In a series of Tweets, ZachXBT, the on-chain sleuth account, has clarified the recent Discord server hack.
A Canadian phishing scammer known as Soup, or Dan, has reportedly stolen millions in assets by attacking the Discord servers of projects, including Orbiter Finance and Pika Protocol. Soup creates fake Decrypt Media websites and impersonates a legitimate Decrypt employee named Luke Hamilton. He collaborates with other scammers, inviting team members of crypto projects to join a fake Decrypt Discord server in order to steal their Discord tokens.
On May 30, 2023, the Pika Discord server was compromised when scammers gained access to a team account. They posted a malicious link in the announcements channel, stealing over $220,000 worth of assets. Soup's wallet address, which was revealed accidentally, received approximately 5 ETH directly from the scam.
The following day, on May 31, 2023, the Orbiter Finance Discord server was also compromised after a team member's Discord token was phished. The scammers used a similar tactic to post malicious links that facilitated the theft of over $760,000. About 30% of the stolen funds were transferred to alternate addresses controlled by Soup.
Soup has been involved in other criminal activities in the past. Last year, he participated in the theft of a Mutant Ape Yacht Club NFT – number 21080 – with his partner Faint. In January, Soup played a role in stealing Crypto Punk 6983 from a victim on Twitter.
The scammer has allegedly used a portion of his ill-gotten gains to purchase exclusive Roblox items that sell for high five-figure amounts. As the crypto community becomes more aware of Soup's activities, it is crucial for project team members to exercise caution when joining Discord servers and sharing their tokens.
