Jayz Nguyen

Last week, I lost my entire cryptocurrency portfolio - low six figures built over eight years. Not from a rug pull. Not from connecting to a malicious dApp. I never even had my wallet open. I've been in Web3 since 2017. Early Polygon investor. Mined ETH when it was still proof of work. Helped build the DeFi ecosystem on polygon and BSC. I believed in keeping assets on-chain rather than on centralized exchanges. That belief cost me everything. ━━━━━━━━━━━━━━━━━━━━ 𝗛𝗼𝘄 𝗜𝘁 𝗛𝗮𝗽𝗽𝗲𝗻𝗲𝗱 I came across a beta testing opportunity for a gaming project called "MetaToy" in a Telegram group. Professional website. Active Discord. GitBook documentation. A team member named "Shanni" (Telegram: @shannimt) who claimed to be "Cofounder Meta team" with credentials including work for @Persistenceone and @BitunixOfficial. They answered questions thoughtfully and didn't rush me. As someone who's evaluated countless Web3 projects, I thought I knew how to spot scams. This one looked legitimate. The fatal mistake: downloading their "game launcher" to test the beta. The moment I ran that installer, malware embedded itself in my system. Here's what makes this attack sophisticated: I never connected my wallet to anything. My antivirus Norton (don't you guys have a guarantee for this? I'm on 360 deluxe and scanned the file.) immediately flagged suspicious activity. I ran full system scans, boot-time scans, deleted every suspicious file and registry entry I could find. I thought I was safe. I even reinstalled windows (11) after enabling TPM2.0 and memory isolation. Twenty-four hours later, every single wallet connected to my Rabby and Phantom browser extensions was completely drained. Not just my main wallet - all of them. Police report Police report was made 2152 hours at 12 December Report number F/20251212/7113 @SingaporePolice looking forward for someone to get a hold of me - email, whatsapp etc. ITs been 3 days. The attacker may have offramped the funds already but the exchanges / trail are detailed below. @zaobaosg already gave me a call before anyone else. ━━━━━━━━━━━━━━━━━━━━ 𝗧𝗵𝗲 𝗖𝗼𝗹𝗹𝗮𝘁𝗲𝗿𝗮𝗹 𝗗𝗮𝗺𝗮𝗴𝗲 This wasn't just my money. I was diamond-handing tokens from friends' projects I believed in - @tpro_network , SBPgame.com , @NLGFoundation @xprotocol_org @dFusionAI . Projects I wanted to support through holding. All gone. I was a crypto angel investor with a portfolio built over eight years. Now I'm just a regular Joe starting from zero. ━━━━━━━━━━━━━━━━━━━━ 𝗧𝗵𝗲 𝗧𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗥𝗲𝗮𝗹𝗶𝘁𝘆 The malware had already exfiltrated my encrypted wallet data before I even knew anything was wrong. All my cleanup efforts were already too late. The attacker waited patiently, decoded what they needed, and executed the theft when I thought the danger had passed. This wasn't a case of clicking "Approve" on a bad transaction. This was credential theft at the operating system level. My belief in self-custody over CEXs - something I'd advocated for years - backfired catastrophically. ━━━━━━━━━━━━━━━━━━━━ 𝗪𝗵𝘆 𝗜'𝗺 𝗦𝗵𝗮𝗿𝗶𝗻𝗴 𝗧𝗵𝗶𝘀 I'm a cofounder of RektSurvivor (rektsurvivor.com) - a free, non-profit community for people who've lost funds in crypto, built with Hsu-Chuan Li @_cryptobuddha of Offchain.Social. The irony is not lost on me. I've spent years helping others navigate these situations, and now I'm one of them. This is my second trip to rock bottom. When I left NTUC Club in 2013 to become an entrepreneur, I was negative $50k net worth. The difference is I was a lot younger then. I'm 44 now. ━━━━━━━━━━━━━━━━━━━━ 𝗙𝗼𝗿 𝗧𝗵𝗼𝘀𝗲 𝗪𝗵𝗼 𝗪𝗮𝗻𝘁 𝘁𝗼 𝗛𝗲𝗹𝗽 We've identified the attacker's primary wallet: 0xc17490aff678cc88712e117a413087949faba7e9 They've been off-ramping through three exchanges. Key transaction hashes for investigators: Cryptomus: 0x83ea24db8b7387100b7220f2eb9afb5f907af4987598000bf15d4db1303e8e6c Binance (via 0x19f4ceabd94b809d139377e96b8ecd2cc1e4beb7) WhiteBIT (via 0x19c5fb71f193c53ab893d69468b7e98dc8975664) A police report has been filed with Singapore Police Force. If you have any information about the person behind Telegram handle @shannimt or the MetaToy scam operation (metatoy.io - ⚠️ DO NOT visit, malicious site), please reach out. My original wallet address was 0xBb77eDa00654bb78aF2E1B9c40c14Df8Fc1e9bE9 - I'm "hawkerize" on DeBank. That identity is now a memorial to what I lost. Attack breakdown Initial Contact Phase Date/Time/Event 5 Dec 2025, 10:03 Victim contacts scammer (Telegram: @Hylo, username "Shanni") after seeing job posting in "memewonder" group for moderators/community managers and beta testers. 5 Dec 2025, 10:53 Scammer shares fraudulent project links: metatoy.io, x.com/MetaToyGame, discord.gg/metatoy 8 Dec 2025, 06:44 Scammer sends application form requesting personal info including ERC20 wallet address 9-10 Dec 2025 Ongoing communication; scammer offers job at $500-600/month with flexible hours Malware Delivery Phase Date/Time Event 11 Dec 2025, 08:05 Scammer tells victim to get "code for the launcher" from developer 11 Dec 2025, 08:10 Scammer provides code "eqpdra" and instructs victim to download launcher from website 11 Dec 2025, ~08:30 Victim downloads and installs malicious "MetaToy" launcher 11 Dec 2025, ~08:45 Norton Antivirus blocks credential theft attempts from "electroninstallationtelemetrylogsaver64" and "rmclient.exe" 11 Dec 2025, 09:05 Victim confronts scammer about malware detection; declines to continue Theft Execution Phase Date/Time Event 12 Dec 2025 Approximately 24 hours after malware installation, victim's Rabby and Phantom browser wallet extensions are drained 12 Dec 2025, 06:00-06:02 UTC-07:00 First wave of fund transfers to attacker consolidation wallet 0xc174...a7e9 12 Dec 2025, 20:13 Victim discovers theft and messages scammer on Telegram 12 Dec 2025 (ongoing) Attacker begins off-ramping stolen funds through multiple CEXs 4. MALWARE TECHNICAL DETAILS Delivery Method: Fake game launcher download from metatoy.io website, requiring invitation code "eqpdra" Malicious Components Identified: •        electroninstallationtelemetrylogsaver64 - Attempted browser credential theft •        rmclient.exe - Attempted browser credential theft via process injection •        Registry entry: HKEY_CURRENT_USER\Software\electroninstallation PIHTYW •        Installer folders in %AppData% and %LocalAppData% Malware Behavior: The malware targeted browser extension wallets (Rabby, Phantom) by attempting to access encrypted vault data and/or capturing credentials through process injection into legitimate Windows processes. Norton Antivirus blocked some credential theft attempts, but the malware likely exfiltrated wallet data before or through methods that evaded detection. ━━━━━━━━━━━━━━━━━━━━ 𝗙𝗔𝗤𝘀 𝗜 𝗞𝗻𝗼𝘄 𝗬𝗼𝘂'𝗹𝗹 𝗔𝘀𝗸 Did you connect your wallet to a dApp? → No. Never. Were you logged into your wallet when the attack happened? → No. I kept my wallet logged out from the moment Norton's initial alert triggered. Why didn't you use a burner wallet? → I wasn't connected to any dApp. I only installed what I thought was a game beta launcher. That was enough. Have I contacted the Exchanges → I have contacted Cryptomus so far on their contact form. And I have submitted a police report in Singapore, I have faith in our country's cybercrimes division. ━━━━━━━━━━━━━━━━━━━━ 𝗪𝗵𝗮𝘁 𝗜 𝗪𝗮𝗻𝘁 𝗬𝗼𝘂 𝘁𝗼 𝗧𝗮𝗸𝗲 𝗔𝘄𝗮𝘆 If you download and run any executable - even from a "legitimate-looking" project - you are exposed. Browser extension wallets are vulnerable to system-level malware regardless of whether you're logged in or connected to anything. Consider hardware wallets for anything significant. Treat every download as a potential attack vector. I already use redundant wallets, cold wallets, multisigs, have 2FA on everything, strong passwords, a password manager, airgapped physical recovery phrases. So believe me, you CAN BE A VICTIM still. And if you get rekt, know that you're not alone. RektSurvivor exists because this community is stronger together. ━━━━━━━━━━━━━━━━━━━━ 𝗔𝗰𝗸𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲𝗺𝗲𝗻𝘁𝘀 Blockchain forensic charts provided by Basel Ismail, Founder of @Blockcircle - thank you for the rapid analysis that helped trace the fund flows. To the RektSurvivor community members who reached out with support, emergency funds, and even job offerings - your kindness in my darkest moment means everything. Special thanks to Daniel Milton, Louis Chen, Jan Hanken of Arc Accelerator, John and Howie of @elephantsinc Elephants.inc, and @Jayz079 Jayz Nguyen of @ Ufin. ━━━━━━━━━━━━━━━━━━━━ If you've experienced something similar or want to learn more about protecting yourself, visit rektsurvivor.com 📷Maximize imageEdit imageDelete image #Web3Security #CryptoScam #InfoSec #RektSurvivor #CyberSecurity #Blockchain #CryptoSafety

