AI
Two Categories of Crypto Scams
Nick Percoco divided crypto scams into two categories. Spray and prey tactics send millions of texts hoping someone responds. Kitboga showed one he received that day. It was a fake withdrawal alert from a crypto exchange with a callback number. Targeted attacks go after specific victims. Kitboga described a grandparent scammer who knew the family’s names, address, and that their grandson was learning to drive. The caller claimed the grandson had a car accident and needed bail money. Both categories rely on social engineering.
The $9 Billion Toll on Victims
Crypto scams stole $9 billion in 2024. One-third of victims were 60 or older. Kitboga started scambaiting because his grandparents with dementia and Alzheimer’s were targeted. Nick noted that Kraken now sees users in their 80s and 90s creating accounts, which triggers extra monitoring. Once crypto funds leave an account, they are gone. There is no 1800-Bitcoin refund line. Scammers moved from $500 gift card demands to liquidating entire 401k accounts. Organized crime groups now prefer scamming over drug trafficking because it carries less jail time.
Intel Sharing Between Platforms and Baiters
Kitboga shares files of crypto wallet addresses with Nick’s team at Kraken. One recent file contained 1,300 wallets collected through the mycoin honeypot. Kraken found 63 account matches. Ten accounts were still active and got shut down. The Intel includes IP addresses, email addresses, photos, videos, and real identities. In some cases, scammers uploaded their actual passports during fake account verification. Kraken packages that data for law enforcement. The intelligence flow works both ways. Kraken uses it to detect and block scam accounts before funds are lost.
Bot Army Wastes Time at Scale
Kitboga built his bot army starting with if-else Python statements written live on stream. Today the bots use large language models. They carry natural conversations and collect Bitcoin wallets and bank accounts. Scammers stay on the phone for an average of 50 minutes. The bots run on containerized Docker setups. Kitboga’s goal is to run 2,000 to 3,000 bots simultaneously. The bots do not get angry. They keep asking questions. Scammers eventually figure it out but only after wasting significant time. The bots also collect Intel during every call, including wallet addresses and bank account details.
Fake Exchange Honeypot
Kraken’s engineering team built a replica of their exchange for Kitboga. From the user interface, it looks identical. Millions of dollars in fake Bitcoin sit inside. Scammers see the balance and believe they hit a jackpot. Withdrawing requires passing a webcam check. A browser-based AI model verifies the scammer makes a specific face. One scammer spent days trying to withdraw $2 million. He failed the face check repeatedly. He cheered when he thought the transfer went through, then cried when it did not. The fake site has processed millions in phantom transfers that never existed.
Q&A
Should regular people engage with scammers when they call? Kitboga said no, because the scammers will know you are a live body and sell your number. ▶ 37:14
How effective is reporting scammers to law enforcement? Kitboga said it is very hard because law enforcement is overwhelmed by the sheer volume of scams. ▶ 39:39
What resources exist for people who want to help fight scams? Kitboga suggested visiting local community centers and retirement homes to give talks about scams. ▶ 43:29
Have any scammers been converted into informants? Kitboga said one reached out and shared Telegram channels but stopped after figuring out his identity. ▶ 52:19
Notable Quotes
$9 billion in 2024 was stolen from victims Nick Percoco · ▶ 12:04
once the funds are gone, um, in many cases, they’re gone Nick Percoco · ▶ 13:54
if we can make it so difficult for them to scam using something like crypto that now they just leave Kitboga · ▶ 17:12
Key Takeaways
- A bot army running on Docker can collect Intel while wasting scammers’ time at scale.
- Fake exchange honeypots trap scammers who believe they are withdrawing real funds.
- Intel sharing between scambaiters and exchanges shuts down active scam accounts.
About the Speaker(s)
Nick “c7five” Percoco is the Chief Security Officer at Kraken, where he spearheads the frameworks and protocols that ensure a secure and seamless trading experience for clients. A recognized leader in the security and hacker community, Nick brings nearly 30 years of expertise in cybersecurity and technology, shaping the industry’s approach to threat defense and risk mitigation. A dedicated contributor to the security community, he founded THOTCON, Chicago’s premier non-profit hacking conference, and has been a contributor to secure infrastructure and network design at DEFCON, the world’s largest hacking conference, since 2017. An accomplished speaker and researcher, Nick has presented groundbreaking work on cryptocurrency security, targeted malware, mobile security (iOS & Android), and IoT vulnerabilities at leading global forums, including Black Hat, RSA Conference, DEFCON, CfC St. Moritz, and SXSW.
With more than 3M subscribers on YouTube and beyond, Kitboga pioneered scambaiting. “Everyday there are scammers taking advantage of people. I call them to waste their time, walk people through their ‘script’ and lies, report info when I can, and otherwise make light of a dark situation.”