Fake $TSLA Stock Pre-sale Uses Wallet Screening to Identify Victims and Drain Funds

cryptonews.ruPublicado a 2026-08-12Actualizado a 2026-08-12

Resumen

Cybercriminals are selling a $500 "Tesla token pre-sale" scam kit that allows even non-technical users to set up fake investment websites. The kit, sold by a user named xrep, includes hosting, phishing pages, and a fake dashboard. The scam impersonates Tesla, targeting social media users with fake exclusivity offers. It employs tactics like fake countdown timers and urgency to create FOMO (fear of missing out). Victims are lured to connect their wallets for a "bonus" and are then tricked into providing their 12-word recovery phrase, leading to complete wallet drainage. An alternative method directly requests cryptocurrency transfers to scammer-controlled addresses. The operator's dashboard tracks victim activity, location, and stolen recovery phrases, allowing the scammer to check a wallet's value before draining it and to artificially inflate fake balances to solicit more payments. This scheme follows recent warnings from the U.S. IRS about fake crypto tax portals and other phishing attacks targeting hardware wallet users.

A ready-made kit for fraud is being sold for $500 on a cybercriminal forum. Anyone with almost no technical skills can set up a fake $TSLA token pre-sale and drain the wallets of anyone who invests.

Hacker Sells Scam as a Ready-Made Product

This tool kit was developed by a forum user with the handle xrep, who has been active in the cybercriminal underground since March 2026. It has received positive feedback from other criminals.

Researchers stated that this product is a "complete scam in a box." The kit includes hosting, phishing pages, a fake investment dashboard, and tools for trac victims.

Cybersecurity specialists from Malwarebytes discovered the fraudulent scheme on May 16. It displays a pre-sale page with the Tesla name and logo, presented as an exclusive early purchase opportunity for X users. The website operates in multiple languages and works on both phones and computers.

At the start of the attack, an X user is asked to pass an "eligibility check." The page then displays that user's real profile picture to create the impression that the offer was selected for them.

The scam creates a sense of FOMO (fear of missing out) using a progress bar that starts filling, a countdown timer, and warnings about an imminent price increase.

The first investment option offers a 15% bonus for connecting a wallet. Then the form requests the 12-word recovery phrase to completely drain the cryptocurrency wallets.

Another "investment" option bypasses the wallet and asks the victim to send Bitcoin, Ethereum, USDT, or Dogecoin to an address controlled by the operator. In the end, the buyer sees a fake balance on their account.

Screenshot showing the fake Tesla scam website. Source: Malwarebytes.

Fraud Kit Steals Location and Recovery Phrases

The dashboard makes the kit more dangerous. It allows the operator to see how victims navigate the site, log usernames and locations, and collect recovery phrases entered on the phishing page. The operator can check if a wallet contains anything valuable to steal before attempting to take it over.

It can also artificially inflate the balance on request, making the user believe their investment is paying off and pay even more. If the user has already paid, the dashboard sends a message demanding an additional network fee.

On August 3rd, the U.S. Internal Revenue Service warned that scammers are sending letters to cryptocurrency owners, directing them to a fake "Digital Asset Compliance Portal" that looks like IRS[.]gov, aiming to steal wallet login creddentials. According to the agency, such a portal does not exist.

In May, Cryptopolitan reported that scammers were sending printed letters to Ledger owners. These letters described a fake "Quantum Resistance Security Update" that used QR codes to phish for 24-word recovery phrases.

end-content

Preguntas relacionadas

QWhat is the key functionality of the fake Tesla stock pre-sale scam toolkit described in the article?

AThe toolkit is a 'full scam in a box' that includes hosting, phishing pages, a fake investment dashboard, and victim-tracking tools. It allows scammers to conduct fake Tesla ($TSLA) token pre-sales and trick users into providing wallet recovery phrases or sending cryptocurrency to attacker-controlled addresses.

QHow does the scam website create a sense of urgency or FOMO (Fear of Missing Out) for potential victims?

AIt uses a combination of visual elements like a filling progress bar, a countdown timer, and warnings about an imminent price increase to create the impression of scarcity and urgency, pressuring users to act quickly.

QWhat personal and financial information does the scam's control panel allow the operator to collect from victims?

AThe control panel allows the operator to see how victims navigate the site, register usernames and locations, and collect the wallet recovery phrases entered on the phishing page. It also lets the operator check if a wallet holds anything valuable before attempting to steal from it.

QAccording to the article, how much does the pre-made scam toolkit sell for on the cybercriminal forum?

AThe pre-made scam toolkit is sold for $500 on the cybercriminal forum.

QWhat recent similar phishing warning did the U.S. Internal Revenue Service (IRS) issue, as mentioned in the article?

AOn August 3, the U.S. IRS warned that scammers were sending letters to cryptocurrency owners directing them to a fake 'Digital Asset Compliance Portal' designed to look like IRS[.]gov, with the goal of stealing wallet recovery phrases. The IRS stated that no such portal exists.