🎉 Discover Cambodia with @TPRO_Network X @relocatify1 🇰🇭 and join the Epic $TPRO burn!🔥 GM Legends! We are organizing a special giveaway for you. What you can win: 💥1X flight ticket to Cambodia* 💥1X 7-day luxury resort stay for 2 people on a Cambodian Island 💥1X 7-day luxury crypto resort stay at Satoshi’s Paradise** 💥5X online setups of Cambodia bank accounts 💥5X $250 in $TPRO How to participate: • Each coupon gives you 1 chance. • For 15 USDT or USDC you can get 1 coupon. • For TPRO worth $12 you can get 1 coupon. Send TPRO or USDT / USDC before 21.09.2025 10 PM UTC on ERC20 Chain to this wallet address: 0xAE6C59600a860D9e87E4c7E0B8511996d252Fd25 Price at time of send matters; only tokens bought during the giveaway count. Max 10 coupons per address. ⚠️ All USDT will be used for TPRO buybacks & burns once giveaway ends. 📢 Winners will be announced on X. Only 18+ individuals may participate. No guarantee of winning. Organizers aren’t responsible for token price changes. *Flight ticket prize reimbursed up to USD 1,200. **Satoshi’s Paradise stay 7 nights delivered once the resort is open to guests. Good luck, Legends! ⚡️

