NFT scammers are hijacking verified Twitter accounts

This week, my podcast co-host Luke Bailey and I came across a handful of really bizarre Twitter accounts while recording our show. It’s unclear exactly how, but it appears as though a handful of South American E-Sports players, a Brazilian soccer player, and a Welsh culture writer all had their Twitter accounts taken over and are now someone is using them to promote various NFT projects.

These accounts suddenly, earlier this month, exclusively began tweeting about different NFT giveaways. We’ve attempted to reach out to all the parties involved to understand what happened here. Some of these accounts are still verified, and in one troubling instance, one of these accounts is being used to solicit money from other NFT startups.

We’ve also since heard from other users who have reported similar experiences on other platforms. I learned of one woman who had her Instagram hijacked and was only able to get it back after she personally contacted a friend who happened to work at Meta. (This also appears to have happened to one of the actresses from Derry Girls.)

Journalist Jacob Silverman highlighted three of these accounts earlier this month, describing them as “blue check, six-figure follower count, only posting crypto giveaways and growth-hacking crap.” Well, we looked into it. Here’s what we know so far.

The first account we looked into is called @DP_eryl. The Twitter account has 111,000 followers and isn’t verified. A quick scroll through its current tweets reveals nothing, but different NFT giveaways. As far as we can tell, there’s no common theme between the different NFTs being advertised. But this flurry of NFT-related activity only started in June. Before that, the account, which was registered in 2014, was used primarily to retweet articles from a local Welsh news site called the Daily Post. Then on June 7, @DP_eryl tweeted, “Going to start getting back into #NFTs, with that being said I will follow anyone who follows me w/🔔 & likes this tweet.”

According to a cached version of @DP_eryl’s account on the Wayback Machine, as of 2019, the account belonged to a man named Eryl Crump and it only had around 3,000 followers. And according to that bio, Crump is the Daily Post chief reporter in Gwynedd, Anglesey and Conwy in Wales. And, sure enough, if you go to the Daily Post’s website, Crump has an author page and it still links to the @DP_eryl account.

I reached out to Crump directly and got a bounce back from his Daily Post email. I also reached out to other Daily Post employees and didn’t hear anything back. Though Crump appears to still work at the Daily Post though. He published a piece called “The best walks across Snowdonia that don't take you to the top of a hill” last week.

It could be possible that the Daily Post is totally fine with their employees shilling NFTs, but it seems unlikely, especially when there are other accounts behaving in almost the exact same way.

Next up, we looked into two South American E-sports players that appear to have their accounts similarly hijacked, an account called @blk9_r6 and another called @TheChl0e. The first account belonged to a Paraguayan Rainbow Six player named Richard Rodríguez who is on a team called Furious Gaming. The second account belonged to a Brazilian Rainbow Six player named Larissa Kimie Ito Vieira Cassiano, who plays on a team called Black Dragons. The Black Dragons website still links to Cassiano’s now-NFT-happy Twitter account. I reached out to both Furious Gaming and the Black Dragons for comment and haven’t heard back.

Both accounts went through NFT heel-turns similar to Crump’s account, suddenly, around early June, and are now tweeting nonstop about NFTs. Also, both accounts are tweeting in English, which they were not doing before they suddenly became NFT evangelists. Most shocking of all, both accounts are still verified, even though the majority of the recent tweets from the @TheChl0e account appear to have been taken down by Twitter (I’m going to guess due to spam).

It’s also worth noting that earlier this year, according to the Wayback Machine, Rodríguez’s account only had around 2,000 followers. Now it has 111,000, just like Crump’s.

This last account we looked into, however, is where things got very weird.

The Twitter account @marcelosarvas belonged to Brazilian soccer player Marcelo Sarvas as of last year. Sarvas is currently part of the coaching staff for the LA Galaxy soccer club. I reached out to the club for comment, but haven’t heard back. The account now, however, is “partnered with” an NFT line called Tigerversss, which, on Twitter, claims to be a Boston-based NFT startup that donates a portion of their proceeds to “tiger conservation”.

The Tigerversss NFT line has a website and that website lists Marcelo Sarvas as a “marketing advisor” and even links out to the @marcelosarvas Twitter account.

None of the other “team members” listed on the site use their real names, but they do link to LinkedIn pages. One team member lives in Massachusetts, but many of the others, including the founder, are based in India.

I reached out to Arun Kumar, the founder of Tigerversss, who goes by “Crescent Moon” and is based in Bengaluru, India, and he actually got back to me this morning.

Kumar told me that they were contacted first by the @marcelosarvas account, who offered to be a marketing advisor on the project. “He said he is from Florida,” Kumar said. “He promised to work with us and help with our project. He did not say that he is a footballer.”

According to Kumar, he did recently have a Google Meet video call with the person behind the @marcelosarvas account, but the video was turned off. “He said he would guide us with every step in marketing. We lost so much money. We are a very small team from India,” Kumar said.

Kumar said the Google Meet video call was organized via Twitter DM and he didn’t know what email was used to access the call.

Now, there are really two possibilities here. Either a fairly well-established soccer player has pivoted so hard to NFTs that he is no longer identifying as a soccer player on Twitter, to the point where he has replaced his bio with, “Elite Web3 Marketing Strategist” and has relocated to Florida and is advising an Indian Web3 developer he met on Twitter. Or someone taken over Sarvas’ still-verified account and is using it so blatantly that they’ve literally joined a startup with his identity.

Sarvas has other social accounts, including an Instagram, but it hasn’t been updated since March.

All of this is weird and confusing and, unfortunately, this is as far as we’ve been able to get. There aren’t a lot of things linking these accounts together, but the idea that multiple verified accounts on Twitter have seemingly been hijacked to promote shady NFT lines is troubling to say the least.

It’s also unclear how connected these accounts are. Though, the strategy appears to be the same: Take over a verified account that’s connected to a real person, focusing specifically on professional gamers and athletes, and then use it to constantly promote NFT projects. And, in the case of Sarvas’ account, use one of these hijacked accounts to actually take money from other NFT developers in exchange for “marketing,” which may well just mean promoting the project on Twitter.

How is this happening? I’d guess some kind of phishing scam, which are very popular in the crypto world. Click the wrong link on a sketchy DM and suddenly your Twitter account has been turned into an NFT zombie. But the fact that Twitter isn’t doing anything about these zombie accounts — or the hacks that get them hijacked — is very odd.

If this has happened to you or someone you know, let me know. My DMs are open. If I start suddenly promoting NFT projects, though, you’ll know the NFT scammers got to me.

The following is a paid ad. If you’re interested in advertising, just reply to this email and let’s figure something out. Thanks!

Enhance Google with your past research. For a memory boost.

You probably read dozens of articles like this daily. But when you need to reference a specific one, you can't find it and your best ideas never develop. Heyday automatically saves pages you visit. And then, resurfaces them alongside relevant Google search results – to boost your memory. Try it.

If you want to listen to the podcast companion to this story, you can do that here:

Your normal roundup-style Garbage Day, including a fantastic column by Allegra Rosenberg and a delightful new installment of my current paid-subscriber-only miniseries, will return on Monday. You can get all that and more by hitting the green button below.

***Any typos in this email are on purpose actually***