Event-driven crypto scams are outpacing static blocklists

At a glance

What this is: Blockaid says crypto scams tied to trending events are converging on the same pattern: lookalike infrastructure, social engineering, and instant theft at the moment of wallet connection or deposit.

Why it matters: This matters to IAM and NHI practitioners because scam infrastructure now behaves like disposable identity and trust abuse at scale, defeating controls that depend on prior reputation, static allowlists, or manual review.

By the numbers:

• April was the worst month for crypto theft on record, with over $629 million drained across more than 20 incidents.

Context

The core governance gap is not new malicious content, but the speed at which attackers can turn real-world attention into trusted-looking digital journeys. In crypto, that means a lookalike domain, a wallet prompt, and a transfer or signature that moves value before any manual process can intervene.

Blockaid's analysis shows that the bait changes faster than the underlying scam mechanics. The campaigns around Musk-related news and the World Cup differed in theme, but both relied on disposable infrastructure, borrowed trust, and user action at the point of compromise.

Key questions

Q: What breaks when crypto scams rely on disposable domains and fresh wallet addresses?

A: Static blocklists and history-based fraud scoring fail because they depend on prior reputation. Disposable domains may exist only briefly, and fresh addresses can look clean until the first victim funds them. Defenders need real-time behavioural inspection at the moment of connection or transfer, plus controls that do not assume malicious infrastructure will stay visible long enough for manual review.

Q: Why do trending events make wallet-drainer and investment scams more effective?

A: Trending events create urgency, borrowed trust, and distraction at the same time. That combination makes victims more likely to click, connect, or deposit before checking whether the site or token is real. The event itself is not the vulnerability. The vulnerability is the speed at which criminals can wrap a familiar brand or tournament around the same theft workflow.

Q: How can security teams tell whether a scam control is actually working?

A: A control is working only if it catches new domains, new tokens, and new destination addresses before users act. If detection depends on reported infrastructure, human review, or name matching, it is already behind. Effective controls should warn at the point of connection or transfer, and they should work even when the campaign uses randomised domains or newly created wallets.

Q: What should platforms do when event-themed fraud starts moving through wallet and payment flows?

A: They should tighten the point-of-action controls first, because that is where value moves. For wallet flows, inspect dApp behaviour before signature. For payment flows, score the destination and the surrounding campaign signals before settlement. The aim is not to classify the event faster. The aim is to stop the transfer while the user still has a chance to reconsider.

Technical breakdown

Why lookalike dApps and deposits work

These campaigns collapse the user journey into a single trust event. In a wallet-drainer flow, a victim connects to a counterfeit dApp and signs a transaction that grants approval or directly transfers assets. In an investment-scam flow, the victim sends funds to an attacker-controlled address after being persuaded by a fake dashboard, deepfake video, or impersonated account. The technical trick is not sophistication in code, but sequencing: the site only needs to survive long enough to collect one signature or one deposit. Once the victim acts, the infrastructure can be burned and replaced. See the Crypto Scam and Drainer Guide.

Practical implication: Treat wallet connection and deposit initiation as high-risk trust events, not routine clicks.

Why disposable domains defeat legacy fraud controls

The attacker model here is built around ephemerality. Domains are machine-generated, re-registered across multiple TLDs, and abandoned before manual blocklists can catch up. Scam addresses often have no history, which means traditional destination-based fraud scoring has little to evaluate. That leaves defenders with a blind spot: the control layer is looking for known bad entities, while the adversary is creating new ones continuously. The right technical response is not more static lists, but live assessment of site behaviour, token behaviour, and destination risk at the moment of interaction.

Practical implication: Shift detection from reputation history to real-time behavioural inspection at connection and transfer time.

Why event-themed impersonation scales so quickly

Trending events supply the attention, urgency, and legitimacy that scam operators need. When campaigns cluster around celebrity brands or major tournaments, attackers can reuse the same wallet-drainer or presale logic while swapping the theme, front-end copy, and social distribution channel. That makes the threat portable across audiences and chains. The result is a reusable fraud pattern rather than a single campaign. For defenders, the important architectural point is that the lure is modular, so controls must focus on what the site, token, or address does rather than what it claims to be.

Practical implication: Design controls to judge behaviour and flow, not just brand name, message text, or asset theme.

Threat narrative

Attacker objective: Steal crypto assets by converting event-driven attention into one-time wallet approvals or direct deposits before the scam infrastructure is reported or blocked.

