Post-UST Collapse Aftermath: Fake Claim Channels and Terra 2.0 Airdrop Phishing Double Scams

Who Gets Targeted

Victims fall into two categories: First, existing victims from the 2022 collapse—mostly retail investors aged 25 to 45 with some crypto asset experience who lost tens of thousands to millions of RMB and are desperate to recover their losses. Seeing 'official compensation registration' causes them to drop their guard. Their psychological vulnerabilities are sunk cost fallacy and loss aversion, making them prone to viewing phishing links as a lifeline. Second, new speculative entrants who heard rumors that the Terra ecosystem 'might restart payouts or airdrop new chains,' taking a low-cost gamble to buy the dip and clicking unknown links. Their common traits are a heavy reliance on Telegram group rumors, a lack of ability to verify official domain names, and a habit of 'self-rescue' due to a lack of recourse for crypto rights protection, precisely falling into the trap of targeted hunting by fake customer service and liquidation entities.

骗局怎么运作

• Step 1: Public sentiment harvesting and target selection. Scammers monitor trending searches and news comment sections regarding 'Do Kwon sentencing' and 'Terraform bankruptcy liquidation,' filtering for active UST victims in related Telegram groups and X (Twitter) comment sections, or directly purchasing leaked user email and wallet address lists from dark web exchanges prior to the crash. They initiate one-on-one direct messages using the script 'Upon review, your account qualifies for Terraform Labs compensation registration,' creating the illusion of an official targeted notification.
• Step 2: Forging authoritative identity endorsement. Scammers build phishing sites nearly identical to the Terraform Labs liquidation page, falsely claiming to act under court, liquidator, or SEC commission to conduct 'victim loss registration,' and even forging judgment screenshots and stamped documents. The script runs: 'Total compensation is $4.47 billion, distributed proportionally; registration window is open for only 30 days.' They leverage real news events as trust endorsements to make victims mistake this for post-judgment statutory procedure.
• Step 3: Inducing wallet connection and authorization. The phishing page requires victims to 'verify on-chain holdings to calculate compensation amounts,' guiding them to connect wallets like MetaMask and sign an authorization. What they actually sign is a malicious smart contract transaction granting unlimited spending approval (Approve). Victims think it is merely login verification, and the stablecoins and tokens in their wallet are then batched away by the contract. The entire process is irreversible on-chain.
• Step 4: Pre-payment exploitation. For victims who refuse to connect their wallets, a classic script is used: 'You must first pay legal fees, gas fees, and cross-border transfer deposits before funds can be released.' They claim compensation amounts are in the tens of thousands of dollars but require an upfront 5% to 10% processing fee, leveraging expectations of imminent large payouts to make targets continuously add payments. Payment addresses belong to mixers or relay accounts, and funds are transferred immediately upon receipt.
• Step 5: Fake Terra 2.0 ecosystem airdrops. Borrowing from the historical fact of the new LUNA chain airdrop, scammers spread fake snapshot pages claiming 'old holders can claim retro-active airdrops,' stating the project team is making additional distributions to make up for losses, and requiring victims to stake assets to 'activate eligibility.' The staking pool is actually a scammer-controlled contract from which funds cannot be redeemed upon maturity, completing the final round of harvesting on an already injured population.

红旗信号（看到这些快跑）

• 🚩 Any message claiming to be 'Terraform official compensation registration' or 'court-designated liquidation channels' that reaches out via direct message, comment sections, or mass emails—actual judicial compensation is publicized by court administrators through verified bankruptcy case systems and never proactively DMs retail investors.
• 🚩 A 'qualification verification' page that requires connecting a wallet and signing an authorization—regular inquiries only require a public wallet address for read-only checks. Any page demanding transaction signatures or approvals is stealing funds.
• 🚩 Demanding processing fees, security deposits, lawyer fees, or gas fees prior to receiving compensation—judicial bankruptcy distributions never charge creditors upfront fees.
• 🚩 Domain names with subtle differences from official ones (an extra letter, a different top-level domain), while the page completely replicates judgments, news screenshots, and countdown timers—countdowns creating urgency are standard high-pressure tactics.
• 🚩 Group chat posts displaying 'successfully received compensation' that come from newly registered alt accounts with nice avatars but empty posting histories, while admins mute dissenters.
• 🚩 Claims that 'internal channels can privately acquire your LUNC/USTC claims at a higher price than liquidation value' coupled with demands for offline trading—these are invariably fund-stealing or money-laundering channels.

