Austrian bust $1.3M ‘crypto’ fraud; phishing scam targets Ledger

Getting your Trinity Audio player ready...

Austrian police have busted a crime ring alleged to have defrauded over $1.2 million worth of digital assets and other valuables using fake cash, giving a long-running scam a ‘crypto’ twist. Elsewhere, scammers are targeting Ledger users with a spoofed email and coercing them to surrender their recovery phrases.

Rip-Deal 2.0 in Austria

Police in the capital, Vienna, have uncovered a criminal network they allege is behind a scam that defrauded over €1.2 million ($1.26 million) from investors, mostly in digital assets. A majority of the victims were Austrian.

Local outlets report that the mastermind behind the operation is a 39-year-old Dutch man with Serbian roots. The unnamed suspect is already serving a three-year sentence after he was arrested in Milan earlier this year in an operation that involved Europol.

The scammers introduced a digital currency twist to a classic scam known in Austria as “Rip Deal.” Traditionally, the scheme involved using counterfeit cash to purchase high-value items, such as gold watches, and reselling them for real cash. However, in “Rip Deal 2.0,” the scammers bought digital assets with fake cash.

Austrian police have been pursuing the scammer for well over three years. One detective spearheading his manhunt has been working with dozens of victims, all of whom were scammed by the Dutch suspect and his cronies. 

In one instance, an Austrian businessman narrowly missed out on losing $137,000 to the scammers after his daughter, a police officer, recognized the tell-tale signs of a Rip-Deal. The scammers had convinced the man to deposit the money into a digital asset wallet as payment for an industrial machinery deal. 

According to the lead detective, scammers usually invite their victims to luxury hotels abroad, with payment almost always being made in digital assets. They would “get victims to input their passwords or ‘seed phrases’ for cryptocurrency wallets, sometimes spying on their phone screens using cameras hidden in the ceiling,” the detective revealed. Armed with the seed phrases, they took over the wallets and wiped them clean.

Rip-Deal 2.0 is one of several digital currency cases the Vienna police have investigated in the past few years. Chief Inspector Gerald Goldnagl, who heads the city’s Rip-Deal unit, revealed that since 2020, they have solved over 100 such cases, with losses amounting to $26.3 million.

Globally, digital asset scammers continue to wreak havoc on millions of victims. According to the Chainalysis mid-year report, stolen funds and ransomware are the two most rampant avenues for criminals. In the first six months, these criminals stole $1.58 billion and generated another $460 million through ransomware.

Pig butchering, in which the scammer builds a relationship for weeks or even months with the victim before eventually scamming them, has also become worryingly popular in recent years. 

Scammers target Ledger users with spoof emails

Still on scammers, a group of fraudsters is once again targeting Ledger users in a phishing campaign.

Users of the hardware digital asset wallet took to social media to reveal that they had been receiving emails from a legitimate-looking address claiming to be Ledger support staff. The emails all claimed that there had been a recent data breach in which some seed phrases may have been exposed. 

“To safeguard your assets, we strongly encourage you to verify the security of your recovery phrase through our secure verification tool,” the email reads before redirecting users to a website where they are required to input their recovery phrase for “verification.” 

Those that do surrender their seed phrase to the scammers get the wallet wiped clean.

In response, Ledger noted that its systems have been designed to keep users’ assets safe even in the case of an external incident. 

“Ledger devices are purpose-built to keep your assets secure and entirely under your control—always. We’ve reinforced our systems time and again to meet the highest standards of security in an increasingly connected world,” the French firm stated.

It further reminded users that it never calls, texts or emails them to ask for their recovery phrase. “If someone does, it’s a scam,” it added.

Ledger users are no strangers to phishing campaigns. The hardware wallet has long been targeted by scammers who pose as Ledger staff or push fake software before stealing from the victims. However, the phishing campaigns escalated after a data breach in 2020, in which over a million clients’ names, numbers, emails and addresses were leaked.

Watch: Can blockchain stop academic fraud? Here’s how