# Loyalist: $4m stolen from over 400 victims

By [Investigations By ZachXBT](https://paragraph.com/@investigations) · 2023-02-16

---

### Background

Since early 2022 Loyalist / Lukas / Shibango has stolen an estimated $4m+ worth of crypto and NFTs through running phishing scams on Twitter and by collaborating with other known phishing scammers.

### July 2022

On July 25 2022 multiple people fell victim to an [ENS domain phishing site](https://twitter.com/PeckShieldAlert/status/1551783367611256833) prompting people to grant approvals to [0xe55](https://etherscan.io/address/0xe555D621020f6AA2Cc10d62FE28b41581B15EfCa) and lose 10 NFTs. This address had been freshly [funded by 0x908](https://etherscan.io/tx/0x21377acea4f9ead35f9a87afe253997ce5ca76f0b4afdaf7d4f0018f50b7ac2e) earlier that day. Prior to then 0x908 had [deposited 100,000 DAI into Tornado](https://etherscan.io/tx/0x592b4d3a79e52c49468b48fd82fd1cefd61286b475e02ac8cf7e281da69d0a21) Cash.

![](https://storage.googleapis.com/papyrus_images/adb636d8b5e5f25a2596f16c9216ff70ee4ff1cafa73b6d68a6a3f53ed555b18.png)

![Source: Peckshield](https://storage.googleapis.com/papyrus_images/e472d0810684e28de615ef0cf2df9d535d4397ee7e28393fbbc685f857abb4c7.jpg)

Source: Peckshield

Stolen funds from 0xe55 were then swept to 0xc997. Connected to 0xe55 are numerous addresses who have fallen to victim to similar phishings scams.

![Blue = documented victim | Purple = main phishing address](https://storage.googleapis.com/papyrus_images/2ba4ed082b9f672be557d74b1eac441945c90caf8ddaef8a3d4de546ff318aef.png)

Blue = documented victim | Purple = main phishing address

Twitter user rugnft had [BAYC 3273, BAKC, and Otherdeed](https://etherscan.io/address/0x6bf3404f18d2088c113a1170c84455ba578404b3#nfttransfers) stolen on July 30 2022 ending up in 0xc997 and 0x85d, two addresses seemingly controlled by Loyalist. Later that day [100 ETH was deposited into Tornado Cash](https://etherscan.io/tx/0x6c2b0032f65f0306a3bf518623b4f3f8980e7d408f7c58620266c7a728859c7f) by 0xc997.

![](https://storage.googleapis.com/papyrus_images/788f47a3558b9b313385f3d6e7496a3d0dc56b79b8700333673619d24285d87b.png)

![](https://storage.googleapis.com/papyrus_images/644e8eafddcb60648314523b2d0d69bb39a262e0ae8463d562b9e13b140ebf1b.png)

### August 2022

On Aug 1 2022 [0xc997 funded a new address 0xa30](http://0x56ac43ff7fcb83561ccbc12f7baea4f59b5ce3b61c8a4e7e843e89b8e562930f) before then [funding 0x572a](https://etherscan.io/tx/0x09d0411abea7b3d04700d8a5e6561b8f221f5f950c98226af6d5c638134f41a0) on Aug 10 2022. [From 0x572a 526 NFTs were stolen](https://etherscan.io/address/0x572a19431474f1fa83d51ee7d730fa37e73ee85b#nfttransfers) from various phishing scams.

EX 1: Twitter user buchetto [phished for Meebit 8661](https://etherscan.io/tx/0x956a803c42376d008de6fce5b711d48ef00298bc1053ae44d89482840cd68485) by 0x572a on Aug 13

![](https://storage.googleapis.com/papyrus_images/1573a602e3104dad4169e1d742f6d6e8a3605857f1f90d9c92c96776541e72e3.png)

![](https://storage.googleapis.com/papyrus_images/5bbb3d737bed544b1669767f491b58bc229dba34d678ede727fadfb4e7a783c7.png)

EX 2: Twitter user StockDisick [phished for 17 NFTs](https://etherscan.io/tx/0xec91a05f22eee0758cca26c0b41614961283a536259698e26a8ffb6df20483f8) on Aug 15 by 0x572a