Lecturas Relacionadas

Hawaii crypto ATM ban to take effect on Oct. 1

Hawaii will implement a total ban on cryptocurrency ATMs and kiosks starting October 1, following the signing of House Bill 1642 into law by Governor Josh Green in July. The legislation prohibits the ownership, operation, or management of kiosks that exchange U.S. currency for digital assets. Lawmakers cited FBI data reporting over $11 billion in digital asset scam losses nationwide in 2025, with Hawaii residents filing 826 related complaints and incurring roughly $80 million in losses. Hawaii joins Minnesota, Tennessee, and Indiana in enacting such bans, while states like South Dakota and Wyoming have imposed strict regulations. According to CoinATMRadar, 57 crypto ATMs and kiosks were operational across Hawaii's main islands as of this week.

cointelegraphHace 22 min(s)

Hawaii crypto ATM ban to take effect on Oct. 1

cointelegraphHace 22 min(s)

Coinbase to Remove 10 Altcoins from its Futures Contract

Cryptocurrency exchange Coinbase has announced the suspension of futures contracts for 10 altcoins. Trading for these contracts will be halted on August 26 at approximately 21:00 Turkish time. The affected perpetual futures contracts (PERP) are for the following assets: Memecoin ($MEME), The Sandbox ($SAND), Moonbirds (BIRD), Blur (BLUR), Katana (KAT), SPX6900 ($SPX), Zora (ZORA), Axie Infinity (AXS), Gensyn (AI), and LayerZero (ZRO). Coinbase stated that any positions remaining open at the end of the trading day will be closed automatically. The final settlement price will be based on the average index price over the 60-minute period prior to the trading halt, and the funding rate for the final period will be set to zero. The exchange noted it has recently been making consistent decisions to delist assets from its futures platform.

cryptonews.ruHace 47 min(s)

Coinbase to Remove 10 Altcoins from its Futures Contract

cryptonews.ruHace 47 min(s)

Chainlink Whales’ Activity Hits Five-Month High as Holders Anticipate Breakout

Activity of large Chainlink investors has surged to a five-month high, potentially signaling a bullish breakout for LINK, according to data from analytics firm Santiment. On August 12, the network processed 246 large transactions of at least $100,000 each, the highest daily count in five months, a pattern historically linked to price increases. Despite this surge in whale activity, LINK's price, trading at $8.80 at the time of the report, has been largely stagnant over the past year and remains down roughly 83% from its May 2021 all-time high. However, Santiment noted a bullish technical signal as LINK broke a descending trend line on August 11. Standard Chartered offered a significantly optimistic long-term outlook, setting price targets of $13 by 2026, $41 by 2027, and a higher target for 2030. The bank's forecast is based on Chainlink's potential role as a foundational layer for tokenized real-world assets, a market projected to reach around $4 trillion by 2028. The report highlighted that Chainlink's utility and adoption continue to grow, with recent integrations including a cross-border settlement project with 47 banks and partnerships with major institutions like DTCC, Robinhood, and Amundi. Despite this expanding infrastructure, LINK's price has struggled to break out of its $8-$10 range for most of the year.

cryptonews.ruHace 50 min(s)

Chainlink Whales’ Activity Hits Five-Month High as Holders Anticipate Breakout

cryptonews.ruHace 50 min(s)

XRP Price Forecast Amid Accumulation by Large Holders

XRP Price Forecast Amid Rising Accumulation by Large Holders On August 12, XRP's price increased by 1.36% to $1.01, recovering after briefly dropping below the $1 support level the previous day. Data indicates that despite weak price momentum, activity from large holders (whales) and active addresses is growing. Santiment data shows a net increase of 32 wallets holding over 1 million XRP over three months, starting May 2026. This accumulation suggests a transfer of supply from weak to strong hands. While large investors bought, retail selling contributed to a 29% decline in XRP's market cap over the same period. Concurrently, the number of active XRP addresses surged 84% from August 1 to August 11. This network activity rise occurs ahead of an XRP Ledger update expected to boost DeFi usage and despite a low 22% probability of the CLARITY Act passing in 2026, creating a bullish divergence. Technically, XRP's drop below $1 on August 12 marked a 20-month low, with the RSI at 37 favoring bears. Further sell pressure could push the price down to the $0.85 Fibonacci level. However, analysts note XRP may be oversold after a 71% decline from July 2025. A strong uptrend would require overcoming resistance at the $1.20 Fibonacci level. Separately, the Coreum bridge connecting to the XRP Ledger was hacked for $200,000 worth of XRP, exploiting a deposit verification flaw. The Ripple community confirmed the XRP Ledger itself remains secure.

cryptonews.ruHace 50 min(s)

XRP Price Forecast Amid Accumulation by Large Holders

cryptonews.ruHace 50 min(s)

Solana Nearly Halted Finalization Due to an Outage

On August 12th, a routing failure at infrastructure provider TeraSwitch caused approximately 90 Solana validators, representing 28.83% of staked SOL, to go offline simultaneously. This brought the network dangerously close to the 33.34% threshold at which transaction finality would halt, stopping the blockchain. The incident, highlighted by Marinade Finance, lasted about 33 minutes before routing was restored. The affected validators missed out on roughly 333 SOL in rewards during the downtime. The event underscored significant risks from infrastructure concentration, as TeraSwitch alone managed validators with 27.34% of the total staked SOL prior to the outage. Marinade Finance stated it would revise limits on validator distribution across autonomous systems and data centers to improve resilience. Some major operators, like Coinbase, already distribute infrastructure across multiple providers with backup servers to mitigate such single points of failure. The incident echoes a 2022 event where provider Hetzner, hosting ~40% of validators, disconnected nodes, though the network remained operational.

cryptonews.ruHace 52 min(s)

Solana Nearly Halted Finalization Due to an Outage

cryptonews.ruHace 52 min(s)

Trading

Spot