By Elliptic, a data analytics firm that specializes in spotting illicit activities on the blockchain, released a report that identified $400m worth of XRP that the firm tied to illicit activities, ranging from thefts to scams and the sale of stolen credit cards. The illicit activity only represents 0.2% of the total XRP ledger activity.
These numbers are disappointing, especially when we compare XRP to other cryptocurrencies in the very lucrative crime use case. If Ripple focuses only on attracting legitimate business transactions, it may never lure the scammers, ransomware authors, thieves, or credit card mills that are significant drivers of blockchain adoption on other platforms.
Just how big is BTC adoption with criminals? A study in a journal called the Review of Financial Studies estimated that $76 Billion worth of illicit activity moved through BTC per year, which amounted to 46% of all Bitcoin transactions.
76 Billion vs. 400 Million. It’s hard for XRP to look cool in that yardstick measuring contest.
What would an illicit XRP scam look like?
A common recent scam technique is tricking youtube users into sending XRP to a scammer to register for a fake Ripple airdrop. The expectation is that once a user registers by sending a certain amount of XRP to the advertised wallet address, they will receive a larger sum of XRP via the fake airdrop. Since the whole thing is a scam, the victims never receive anything in return, and the scammers run with their XRP.
How lucrative are these scams? MarcoStyle, a popular youtube content creator, had his account compromised by one of these XRP scam groups. The attackers ran a fake swell airdrop on his channel, and they managed to run off with $15 thousand worth of XRP before they were shut down.
Upper Echelon Gamers has a rundown of what happened and how MacroStyle managed to get his account back:
Interestingly, the attackers somehow managed to get verified as Brad Garlinghouse by Youtube.
The airdrop scam is a variation of a scam we sometimes see on twitter. Scammers try to impersonate public figures in the cryptocurrency community like Brad Garlinghouse or Vitalik Buterin to trick users into sending them crypto with the promise that these public figures will send them more crypto in return.
Never send public figures cryptocurrency with the expectation of getting it back. Even when they’re advertising it from their verified social media accounts, you cannot trust that these accounts haven’t been compromised. Jack Dorsey, C.E.O of Twitter, had his account compromised in a SIM swapping attack back in August.
A SIM swapping attack is a highly prevalent form of account hijack, where an attacker tricks or bribes a phone company into transferring control of a user’s phone number to an attacker. From there, any SMS authentication used in 2FA or account recovery would be forwarded to the attacker, allowing them to access to the user’s account. All an attacker needs to carry out this attack is the user’s phone number. If it can happen to Jack Dorsey, it can happen to almost anyone.
Stay safe, and don’t fall for crypto airdrop scams.
Header photo by Alexandre Debiève