1. Entry occurs when a victim is pushed from social content, deepfake media, or hijacked accounts to a lookalike site or fake investment offer.
2. Credential harvesting is replaced by approval or deposit capture, where the victim authorises a wallet signature or transfers funds to an attacker-controlled address.
3. Escalation happens as the attacker uses the signed approval or deposited assets to move value out immediately, then abandons the burned domain or wallet path.
4. Impact is the irreversible theft of crypto assets, with victims reporting losses ranging from hundreds of dollars to five figures and operators reusing the same playbook against new events.

Breaches seen in the wild

• xAI API key leak 2025: An xAI developer leaked an API key on GitHub that reached 60+ private Grok models and stayed live for about two months before revocation.
• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Event-driven fraud is now a governance problem, not just a content problem. These campaigns succeed because they combine identity borrowing, disposable infrastructure, and user-authorised transfer logic into a single abuse chain. In practice, that means scam operators are exploiting trust controls that were never designed for real-time social bait and one-click asset movement. Practitioners should treat this as a governance gap between digital trust and payment execution.

Disposable infrastructure is the real control-evasion layer. Attackers can rotate domains, brands, and delivery channels faster than blocklists can mature, so the underlying concept is not brand impersonation alone but scam lifecycle churn. That makes reputation-based defence structurally late. Teams need controls that inspect the behaviour of the site, token, and destination at the moment of use, not after the fact.

Wallet-drainer campaigns and investment scams are two versions of the same trust attack. One steals through a malicious signature, the other through a deceptive deposit flow, but both depend on the victim being convinced to act first. That convergence matters for fraud, IAM, and digital identity teams because it shows how trust can be weaponised without ever compromising a password or account session.

Event-surge scams expose the limits of manual review and static policy. Trending events create rapid spikes that outpace analyst triage, especially when the attacker infrastructure is short-lived and highly repeatable. The practical lesson is that detection must sit at the point of connection, signing, or transfer. Practitioners should assume that the next event will be productised by criminal tooling almost immediately.

What this signals

Attestation must move from identity history to transaction intent. Fraud campaigns built on event hype show why yesterday's reputation is a weak signal when attackers can mint fresh infrastructure on demand. Platforms need to evaluate the transaction context, destination behaviour, and surrounding campaign signals before value moves, not after a report lands.

Campaign churn is now a control-evasion strategy. The important operational lesson is that attacker infrastructure is disposable by design, so response processes built around list maintenance will always trail the threat. Practitioners should prepare for recurring waves tied to whatever story dominates the market next.

For practitioners

• Harden wallet-connection checkpoints Require real-time risk scoring before a user connects a wallet to a new dApp, especially when the site is tied to a trending event or token claim.
• Screen deposits for scam intent at the transfer edge Apply behavioural and onchain screening to destination addresses during deposit and withdrawal flows, not after funds leave the platform.
• Treat trending-event campaigns as ephemeral threats Add response playbooks for fast-moving event bait, including rapid takedown triage, token verification, and social channel monitoring.
• Move beyond brand-based blocklists Detect domain and token behaviour rather than relying on names, because attackers can change labels faster than manual deny-lists can update.

Key takeaways

• Event-driven crypto scams succeed because they merge borrowed trust with disposable infrastructure, which defeats controls built around known bad names.
• Blockaid reported over $629 million drained across more than 20 incidents in April, illustrating how quickly scam patterns can scale once they hit the right audience.
• Practitioners need real-time behavioural checks at wallet connection and deposit time, because static blocklists arrive after the theft has already happened.

Related NHI Mgmt Group resources: Crypto Scam and Drainer Guide · Authorised Push Payment (APP) Fraud Guide · Web3 and Crypto Security Guide · Lottie Player npm compromise 2024

Key terms

• Wallet Drainer: A wallet drainer is malware or malicious logic that tricks a user into signing an approval or transfer that empties assets from a crypto wallet. It often hides inside a fake dApp, compromised front end, or deceptive prompt, and it relies on user confusion rather than technical access to the private key.
• Authorised Push Payment Fraud: A payment scam in which the victim is persuaded to authorise the transfer themselves. The transfer is technically authorised, but the decision is corrupted by deception, which makes liability, evidence, and prevention harder to separate from standard transaction controls.
• Lookalike Domain: A lookalike domain is a web address designed to resemble a trusted brand closely enough to trick users into believing it is legitimate. In identity attacks, the domain becomes part of the deception layer, letting attackers capture credentials, identity details, or payments through a counterfeit flow.
• Scam Infrastructure: The supporting services that make fraud scalable, including escrow, payment routing, messaging channels, data vendors, and laundering tools. Security teams should treat it as a service ecosystem, not just a collection of offenders, because the infrastructure often outlives individual actors.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.