A woman who goes by "Shegenerates," who is a Solidity developer, was among the first to raise the alarm about this new scam. In a tweet on Thursday, she wrote that someone sent her "airdropped" tokens supposedly worth $30,000, but in reality it was a “sophisticated scam.” 

With the value of cryptocurrency climbing over the course of 2021, scammers and hackers have increasingly targeted not only crypto exchanges and organizations, but also individuals who own Bitcoin, Ethereum, or any other cryptocoin or token. 

“We're seeing an increasing number of phishing scams that attempt to take control of peoples' web wallets. This one is novel because people are being sent ("airdropped") tokens, and directed towards a website that claims to be a decentralized exchange,” Tom Robinson, the co-founder of blockchain analysis firm Elliptic, told Motherboard in an email. “[The scam is] luring them to a site where they're told they can sell the tokens they've been given—but the site actually steals whatever is in their wallets.”

According to Shegenerates, attempts to swap the tokens have resulted in failed transactions, which are posted to the blockchain forever and may indicate to scammers which victims are willing to interact with tokens of unknown provenance for a quick profit. It would also mean that the scammer would reap a fee reward in the event of a successful swap. 

It’s unclear how many people have been targeted, or have actually fallen for this scam. Jonathan Levin, the co-founder of blockchain monitoring firm Chainalysis, said that this kind of scam “is gonna be something hard to combat.”

In her tweets, Shegenerates warned people to never interact with tokens or smart contracts that get sent out of the blue, and to never go to custom websites that are specific to a token.

“If a token name has a domain name in it, that is a big red flag not to go to that website and get phished,” she wrote. 

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.