Bitcoin Ordinals Hype Lures Meme Token Traders Into Wallet Drainer Attack

Ordinals go Bitcoin a way for creators to “write” NFT-such as digital media and later meme tokens on the Bitcoin blockchain – but along with significant growth have come the same types of scams and exploits that have flourished on other platforms. Last week, the Ordinals room saw what is being described by some users as the largest such attack to date.

On Friday, a new alleged meme token project called ORNG launched, offering users the ability to mint a BRC-20 fungible token via the Ordinals protocol. It rolled out on what appeared to some users to be an actual Ordinal’s launchpad site called Luminex.

But it wasn’t Luminex – and apparently the coin wasn’t legal either. It was launched via a knockoff website called “Luminux” (note the naughty vowel change), and soon Twitter users were complaining that their Bitcoin wallets were being drained after they believed they had signed a transaction to stamp the new meme- the token.

It is a well-known story in the world of Ethereum NFTs and token drops, and such “wallet drainer” scams comes in various forms. Sometimes it is through a phishing attack where a manipulated website is created that looks like an actual official website or marketplace. Other times such fraud is spread through a hacked Twitter account by a well-known creator or brand.

It is not clear exactly how much was stolen in the attack, but the wallet linked to the scam was taken about 2.37 Bitcoins— or about $63,000 worth — primarily on Friday, with fewer transactions recorded over the weekend.

Since its launch on Friday, the Twitter account has linked to the scam has rebranded to try to serve up another potential scam, with the same fake “Luminux” landing page tweaked to promote a new token mint. It is still unclear who was behind the fraudulent coins.

Luminex and Bitcoin wallet creator Xverse was among the companies that warned users about the scam and tweeted details on how to avoid falling for similar attempts. A spokesperson for Luminex said so Decrypt that it warned the community “within minutes” of the scam launch.

Like similar scams on Ethereum that have siphoned countless millions of dollars in crypto from unsuspecting users, it often involves people acting too quickly to take advantage of what they believe will be an opportunity to make money.

This “fear of missing out,” or FOMO, often causes crypto and NFT traders to overlook potential red flags. In this case, the growing buzz around Ordinals projects and BRC-20 tokens – including the hyped recent launch of the OXBT token – may have tripped up overzealous coiners.

“Fraud often rides popular project waves, as seen here,” said the Luminex spokesperson Decrypt. “We always encourage our community to double-check URLs and wait for official announcements before joining new projects.”