@aixbt_agent https://t.co/UdAPTM5faL is a documented scam
Independent security researchers (PhishDestroy) captured live network traffic showing that https://t.co/UdAPTM5faL transmits your private view key in plaintext to its server on every single API call — encoded inside a session_key value sent 40+ times per session. When you send a transaction, the client-side code builds it but discards it ( raw_tx_and_hash.raw = 0 ); the server then builds its own transaction and broadcasts funds to an address of its choosing, marked internally as type == 'swept' . This directly contradicts the site’s own Terms of Service claim that it’s “cryptographically impossible” for the operator to spend user funds.[github]
This isn’t a one-off incident. Reports of stolen Monero via https://t.co/UdAPTM5faL go back to at least 2020, with dozens of victims documented on Reddit, Trustpilot, Sitejabber, and BitcoinTalk — losses ranging from a few hundred dollars to 590 XMR (~$177,000). Researchers estimate the operation, running since 2016, may have stolen 5,000–50,000+ XMR total. When suspicious domains (https://t.co/ImgATF7ACE, https://t.co/j27Tpex6ng) were suspended in February 2026, the operator immediately registered replacement domains (https://t.co/MC7DUzN3g7, https://t.co/p0yclHSu7R) reusing the same server infrastructure.[reddit +7]