@tpro_network @relocatify1 Wonderful

Việt Nam tôi đó! Chưa bao giờ thấy Tinh thần Yêu Nước Nồng Nàn đến thế… Luôn nhớ ơn Bác, các thế hệ Cha Ông đã hoà thân và máu mình vì một nền Độc Lập - Tự Do - Hạnh Phúc ngày hôm nay. Tự hào lắm 2 chữ Việt Nam 🇻🇳!

So, @CoinMarketCap has a new feature about Alt Season. Of the top 100 altcoins, how many of them out performed bitcoin in the past 90 days. I think this is a tough ranking system. 50 is probably a really good score. 😄

You can now download Grok as its own dedicated app

Grok 3 release with live demo on Monday night at 8pm PT. Smartest AI on Earth.

Many people offered to help with @GiggleAcademy, now you can help create good storybooks for kids, and have a chance to win a prize. The storybooks are free for kids to read.

INVESTMENT: Current TVL around ~$818 million. Over 280 dApps deployed on top of it. Тhat’s @BitlayerLabs, the first BitVM Solution that launched in production, with the mission of activating the trillion dollar bitcoin liquidity. Why? Because Bitcoin is way too slow, not programable, no native yield, cannot verify transactions. And because you can use Bitcoin’s trillion-dollar economic security to build some insane blockchain stuff on top of it. That’s exactly what Bitlayer is doing, blending Bitcoin’s strengths with Ethereum-compatible functionality, to bring NFT’s, DeFi, and tons more, to Bitcoin. Bitlayer has just launched the Finality Bridge which empowers users to securely mint BTC into YBTC with minimal trust assumptions. This means Bitcoin users can participate in DeFi sectors like liquidity mining, staking, and lending across the Bitlayer ecosystem and beyond, to boost their yields. Know more on cjn.link/bitlayer and tune in to their live show at 12:00 pm EST on @MarioNawfal. Disclaimer: We are investors. DYOR as this is not financial advice.

and now is the moment. The Backer of @TON_Capy is arriving in town. Shout out to: @BingXOfficial - the inaugural Backer and solid ally on the TonCapy Odyssey. Thanks to BingX's support, TonCapy's journey is much smoother.

@skydegencall @DogEmojiSol @elonmusk Nice Bro. For future

@DogEmojiSol $DOG Long term hold @elonmusk still share content about it. Might run. The dog emoji clearly shown on the background. x.com/elonmusk/statu… gmgn.ai/sol/token/mcqO…

A lot of engagements with community users already, get onto the campaign if you have not yet!

Check out the latest projects on BNB Chain on the thread below! 🤩 bnbchain.org/en/blog/new-pr…

@CharlieHusats See you there 😉

who will be in Hanoi Vietnam next week, would love to catch up!

@CharlieHusats Happy Birthday to you my big Brother. Wish you all the best, wishing your wish of BTC price hit that 🥰🥰

My Birthday , every hour, seeing new BTC ATH We are seeing 100K this week

@CharlieHusats That’s amazing 🤩

2 years ago, I met CZ right after FTX crashed in Bali G20 conference. CZ got interviewed by the Indonesian famous investor, he was quite confused on things. I was quite confused where we were in the history and what I should do for web3 space. It was the beginning of the bear market. 2 years later, crypto industry went through some dark period and now hitting ATH with the biggest and highest level of speakers and crowd. Great to be in web3 industry, especially now working on things for Bitcoin. What an impressive Binance blockchain week. Let’s build this industry bigger and better together!

@CharlieHusats So beautiful

GMGM Amsterdam

Video of the inside of Cortex today, the giant new AI training supercluster being built at Tesla HQ in Austin to solve real-world AI

Frying Fish Club #1 Fish and Chips Singapore at Vietnam now

So beautiful