A victim lost about 5.17 MILLION in BEAM tokens a few hours ago.

So far the VICTIM's funds haven't gone to any deposit addresses and are still sitting in the scammer's wallets.

However, I am seeing other victim's funds going into various FixedFloat and ChangeNOW deposit addresses.

Below are the wallets connected to the 5.17M victim.

The Wallets

Victim Wallet

• 0x83664B8a83b9845Ac7b177DF86d0F5BF3b7739AD – 5.17M BEAM VICTIM

Scammer Wallets

• 0x98C6ceD9b18d57Ee58820e61AA126c0fec30435d – 5.17M BEAM Scammer 1 [4.56M]
• 0x6f167B86443D04f4b1705A0c78b6cC6Ac691e381 – 5.17M BEAM Scammer 2 [804K]
• 0x8f5cF5bE2928E8E718277792CD745a80D25351b1 – 5.17M BEAM Scammer 1 1
• 0x69f09623BC574b82Fd26307978D48D70751EFbCE – 5.17M BEAM Scammer 1 2
• 0x794e27c4ad9152F64CA6dFC3901E0136B7cFCE93 – 5.17M BEAM Scammer 1 3
• 0x30fAF6BAD1B9694D529FCcbC7Fe6d307Af22acD1 – 5.17M BEAM Scammer 1 4
• 0x0e4c3464261DB1d0F829d37087e58894E8fFCd05 – 5.17M BEAM Scammer 1 5
• 0xa1f0eDBC0Be7Df48dD0b8363cFbCc6efF78683c5 – 5.17M BEAM Scammer 1 6

Inside the Scam

Above is mapping where the txns of 0x98C6ceD9b18d57Ee58820e61AA126c0fec30435d – 5.17M BEAM Scammer 1 went. All of the funds are still sitting in the intermediary wallets at the time of this post.

How the Phishing Scam Works

I'm showing interactions with Angel Drainer. Angel Drainer is a Scam as a Service platform that drains victims wallets once a user signs a malicious contract.

0x6f167B86443D04f4b1705A0c78b6cC6Ac691e381 – 5.17M BEAM Scammer 2 appears to be the drainer wallet in this instance. I'm not sure this if wallet is Angel Drainer, but it operates very similarly.

This victim appears to have signed an Increase Allowance transaction. This function grants the scammer approval for ALL or infinite tokens.

Where's the Money Going?

A different look inside 0x98C6ceD9b18d57Ee58820e61AA126c0fec30435d – 5.17M BEAM Scammer 1.

The scammer swapped all the BEAM tokens into ETH.

As of this moment, about 425K worth of ETH is sitting inside the scammer's primary wallet of 0x98C6ceD9b18d57Ee58820e61AA126c0fec30435d.

There's 200 ETH in each of the intermediary wallets. This totals out to be about 3.39M of the VICTIMS funds.

If law enforcement is able to act quickly, there's still a chance that a significant portion of the funds can be recovered once they hit the exchanges.

Lastly of interest to me is the Angel Drainer interactions. I did notice about 16K worth of ETH went into the Angel Drainer wallet, presumably fees from other victims.

Wallets of Interest

Outside of the wallets I mentioned above, there's a few that need further investigation. Sometimes it's the small breadcrumbs that can lead to an identity. These wallet's pre-date this particular victim but they are directly connected to the scammer.

• 0x83664B8a83b9845Ac7b177DF86d0F5BF3b7739AD – 40.4K sitting in here
• 0xE30e38CE7BD5e67A84D1E281C6Cf03dC08D26fDf – MEXC, Sideshift, and ChangeNOW deposit addresses
• 0x251623efdAfCC7929f40b35D1a2FF4813e6065f5 – Connected to other scams

Thanks for reading and I hope this one has a happy ending for the victim!

​