![](https://storage.googleapis.com/papyrus_images/b68c689f190dc235188bcbb27f6c5da25cec26a7433adf63a78ac0db5b0ac792.png)

EX 3: Twitter user AJslays [phished for 9 NFTs](https://etherscan.io/tx/0x1b5451bb704773d4f5bb503818b01c52f6c8293392721b48b3ab530ef1383bc6) on Aug 15 by 0x572a

![](https://storage.googleapis.com/papyrus_images/100f2ee88422ad14cec7e8c2f0a42bf3725513f737b791139a2e8c26790655df.png)

EX 4: Twitter user Jasoncooperpix [phished for 5 NFTs](https://etherscan.io/tx/0x94ac38e93adc5bed81e18580eddfb1680a490e06efc74dd791b2416189731471) on Aug 21

![](https://storage.googleapis.com/papyrus_images/60f8a7f32703b1c54084ccf649d719c349e03e43e6743db82ed82f327bc8a722.png)

### Discord

In August 2022 Loyalist became active in the Doodles Discord server with the username Shibango#8161 (ID: 819713798419251280)

Inside the server Loyalist revealed his Twitter account “[Loyalist](https://twitter.com/loyalist)” along with the matching ENS address “[loyalist.eth](https://etherscan.io/address/0xedfdb6d56bfb8a45938e815978d101dcd75476d2)”

![](https://storage.googleapis.com/papyrus_images/bae7c6f3f590b5e44ee7e0f5d8a05cbf86e67a1ec7c1dd09d6bd482e6dc55dbf.jpg)

![](https://storage.googleapis.com/papyrus_images/eeca294eadf6f386548d9037f5c348d3a2c4f480ebccf1b6cdad32ab280bf5ce.png)

![](https://storage.googleapis.com/papyrus_images/62473b072470496ea4b2bbc8f92def877fe38e1cdbcddb7ffd9906a7a4ab02f2.jpg)

Doodle 6755 matched what was posted to Discord and [his OpenSea](https://opensea.io/loyalisteth/activity/doodles-official) profile.

![](https://storage.googleapis.com/papyrus_images/fd41c6ccf3702c2d78780010fee4e2fd23399c335ecb7d2d28e918d737198b62.jpg)

![](https://storage.googleapis.com/papyrus_images/19aa5621f42fbad132520253c19609c126676f86fadba8d49b6cd9fd93e4e94d.png)

Visiting [loyalist.eth](https://etherscan.io/address/0xedfdb6d56bfb8a45938e815978d101dcd75476d2) revealed the address was primarily funded by multiple large Tornado Cash withdrawals.

![](https://storage.googleapis.com/papyrus_images/a0d240872c3b43ddab00ce2312d426b7648930d43d1d82d58e4cffa7ce9bd16f.png)

From earlier in this article it was revealed 0x908 had made a [100,000 DAI deposit](https://etherscan.io/tx/0x592b4d3a79e52c49468b48fd82fd1cefd61286b475e02ac8cf7e281da69d0a21) into Tornado on July 18 2022 as well as a [100 ETH deposit](https://etherscan.io/tx/0x6c2b0032f65f0306a3bf518623b4f3f8980e7d408f7c58620266c7a728859c7f) on July 30 2022.

loyalist.eth coincidentally [received 100,000 DAI](https://etherscan.io/tx/0x909f6ef4a37ecf433cff34754cf90f9fd63dbbc3550c55fdf819f53383806789) from Tornado on July 20 2022. The 100,000 DAI pool typically doesn’t see much activity and has a small anonymity set.

Four hours after depositing on July 30, loyalist.eth then [receives 100 ETH from Tornado](https://etherscan.io/tx/0x828580125e18096f8345712023b27558717feca193bb50a2d7645c39f551e1cf).

Although this is promising it’s not yet conclusive so let’s continue digging.

### September 2022

On Aug 13 0x572a [funded a new address](https://etherscan.io/tx/0xd32a036b87883440e30d8f8f0af1ba17fb65094e693f08cdc05ef4fe83e05d02) 0xaa18 which went on to steal 446 NFTs from various phishing scams.

