On the evening of October 16, NanoBaiter, a YouTube creator who targets scammers, posted a 12-part thread: a scammer named Kemi in Abuja, Nigeria, was impersonating MrBeast, Airrack, and NanoBaiter himself, specifically targeting people who had "already been scammed once." Victims would comment on videos saying they’d been scammed, and the scammer would immediately reply, "Find @nanobaiter_team on Telegram," then sell them a supposed "fund recovery software" package. Playing along, the creator turned the tables while the scammer was operating remotely: he reversed the connection, accessed the scammer’s webcam, and uncovered Google Play gift cards and screenshots of Bitcoin payments. He also found that the stolen funds were being laundered through an over-the-counter market that converts gift cards to crypto. Finally, he used a nearby Wi-Fi BSSID picked up by his laptop to pinpoint the scammer’s location. The evidence has been handed over to Nigeria’s EFCC. The original post got more than 620,000 views, and it sparked over 1,200 discussions on X in half a day.
What scammers fear most isn’t the police—it’s the webcam on their own laptop that they forgot to cover up.
A few engineering takeaways:
1. On-chain transfers have no undo button. Once a transaction is confirmed, no "fund recovery software" or "on-chain hacker" can pull the money back. There’s only one realistic way to recover it: the stolen funds flow into a centralized platform with a compliance team, you report it to the police, and they send the platform an official request to freeze the funds. Anyone who asks for an upfront service fee, deposit, or "unlocking fee" before recovering your money is taking a second bite out of you.
2. Posting "I was scammed, here’s the address: xxx" in a public comment section is like putting yourself on a curated list: desperate, your judgment just shaken, and willing to pay for hope. Legitimate official teams won’t DM you first, and they certainly won’t ask you to move to Telegram to discuss things. If a username contains "team," "support," or "official," you can generally block it outright.
3. Remote access works both ways. When a scammer asks you to install a remote desktop app like AnyDesk to "help you check on-chain records," installing it is effectively handing over your computer, browser wallet extensions, and logged-in exchange accounts. This time, the scammer got caught in the same trap: even nearby routers’ BSSIDs became clues. Public Wi-Fi geolocation databases can often pinpoint a street if you have the hardware addresses of a few nearby routers.
4. Gift cards and over-the-counter crypto exchanges are standard cash-out routes for these gangs. If someone asks you to use a gift card to "pay a recovery fee," that alone is enough to identify it as a scam.
My rule of thumb: after being scammed, first export the transaction hash, the other party’s address, and screenshots of the chat, then report it to the police. At the same time, contact the platform the stolen funds went to through its official support ticket system. Don’t post addresses in public comments asking for help. Refuse any request from a stranger to install remote access software. Treat any DM offering to "help recover your money" as the next scammer by default.
What scammers fear most isn’t the police—it’s the webcam on their own laptop that they forgot to cover up.
A few engineering takeaways:
1. On-chain transfers have no undo button. Once a transaction is confirmed, no "fund recovery software" or "on-chain hacker" can pull the money back. There’s only one realistic way to recover it: the stolen funds flow into a centralized platform with a compliance team, you report it to the police, and they send the platform an official request to freeze the funds. Anyone who asks for an upfront service fee, deposit, or "unlocking fee" before recovering your money is taking a second bite out of you.
2. Posting "I was scammed, here’s the address: xxx" in a public comment section is like putting yourself on a curated list: desperate, your judgment just shaken, and willing to pay for hope. Legitimate official teams won’t DM you first, and they certainly won’t ask you to move to Telegram to discuss things. If a username contains "team," "support," or "official," you can generally block it outright.
3. Remote access works both ways. When a scammer asks you to install a remote desktop app like AnyDesk to "help you check on-chain records," installing it is effectively handing over your computer, browser wallet extensions, and logged-in exchange accounts. This time, the scammer got caught in the same trap: even nearby routers’ BSSIDs became clues. Public Wi-Fi geolocation databases can often pinpoint a street if you have the hardware addresses of a few nearby routers.
4. Gift cards and over-the-counter crypto exchanges are standard cash-out routes for these gangs. If someone asks you to use a gift card to "pay a recovery fee," that alone is enough to identify it as a scam.
My rule of thumb: after being scammed, first export the transaction hash, the other party’s address, and screenshots of the chat, then report it to the police. At the same time, contact the platform the stolen funds went to through its official support ticket system. Don’t post addresses in public comments asking for help. Refuse any request from a stranger to install remote access software. Treat any DM offering to "help recover your money" as the next scammer by default.