Popular on-chain sleuth ZachXBT has unmasked another crypto scammer responsible for stealing millions of dollars in digital assets using sophisticated phishing attacks.

The thief’s targets included the discord services for DeFi projects such as Orbiter Finance and Pika Protocol.

Impersonation and Confiscation

In a Twitter thread published on Monday, ZachXBT explained that the attacker, Soup (aka Dan) enacted his scam by impersonating Luke Hamlton – an employee for the crypto media outlet Decrypt.

In collaboration with other Scammers, Soup lured members of various crypto project teams into joining a fake Decrypt Discord server. He then tricked them into submitting KYC information as part of a fake application and interview process, only to later embed phishing attack in an “elaborate attempt to steal their Discord token.”

2/ Soup creates fake @decryptmedia websites and poses as Luke Hamilton (a real Decrypt employee)

He works with other scammers to approach team members of crypto projects to trick them into joining a fake Decrypt Discord server in an elaborate attempt to steal their Discord token pic.twitter.com/Oe6mX2zFk1

— ZachXBT (@zachxbt) July 17, 2023

A Discord token is an alphanumeric string acting representing a user’s login credentials, giving them access to any servers they own or are a part of.

The scammer compromised the Pika Protocol Discord server on May 30, 2023, posting a malicious link in the announcements channel, allowing them to steal $220,000 in crypto. In a private DM, Dan admitted to receiving 15% of the scammers’ profits.

The following day, the scammers attacked Or