EX 1: Twitter user Tutushik5 was [phished for 10 NFTs](https://etherscan.io/tx/0x38a75b0c00c1bfdea8dd7fba7ade29f593b659e7a185c5c99fc7138793994a9b) on Sep 4 by 0xaa18

![](https://storage.googleapis.com/papyrus_images/9f134d4b677db6a1ed9f127a3813295073959007fe1166afcdaed4b09f00c63e.png)

EX 2: Twitter user jfitz69420 was [phished for 4 NFTs](https://etherscan.io/tx/0x15d16471d4439f98165b020514a3467add3eabeee76aa690113edd0deda491ee) on Sep 4 by 0xaa18

![](https://storage.googleapis.com/papyrus_images/1d706fc2fb09b4aa8c976bfe8db1f70f6d590a9d881c8f1ae711e696f9c042e5.png)

EX 3: Twitter user Frank\_theTnk [was phished for 1 X MAYC and 3 X Otherdeed NFTs](https://www.chainabuse.com/report/882a2d99-75bd-4ed7-90b3-2ab1a174082f?context=search-address&a=0xaf5CDD48083f1405923d91c536020C802E02b6A4&chain=ETH) on Sep 5 by 0xaa18 after falling for a Otherside impersonator on Twitter that posted links to a phishing site.

![](https://storage.googleapis.com/papyrus_images/e59b611ec758d408d79aa01770a99a6f331043295909d570fee7314908e097eb.png)

![](https://storage.googleapis.com/papyrus_images/5d2ea78ce04d7636c4c979e7a0601265c4826b28bad3b773d3677c1acb4eed1c.png)

EX 4: Twitter user CryptoKlopp was [phished for 3 X Otherdeed NFT](https://etherscan.io/tx/0xc989eec2d53e8066b83239fb478050e28f82184a9c80788af7c8b7fdf4756e55)s on Sep 5 from the same Otherside phishing scam by 0xaa18.

![](https://storage.googleapis.com/papyrus_images/0d387a7cda9e9b5a0e3c67a099a6605867d996d309c9ac13e2b2d661cefc221d.png)

EX 5: Twitter user ametaversea was [phished for 5 NFTs](https://etherscan.io/tx/0x58b129ebdb7c1fb52b03ebf31a5d44e6b3fac6309ac3414224c5c40bd0936408) on Sep 15 by 0xaa18

![](https://storage.googleapis.com/papyrus_images/a9686069b7784767c41d0ee3ea8ef5da2c11ccd0440278436041fd5a2afb7f2c.png)

0xaa18 consolidated the stolen funds to 0xaf5c and made [2 X 100 ETH](https://etherscan.io/tx/0x496f14d5a483e3ed905d3336ba0f72d307116fbc686007a8fc919ae2e72891ee) and [1 X 10 ETH](https://etherscan.io/tx/0x6019a60fc082719fce3fb3f1fa4820cbe497ed778ea7e43518eaa31600ae37a6) deposits into Tornado beginning September 12 at 10:29 am UTC.

*   Sep 12 at 8:07 pm UTC: [100 ETH was withdrawn](https://etherscan.io/tx/0xa1f4a6e5a81eefa2cd50dd517dd796808d934334e3abb007987e76c08eaadcdf) from Tornado
    
*   Sep 12 at 8:08 pm UTC: [10 ETH was withdrawn](https://etherscan.io/tx/0x7ba43beb762c4c0d1d262368c29340ea9fda65267c843cc8db309eb6fbca0fb3) from Tornado
    
*   Sep 13 at 2:09 pm UTC: [100 ETH was withdrawn](https://etherscan.io/tx/0x132ed6f7e282b8db353b6c35772ba33b22c6cd13a8b36934a87350b1181f1919) from Tornado
    
    All three withdrawals were eventually moved to addresses tied directly to Loyalist once again.
    

