The cryptocurrency community faces a relentless barrage of scams, and fresh research published on August 12, 2023, quantifies the threat in stark terms. A team of researchers from San Diego State University has revealed that fraudulent cryptocurrency giveaway schemes operating through Twitter Lists have siphoned over $870,000 from more than 365 victims between June 2022 and June 2023. With Bitcoin hovering near $29,416 and Ethereum at $1,849, the incentive for scammers to target crypto holders has never been greater.
The Threat Landscape
The research, conducted using an AI-powered tool called GiveawayScamHunter, uncovered a sprawling ecosystem of deception operating in plain sight on the platform now known as X. The automated system identified 95,111 scam lists created by 87,617 accounts, all designed to trick users into believing they were participating in legitimate cryptocurrency giveaways. These scams primarily targeted major cryptocurrencies including Bitcoin and Ethereum.
What makes this threat particularly insidious is its exploitation of Twitter’s built-in List feature—a tool designed for organizing accounts by topic. Scammers hijacked legitimate accounts and created bot networks to generate fraudulent lists that appeared authentic to unsuspecting users. The research team discovered 327 distinct scam-related internet domains and 121 previously unknown cryptocurrency wallet addresses associated with these fraudulent operations.
Perhaps most alarming is the persistence of these operations: 44% of the identified scam accounts remained active as of August 10, 2023, despite the researchers reporting their findings to the platform. This highlights a fundamental challenge in the fight against crypto scams—social media platforms are not moving fast enough to protect users.
Core Principles
Protecting your cryptocurrency holdings starts with understanding that if something sounds too good to be true, it almost certainly is. Legitimate cryptocurrency projects do not distribute free tokens through social media lists or unsolicited direct messages. The foundational security principle for crypto holders is skepticism—always verify claims independently before taking any action.
Private key management forms the bedrock of personal crypto security. Your private keys should never be shared with anyone, entered into any website, or stored in plain text on internet-connected devices. Hardware wallets provide the strongest protection by keeping private keys isolated from internet exposure. For holdings of significant value, a hardware wallet is not optional—it is essential.
Multi-factor authentication adds a critical layer of defense for exchange accounts and email addresses associated with crypto services. Authenticator apps are significantly more secure than SMS-based two-factor authentication, which is vulnerable to SIM-swapping attacks—a tactic frequently employed by crypto thieves.
Tooling and Setup
Building a robust security posture requires the right tools. Start with a reputable hardware wallet such as a Ledger or Trezor device. Configure it using a clean, offline computer and write your recovery seed phrase on paper or a metal backup plate—never digitally. Store the backup in a secure physical location, ideally in a fireproof safe or a bank deposit box.
For daily transactions, use a dedicated browser profile with minimal extensions and no saved passwords. Install a reputable password manager to generate and store unique, complex passwords for every crypto-related service. Enable authenticator-based two-factor authentication on every platform that supports it.
When evaluating whether a crypto opportunity is legitimate, use blockchain explorers like Etherscan or Blockchain.com to verify wallet addresses independently. Check whether the project has been audited by recognized security firms. Search for the project name alongside terms like “scam” or “review” to find community feedback. The absence of negative information should not be taken as proof of legitimacy—new scams surface daily.
Ongoing Vigilance
Security is not a one-time setup but an ongoing discipline. Regularly review the permissions you have granted to decentralized applications. Revoke access to any dApp you no longer use through tools like Revoke.cash or Etherscan’s token approval checker. Monitor your wallet addresses for unauthorized transactions using portfolio tracking tools with alert features.
Stay informed about the latest scam tactics by following reputable cybersecurity researchers and organizations on social media. The GiveawayScamHunter research demonstrates that AI tools are increasingly being used to detect and expose scams, but individual vigilance remains the first and most important line of defense.
Be particularly cautious during periods of high market activity. Scammers exploit excitement and FOMO to push fraudulent schemes. When Bitcoin makes a significant move or a new token generates buzz, expect a corresponding surge in scam attempts. Slow down, verify everything, and never act under pressure.
Final Takeaway
The $870,000 in documented losses from Twitter-based crypto scams represents only a fraction of the total damage inflicted by fraudulent schemes across all platforms. The cryptocurrency market, with its total capitalization exceeding $1.13 trillion, will continue to attract sophisticated criminal operations. Your best defense is a combination of robust tooling, disciplined security practices, and an unwavering commitment to independent verification. The tools exist to protect yourself—the question is whether you will use them before becoming the next statistic.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult security professionals for personalized guidance.
95,111 scam lists hiding in plain sight and Twitter needed a university research team to find them. their trust and safety team is a joke
$870K from 365 victims is roughly $2,400 per person average. these arent whales getting clipped, its regular people losing meaningful money
GiveawayScamHunter found 95k scam lists and twitters response was to add more colored checkmarks. genuinely dystopian incentive structure
$870K across 365 victims is about $2,383 per person. these arent whales, just regular people getting fleeced by fake accounts
Poul H. exactly. nobody cares because its $2k per victim not $2M. class action impossible, law enforcement wont bother. perfect crime statistically
Poul H. 2383 dollars average per victim means these are working class people not whales. the kind of loss that doesnt get reported because victims are too ashamed
Poul H. $2,383 average loss per victim and zero platform level recourse. x literally monetized the scam accounts with blue checks while victims ate the loss
95,111 scam lists and 87,617 accounts. and twitter probably responded by adding another checkmark tier
365+ victims in a year is actually low compared to what I expected. the real number is probably 10x since most people do not report
chillvibes is right, $870K is the reported number. the actual damage from twitter giveaway scams is easily in the tens of millions. most victims are too embarrassed to come forward
12 out of 95,000 is generous. their automated systems cant even catch copycat accounts using the exact same profile picture
and they wonder why nobody trusts the blue checkmark system. 95k scam lists and x probably flagged 12 of them
95k scam lists and they responded by charging for verification. the incentives are so backwards it hurts
twitter had the list API public for years. moderation was never the priority because engagement metrics rewarded scam accounts inflating DAU numbers
fault_overflow_ twitter leaving the list API public for years while engagement metrics rewarded scam accounts tells you everything. DAU numbers mattered more than user safety
$870K stolen through Twitter Lists of all features. scammers will use every tool available, even the boring ones nobody thinks about
using Twitter Lists to organize scam accounts is genuinely clever. hides the fraud in a feature nobody monitors. the researchers deserve credit for catching this pattern
scam_radar_ using a boring organizational feature like Lists to run fraud is genuinely clever from an attacker perspective. hides in plain sight because nobody monitors list activity
list_audit_rat the genius of using Lists is that Twitter never built moderation tooling for it. every other feature has report flows but Lists flew under the radar for years
the AI powered detection tool finding 95k lists that twitters own moderation missed is pretty damning. platform has no incentive to fix what doesnt hurt their ad revenue
95 thousand scam lists and 87 thousand accounts. the scale tells you this was industrialized fraud, not individual scammers working alone
Heike B. 95k scam lists and twitter never built moderation for it. the feature was too useful for engagement metrics to kill
2383 dollars average loss per victim. working class people getting fleeced while x charges for blue checks. incentives could not be more broken
GiveawayScamHunter found what Twitters own trust and safety couldnt. 95k scam lists means moderation wasnt underfunded it was deliberately ignored
SOC_intern_ exactly. you dont accidentally miss 95,000 lists. DAU metrics from scam accounts were too profitable to kill