Luke Scamwalker 🌌

Vigilant by nature, trying to keep crypto safer.
Exploring every parsec of web3 for scams, hacks and exploits.
Always DYOR and may the force be with you. 🪐

[Luke Scamwalker 🌌 @scamwalker]

Crypto moves fast. Scams move faster.

This account is here to track hacks, phishing, drainers and exploits, explain how they work, and help you avoid becoming the next victim.

Always DYOR. Safety first.

May the Force be with you.

[Luke Scamwalker 🌌 @scamwalker]

Coming back soon.

[Luke Scamwalker 🌌 @scamwalker]

🏦 🟠 BLINK CUSTODIAL ACCOUNTS BREACHED

Blink says an attacker withdrew funds from a few dozen custodial accounts. The vulnerability is now fixed and verified, while non-custodial wallets were unaffected.

Affected users will be reimbursed.

[Luke Scamwalker 🌌 @scamwalker]

🧯 🟠 FAKE AI BOT TUTORIALS DRAIN 224 USERS

TRM Labs traced 274.6 ETH stolen through fake YouTube tutorials that tricked users into deploying and funding malicious contracts themselves.

Do not deploy or fund tutorial code unless you independently verify the source and bytecode.

[Luke Scamwalker 🌌 @scamwalker]

🧲 🔴 FOMOPEEK BUILDS EXPOSE WALLET KEYS

SlowMist and OKX found malicious code in FomoPeek 1.1–1.2 that can access private keys and seed phrases on affected iOS devices.

If you used either version, create fresh keys on a clean device and move your funds.

[Luke Scamwalker 🌌 @scamwalker]

🔑 🔴 https://t.co/sdLdyM4Al0 SIGNING KEY COMPROMISED

https://t.co/M0pFCIrjUR says its preliminary analysis traced the exploit to a compromised signing key. Affected wallets and contracts were deactivated with SingularityNET.

Avoid affected converters until the final all-clear.

[Luke Scamwalker 🌌 @scamwalker]

🛰️ 🟡 MULTIVERSX SERVICES DEGRADED

MultiversX is investigating a potential mainnet issue. Its status page currently shows degraded performance across xPortal, Explorer, Wallet, Bridge and xExchange.

Avoid time-sensitive transactions until the network status clears.

[Luke Scamwalker 🌌 @scamwalker]

🧲 🔴 FOMOPEEK BUILDS EXPOSE WALLET KEYS

SlowMist and OKX found malicious code in FomoPeek 1.1–1.2 that can access private keys and seed phrases on affected iOS devices.

If you used either version, create fresh keys on a clean device and move your funds.

[Luke Scamwalker 🌌 @scamwalker]

🧲 🟠 D’CENT APP WALLETS DRAINED

D’CENT confirmed abnormal transfers involving its App Wallet. Onchain analysis found 1,552 wallets drained of ~2M XRP.

If you used the App Wallet or shared its recovery phrase elsewhere, move funds to a wallet with a new recovery phrase.

[Luke Scamwalker 🌌 @scamwalker]

🏦 🟠 HARUKO BREACH EXPOSED CLIENT API DATA

Haruko says a targeted attack exposed read-only exchange API details and trading data from 15 clients. The flaw was fixed and server secrets rotated.

Affected clients should rotate API keys and enforce IP whitelisting.

[Luke Scamwalker 🌌 @scamwalker]

🧬 🟠 CUSTOM SAFE MODULE DRAINED $7.7M

A flawed authorization check in a custom module let an attacker move ~2,900 rsETH from an Ethereum Safe without owner signatures. Safe core contracts were not affected.

Review and remove unnecessary Safe modules.

[Luke Scamwalker 🌌 @scamwalker]

🔑 🟠 INPUT OUTPUT YOUTUBE COMPROMISED

Input Output’s YouTube channel was hijacked and used to promote a fake Cardano giveaway through a QR code.

Do not send funds, follow links or trust videos from the channel until the team confirms recovery.

[Luke Scamwalker 🌌 @scamwalker]

🏦 🟠 REVOLUT BREACH EXPOSED PHYSICAL ADDRESSES

Revolut says data from about 680 crypto customers was accessed, including physical addresses. No funds or internal systems were compromised.

Treat unexpected contact as hostile and review your personal security.

[Luke Scamwalker 🌌 @scamwalker]

🏦 🟠 BREVO SUPPLY CHAIN COMPROMISED

A stolen Cloudflare API key let attackers inject malware through Brevo components embedded across 100,000+ sites on Sept. 14.

If a fake verification page made you run a command, treat that device as compromised.

[Luke Scamwalker 🌌 @scamwalker]

🧬 🟠 NOSTRA MONEY MARKET EXPLOITED

Nostra says manipulated NSTR oracle pricing enabled ~$3.5M in unauthorized borrowing. Its Starknet money market remains paused.

Ignore recovery DMs and do not connect your wallet through unsolicited links.

[Luke Scamwalker 🌌 @scamwalker]

🧲 🟡 FAKE AI AGENTS TARGET CRYPTO WALLETS

HP found fake AI trading agents that scan browsers for crypto wallet extensions, then replace them with malicious versions that steal entered credentials.

Do not install AI trading agents from ads or unverified downloads.

[Luke Scamwalker 🌌 @scamwalker]

🎣 🟠 VERIFIED HBO MAX ACCOUNT PUSHED MALWARE

HBO Max’s verified Reddit account was hijacked to run 108 malicious ads. Fake apps delivered infostealers and crypto clippers targeting wallet recovery phrases.

Do not paste commands from ads into Terminal or PowerShell.

[Luke Scamwalker 🌌 @scamwalker]

🔑 🟠 DCENT APP WALLETS AT RISK

DCENT says abnormal transfers affect App Wallets used to sign transactions before v8.1.0. Hardware-only users are not affected.

Update the app, check if your wallet is affected, and migrate assets if instructed.

[Luke Scamwalker 🌌 @scamwalker]

🏦 🟠 REVOLUT DATA LEAK ESCALATES

Attackers have reportedly begun publishing stolen Revolut customer records and are demanding 10,000 BTC.

Affected users should treat identity-based messages as hostile and independently verify any request before acting.

[Luke Scamwalker 🌌 @scamwalker]

🧬 🟠 CUSTOM SAFE MODULE EXPLOITED

Blockaid reports ~$7.73M in rsETH lost from an unidentified Safe after a public keeper multicall was used against a custom Uniswap v4 LP module.

The issue was not in Kelp DAO’s core rsETH contracts.

[Luke Scamwalker 🌌 @scamwalker]

🏦 🟠 REVOLUT DATA EXTORTION

Revolut says customer data was disclosed after fraudulent requests from a legitimate government agency email domain. FT reports 680 customers were affected and the attackers are threatening publication.

Affected users should expect targeted phishing