WoToken AI Swap: A wallet masquerading as a decentralized AI trading aggregator, where assets are bulk-transferred via smart contract backdoors after authorization.

Who Gets Targeted

The victims are primarily retail crypto investors and young-to-middle-aged users accustomed to DeFi applications on hot wallets. Some have experience with on-chain operations but lack the ability to audit smart contracts. They are typically lured by claims of 'AI automated arbitrage,' 'one-time authorization for long-term stable returns,' and 'decentralized, secure, and transparent' operations. They share psychological vulnerabilities such as chasing high returns, trusting technical packaging, and being unwilling to verify contract permissions. Many, even when aware of authorization risks, take the gamble for small airdrops or high APY, ultimately granting token transfer permissions to backdoored smart contracts unknowingly.

骗局怎么运作

• Step 1: Masquerading as an AI trading aggregator. Scammers build websites or DApps that resemble DeFi aggregators, highlighting keywords like 'AI Swap intelligent price comparison,' 'optimal cross-chain paths,' and 'automated arbitrage engines.' They forge trading volumes, user reviews, and fake audit reports to trick users into believing it is a legitimate AI-driven trading tool.
• Step 2: Inducing wallet connection. Scammers distribute bait such as 'limited-time airdrops,' 'AI beta invitation codes,' or 'high-APY liquidity incentives' in communities, Telegram groups, or via private messages, guiding users to click links and connect hot wallets like MetaMask or Trust Wallet. The pitch usually emphasizes, 'Connect only, no transfers, zero-risk participation.'
• Step 3: Triggering malicious authorization requests. Once connected, the page prompts an 'Approve' or 'Authorize' window. However, the target is not a legitimate routing contract, but a backdoored contract pre-deployed by the scammers. The interface intentionally obscures the authorization details or disguises unlimited authorization as 'permissions required for smart contract automation.'
• Step 4: Planting the mine with unlimited allowance. Once the user clicks confirm, they are actually granting unlimited token transfer permissions. Some contracts include delayed triggers or small-batch transfer rules to bypass on-chain monitoring and security alerts. At this point, the user's assets appear to be in the wallet, but control has already been partially compromised.
• Step 5: Bulk transfer and faking system failure. After accumulating enough authorized accounts, scammers use the contract backdoor to bulk-transfer the authorized tokens to multiple intermediary addresses, then launder them through mixers or cross-chain bridges. When users report failed withdrawals or zero balances, 'customer service' pacifies them with excuses like 'on-chain congestion' or 'AI strategy drawdown,' before shutting down groups and deleting domains to vanish.

红旗信号（看到这些快跑）

• 🚩 Requests to connect a wallet immediately trigger an 'Approval' request, but the target address is not a well-known DEX or DeFi protocol.
• 🚩 The authorization limit is set to 'unlimited' by default or forced, rather than the specific amount required for the current operation.
• 🚩 The website domain is highly similar to a well-known official project but has a short registration history, no credible team information, and no open-source contracts.
• 🚩 Promotional materials rely heavily on buzzwords like 'AI automated arbitrage,' 'zero-risk airdrops,' or 'guaranteed returns.'
• 🚩 Community members or customer service frequently pressure users to authorize, claiming 'rewards cannot be claimed without authorization' or 'funds will arrive immediately after authorization.'

真实案例

• In April 2026, OFweek AI reported that AI scams had evolved from selling courses to token-based pyramid schemes, noting projects that used the guise of AI trading aggregators to induce wallet authorization, with funds automatically transferred via on-chain contracts.
• Exposés related to Binance Mall (BNM) showed scammers using 'zero-cost' bait to guide users to connect wallets; after authorization, assets were bulk-drained by contract backdoors, affecting tens of thousands of accounts.
• Public records indicate that the WoToken cryptocurrency pyramid scheme case has entered judicial proceedings, involving approximately 710,000 people and 7.7 billion RMB. Even after the second-instance verdict, some users remain trapped in the aftermath.

Official Stance

• In April 2026, the Ministry of State Security issued a token security alert, warning the public to be wary of scams promising 'wealth through token hoarding.'
• The Cyberspace Administration of China previously reported on the investigation of the website 'www.4stoken.cn' for illegally operating AI large model API interfaces.
• Public security bureaus in various regions continue to issue warnings regarding wallet authorization scams, advising users to be cautious with authorizations and to regularly check wallet permissions.

How to Protect Yourself

• ✅ Before connecting a wallet, verify the proposed contract address via a block explorer to confirm it matches the official protocol address.
• ✅ Reject any default 'unlimited' authorization requests; limit authorization to the minimum amount required for the current operation and set an expiration time if possible.
• ✅ Install and use wallet permission management tools to regularly revoke unused token authorizations to avoid long-term exposure.
• ✅ Remain vigilant against claims of 'AI automated arbitrage,' 'zero-risk airdrops,' or 'long-term returns from one-time authorization,' and avoid clicking suspicious DApp links.
• ✅ For large assets, use a cold wallet or a dedicated hot wallet for isolation; do not store excessive amounts of token-approvable assets in a single wallet.