uh you know we do things like scanning uh you know newly registered domains, certificate registrations. Uh we find issues across uh we also do scans across Twitter, Telegram and then we also have community reporting.

So your community members can report in uh you know we have a bot that sits in your Discord and your scam report channel. It picks all that stuff up and goes into that security dashboard. These are just like a couple. I can, you know, if I open up the app, I can just keep scrolling and scrolling through all the scams. It's it's kind of ridiculous to be honest, but we are we are helping.

So, what do we actually do? Uh, one of the things we have been working on is a connection to quite a few uh wallets that we're working with. Uh, right now we have a direct integration with Coinbase wallet. Uh we're also sending this data to MetaMask and to a bunch of other wallets as well. Um and basically uh if you any report coming into our system, we put on a shared block list that then goes out to all of these uh all of these wallets.

And we're kind of trying to encourage more and more wallets to pick this up uh to basically have a full coverage of the space so that as soon as you know you're running a D5 protocol, you you notice like a scam targeting your users, you submit it through chain patrol, um we verify quickly. We're very careful around, you know, not making sure we don't have any false positives because like the worst thing would be just to block, you know, a legitimate project that like that would really suck. Uh we've had one in the last five months and we removed it within like a minute out of our system. So uh I think we're doing okay. Um and so we work with Coinbase.

We uh there we have a direct integration. We're also sending this data to MetaMask fishing detect uh and we're also spreading it to there's a bunch more wallets right now integrating our uh integrating our API as well that we're working with. Um and then we also have our own warning page that wallets can bring in to even more quickly uh more quickly integrate this protection into wallets. Um we also handles importing sight takedowns. So now the difference between a takedown and this wallet blocking is blocking at the wallet because of the good relationships uh that have been formed and the high um you know the transparency around our reports uh we can do with some wallets wallets that integrate our API we block within minutes.

Some other wallets that we're working with more manually it's within like usually a couple of hours whereas site takedowns typically take like a day or two or more like I mentioned. So really what we're trying to do is be so fast at blocking these scams that you know the the the people making malicious websites it just it's too much work for them. Uh for example we worked with uh company cow swap they also had a a lot of uh scam Google ads targeting them. We um and they were like they were looking for solutions. They're like it really sucks to them that you know their users are are losing the funds as well.

Um and basically with them, you know, after a couple of weeks of very actively block, we we were taking down five, 10 like almost every single day or not taking down, sorry, but like blocking uh well with the wallet level. Uh and after a couple of weeks, they kind of stopped. They went away. They was just like we it was too much of a headache for them to keep registering new domains, keep uh you know, scheduling new Google ads. It just it is a certain amount of work.

We're trying to it's like it's like this like adversarial thing. we want to make it just more work for them to attack your community than it's kind of worth to like bother for them and they just kind of move on somewhere else. Um, and yeah, so we do these uh we also do the site takedown at the end of the day as well because I mean we don't have 100% wallet coverage and this site can still like kind of you know damage users if they're using some one of the wallets we're not integrated with. We're trying to go really far but we need to you know we also handle the takedown as well. Um, oh yeah, one last thing I wanted to mention.

Reason the wallets kind of have trust for data is we have uh all our every single thing on our block list like every single URL. We also we're also starting to add contract to wall addresses, but that's a little trickier because it's so easy to make new ones. So, we're focused on domains to be honest right now. Um, and but there's a there's a full detailed report on every single thing on that block list and it's publicly available so you can see why it made it on there. uh what was the reason and and and so on.

Um and you can always uh and you can there's a public dispute page that we're very good at at handling, you know, in case there is a false positive, but like I mentioned, there's one. Um yeah, that's that that's it. I I I know I'd love to take any any questions. Um any things you would want to know about your own like, you know, personal security or if you're building a community, how you can help uh protect them as well. All right.

Um, yeah. So, you're saying if the wallet if the if the reporting through us is the best way, if there's like other methods of taking down the scam, Yeah. Yeah. I mean, you I mean, you still want to report it to Google um because eventually they should take it down. But to be honest, um the reason we work with these communities is because like Google doesn't act on it very quickly to be honest.

Um and it's an internal problem they have. Uh we've seen their they do have like a web like head of like web 3 and we've seen one or two people manage to message him and get some stuff removed quickly but it's more of like a if you manage to get enough hype about it on Twitter or something that it reaches somebody up top they'll do it otherwise like to be honest like most of these companies like I think it's something to do with their policy like where it's really weird. It's the same thing on Twitter too. It's like they unless it's like extreme like it has to meet so many different criteria for them to act on it that the scammers can literally change like one little thing and it's like fine. Actually some interesting things that I've seen them do is one if you go to the site directly they'll actually show you like some blog page or some benign page that looks fine.

only when you have the Google tracking ID in there or you have the Twitter referral ID will it actually show you the malicious content. So that makes it even harder to take down because somebody then goes looks at the regular site and like oh this is a blog post or this is somebody's store or website. Uh but then they but if you include this very but if you came from a particular source then it shows you the scam page. Oh yeah, yeah, yeah, yeah. Yeah, yeah.

Yeah. So, we're we're we're starting to work on some of that stuff, but to be honest, right now, a lot of our stuff is mostly like impersonation, like image comparisons and stuff like that. Yeah. But I'd love to talk. Yeah.

Because I mean we're like honestly on our end we're just trying to spread this data as far and wide as possible and we want like we're like super collaborative you know like so yeah I'd love to chat. Yeah. Awesome. I mean if there's no other there's no other questions I think we can we can wrap there but thank you thank you for coming. [Applause]