真实案例

• In May 2022, UST and LUNA vaporized about $45 billion in market value within a week (as documented by Wikipedia and other public records), affecting a large number of investors worldwide. South Korean prosecutors subsequently received multiple collective investor reports. A South Korean investor, emotionally collapsed due to heavy losses, broke into Do Kwon's residence and was detained by police. This incident was widely reported by South Korean media and became a symbolic case of victims' despair.
• In February 2023, the U.S. SEC sued Terraform Labs and Do Kwon for securities fraud; in April 2024, a New York federal jury ruled liability for fraud, and in June 2024, both parties reached a settlement of approximately $4.47 billion, with Terraform Labs entering bankruptcy liquidation proceedings. Following public disclosure of the judgment, on-chain security firms and multiple media outlets recorded a concentrated surge of phishing websites and fake airdrop activities impersonating 'Terraform liquidation compensation.' (Source: [https://www.businesstimes.com.sg/companies-markets/banking-finance/terraform-pay-us4-47-billion-settle-sec-fraud-case](https://www.businesstimes.com.sg/companies-markets/banking-finance/terraform-pay-us4-47-billion-settle-sec-fraud-case))
• On December 11, 2025, the U.S. Federal Court in New York sentenced Do Kwon to 15 years in prison (exceeding the prosecutors' 12-year recommendation). The judgment disclosed that he used fake trading bots to manufacture the illusion of UST anchoring. During the peak of sentencing news propagation, a large volume of 'register for claims and join the group' traffic-driving posts appeared on Chinese social media. Multiple users reported in communities that wallet assets were drained after clicking the links, prompting cryptocurrency security media to issue secondary scam warnings. (Source: [https://www.sohu.com/a/964264853_122014422](https://www.sohu.com/a/964264853_122014422))
• In May 2022, following the collapse of TerraUSD and LUNA, a South Korean investor claiming losses of about 2 billion to 3 billion KRW lost emotional control, broke into founder Do Kwon's apartment building in Seoul, and rang his doorbell demanding he face them. At the time, about 200,000 investors suffered losses, and the incident was reported by multiple media outlets, becoming a signature case of collapse victims' despair. (Source: [https://mothership.sg/2022/05/do-kwon-trespassing/](https://mothership.sg/2022/05/do-kwon-trespassing/))
• In June 2022, security agencies disclosed 'secondary scams' targeting LUNA collapse victims: bad actors impersonated officials to launch a so-called 'TERRA Giveaway,' claiming they would give away $100 million and using 'double returns' as bait to lure victims into connecting their wallets for authorization. After signing, wallet assets were stolen. Concurrently, PeckShield warned that individuals were forging Wrapped LUNA 2.0 token airdrops to drive phishing traffic. (Source: [https://www.pcrisk.com/removal-guides/24039-luna-giveaway-scam](https://www.pcrisk.com/removal-guides/24039-luna-giveaway-scam))

Official Stance

• On February 16, 2023, the U.S. Securities and Exchange Commission (SEC) formally sued Terraform Labs and Do Kwon, charging them with fraudulent misstatements regarding the sale of unregistered securities to investors and the algorithmic stablecoin anchoring mechanism (SEC Official Litigation Release).
• In June 2024, the SEC announced a civil settlement of approximately $4.47 billion with Terraform Labs and Do Kwon, including disgorgement of ill-gotten gains and civil penalties, reminding investors that this case highlights the major risks of high-yield marketing for algorithmic stablecoins (SEC Official Press Release).
• On December 11, 2025, the U.S. District Court for the Southern District of New York sentenced Do Kwon to 15 years in prison in connection with the Department of Justice criminal indictment, with prosecutors characterizing it as one of the largest frauds in cryptocurrency history (U.S. Department of Justice and Court Public Information).
• Following the collapse in May 2022, the Seoul Southern District Prosecutors' Office in South Korea launched an investigation into Terraform Labs and applied for an arrest warrant for Do Kwon. South Korean financial regulatory authorities warned that algorithmic stablecoins are high-risk assets unbacked by legal tender (South Korean Prosecutor and Financial Services Commission Public Notice).

How to Protect Yourself

• ✅ Verify any 'compensation registration' information through only two channels: public disclosure on the U.S. court electronic filing system (PACER) and the bankruptcy court-designated claims administrator's official website, alongside the SEC website investor alert page. Treat all links sent via private messages, comment sections, or group announcements as preliminary scams.
• ✅ Ironclad rule of wallet operations: Checking balances and claim eligibility does not require signing any transactions. Immediately close any page that asks you to connect your wallet and click 'Approve/Authorize,' and use revoke-style tools regularly to check and cancel historical authorizations.
• ✅ Never prepay any fees to any account claiming to offer 'accelerated compensation' or 'internal redemption.' Judicial bankruptcy distributions are paid proportionally from liquidated assets; personal expedited channels do not exist.
• ✅ Bookmark genuine SEC and court news media domain names in your browser. When encountering counterfeit pages, compare domain spelling and registration information first, and treat pages with countdowns or quota limits as phishing by default.
• ✅ For compromised on-chain transfers, immediately save the transaction hash and address, report the case to the local police station, register on the national anti-fraud platform, and report scam addresses to blacklists published by on-chain analysis firms to preserve evidence for potential future on-chain freezing and asset recovery.