Deepfake Crypto CEO Livestream Airdrop Scam: AI Impersonation of Exchange Founders to Induce Wallet Authorization and Asset Theft

Who Gets Targeted

Victims are primarily retail cryptocurrency investors, ranging from beginners to those with significant assets but limited security awareness. They are often driven by FOMO (Fear Of Missing Out) triggered by claims of 'exclusive founder giveaways' or 'limited-time airdrops.' Influenced by the atmosphere of livestream chat rooms and real-time likes, they lower their guard, click on phishing links disguised as official pages, and authorize malicious smart contracts. Their psychological vulnerabilities include: trust in the brand endorsement of well-known exchanges, a desire for free tokens, and a lack of understanding of blockchain wallet authorization mechanisms—mistakenly believing that connecting a wallet is harmless, unaware that malicious authorization can lead to unlimited token drainage.

骗局怎么运作

• Step 1: Attackers obtain large amounts of video and audio footage of well-known exchange founders through data breaches or public channels. They use deepfake tools to generate realistic livestream video streams, mimicking expressions and accents in real-time, while forging official airdrop announcements in the livestream title and description to create the illusion of an 'official release.'
• Step 2: Attackers use bots or black-market accounts to inflate engagement on social media and Telegram groups, pushing messages about 'limited airdrops' or 'community rewards' accompanied by fake official website links. These links often differ from the real domain by only one letter or use hidden redirect techniques, making them difficult for the average user to distinguish.
• Step 3: During the livestream, the fake founder repeatedly urges viewers to 'click the link below to claim the airdrop immediately,' claiming it is 'limited to the first 10,000 users,' while displaying a fake countdown of claimed spots. Simultaneously, real-time scrolling 'fake transfer records' and 'winner notifications' in the chat create a sense of authenticity, pressuring users to act quickly.
• Step 4: After clicking the phishing link, the site prompts the user to connect their wallet (e.g., MetaMask, Trust Wallet) and displays an authorization request. The prompt is carefully crafted as 'Authorize contract to claim airdrop,' but it actually authorizes a malicious contract controlled by the attacker, granting them permission to transfer any tokens from the wallet.
• Step 5: Once the user completes the authorization, the attacker immediately uses scripts to initiate batch transfer transactions, draining all available tokens and bound DApp allowances from the wallet. Since on-chain transactions are irreversible, and some users are even tricked into entering their seed phrases on the page, victims can lose their entire life savings within minutes. Afterward, the attackers quickly launder the funds and move them to mixers or privacy chains.

红旗信号（看到这些快跑）

• 🚩 Livestream titles or event pages use hyperbolic language like 'limited time,' 'double return,' or 'founder personally,' despite no such announcements on official channels.
• 🚩 Requests to connect a wallet or enter a seed phrase to claim an airdrop—legitimate airdrops never require authorizing fund transfers or providing private keys.
• 🚩 Repeated pressure during the livestream to act quickly, accompanied by fake countdowns, fake winner notifications, and other elements designed to create urgency.
• 🚩 The event URL domain is highly similar to the official domain with minor differences, or contains misspelled sensitive keywords like 'airdorp' or 'giveaway'.
• 🚩 AI-generated characteristics in the livestream, such as occasional flickering on the face, blurred edges, or voice-to-lip synchronization issues, which appear unnatural, especially in high-definition.

真实案例

• In early 2026, Hong Kong police reported a $34 million deepfake crypto scam, leading to multiple arrests and charges. The fraud ring used AI face-swapping to impersonate crypto platform executives, inducing victims to transfer funds during Zoom meetings. Police confirmed the ring had been operating for several months. (Source: https://www.thestandard.com.hk/news/article/324116/Police-charge-nine-more-in-34m-deepfake-crypto-scam)
• In March 2026, cybersecurity firm Blockeden revealed that a North Korean hacker group used deepfake CEO imagery to launch attacks on Zoom, tricking participants into authorizing wallet signatures and successfully draining multiple crypto wallets, resulting in millions of dollars in losses. (Source: https://blockeden.xyz/zh/blog/2026/03/08/north-korean-deepfake-zoom-campaigns-crypto/)
• In January 2026, Binance founder Changpeng Zhao issued an urgent warning on X, stating that a crypto KOL had been defrauded after being tricked by a deepfake version of a 'colleague' during a Zoom call, reminding users to always verify identities through official channels.
• In May 2024, CNN reported that the British engineering giant Arup confirmed it had fallen victim to a deepfake scam: a Hong Kong employee, believing they were speaking to colleagues and executives forged by AI during a video conference, transferred $25 million (approx. 200 million HKD) to the scammers. (Source: https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk/index.html)

Official Stance

• In January 2026, Hong Kong police issued an alert regarding the $34 million deepfake crypto scam, warning the public to be vigilant against video calls from impersonated platform executives.
• In March 2026, blockchain security firm Blockeden published a research report on North Korean deepfake attacks, warning crypto holders not to connect wallets during untrusted livestreams or meetings.
• Throughout 2026, on-chain analysis firms like Chainalysis and TRM Labs released multiple annual reports noting that losses from AI-driven crypto scams increased by over 300% year-over-year, calling for exchanges and users to strengthen security verification.

How to Protect Yourself

• ✅ Never click on external links claiming to be 'airdrops.' Always operate through the official exchange website or the official app, and verify domain spelling and certificate information.
• ✅ Before connecting a wallet, check if the contract address shown on the authorization page matches the official one. Use browser extensions (e.g., Revoke.cash) to regularly clean up historical authorizations and revoke suspicious permissions.
• ✅ Use hardware wallets to store large assets and set limits for each transaction so that even if authorized, excess transfers are not allowed. Enable multi-signature or secondary confirmation mechanisms.
• ✅ Develop good verification habits: for any livestream or meeting involving assets, confirm the identity through independent channels such as official social media or customer service hotlines, and stay alert for subtle AI artifacts in the video.