![](https://storage.googleapis.com/papyrus_images/de9217e068e637c0efb7dfe1b618291813078f5d0a21f6755fb94d0d2e891a2c.png)

### October 2022

On Sep 15 [0xaa18 funded 0x41cc](https://etherscan.io/tx/0xdca2d1c074c2afaa260724393b7b55cb84c7016fb49419a16ae1afde4eb0c595) before then [funding 0x465 on](https://etherscan.io/tx/0x09a275e7cc7bc64343027df7ff3f8dc768145e2f2f18071c8cfebb14329aecb5) Oct 10. From 0x465, [480 NFTs were stolen](https://etherscan.io/address/0x465f1e668ca098cd9fe7bef3c48eb5aaf3868ad0) from various phishing scams. During this month Loyalist started actively using Monkey Drainer to steal NFTs.

![](https://storage.googleapis.com/papyrus_images/bab9c3b8400336b034d57c343d934cc6d6e3667d51f4d631de11810bd1d4d009.jpg)

EX 1: Twitter user greenmamba\_eth was [phished for 19 NFTs](https://etherscan.io/tx/0xe83a5fdb22c1fa92271f1d5b5c0432e19db561374b50cb0e9313677c89698a61) on Oct 10 by 0x465.

![](https://storage.googleapis.com/papyrus_images/54a97688bff80224a3dab0a60f59dda35362ae039b38256ac90205982119c0ef.png)

EX 2: Twitter user ursthiru was phished for [MAYC, 2 X Meebits, Cool Cats, and 16 other NFTs](https://etherscan.io/tx/0xf0784aafa4114d67c09343d888ffdec0d03b9b661e8624f390ce23fcadbf449d) on Oct 22 by a fake Blur Twitter account.

![](https://storage.googleapis.com/papyrus_images/2fb9123f533963a7c80c12ac16b5e63ce968ef687164ae3e6be03a801dfc9529.png)

EX 3: Twitter user Blainetrain83 was [phished for 17 NFTs](https://etherscan.io/tx/0xc1df46676ac7c4dc153f8d496b1a67078480f24fb5c3370b35c7a7db0251988a) on Oct 22 from the same fake Blur Twitter account by 0x465.

![](https://storage.googleapis.com/papyrus_images/c24dd5757e534cc28b76356ef076da8795c0d413e0d6fab30fd515e75ccf39a1.png)

On Oct 22 funds were consolidated to [0x8fed](https://etherscan.io/address/0x8feda5b5081a9e7d872d0e0f324033ed3a199339) before depositing [2 X 100 ETH to Tornado](http://0xe6b02d2b7bc9d02e4443eff4cd2b8d07b86d380e20e06e864b3379bb740195a0) on Nov 3 2022 at 6:17 am UTC.

*   Nov 4 at 3:13 am UTC: [100 ETH was withdrawn](https://etherscan.io/tx/0x6fb24d9328f4a09038d941d2ecdfd9eb1f127ca6f3c1ed885c2f4af47c224f3f) from Tornado
    
*   Nov 4 at 3:15 am UTC: [100 ETH was withdrawn](https://etherscan.io/tx/0xa16efcdcfb6013aa85d0f8f056602360a48a0175bc855c4f8a764d452929d4de) from Tornado
    

Once again the funds consolidate to to a loyalist address.

We now have seven instances of Tornado deposits and withdrawals tied directly to loyalist matching 1:1.

### November 2022

On Nov 4 2022, [7 X CryptoPunks were phished using Monkey Drainer.](https://www.chainabuse.com/report/c580beb3-1896-4456-8da1-34954de6cb67?context=profile-self&username=ZachXBT) Loyalist used [0x8fed to initially fund the main address](https://etherscan.io/tx/0x053c0405004e4ea949e7c42c23956b75fe33e9ee0af1e58a1b330d5ce384b67a) tied to the phishing scam. It remains unclear what exact role he played in the attack.

### Who is Loyalist

In the Doodles Discord server and on Twitter Loyalist reveals he is from Eastern Europe and even posts pictures of the country.

![](https://storage.googleapis.com/papyrus_images/7d5f99c4e98608b559dc612a4634736dedd39981ba565bf600dc2c8bdac344ea.jpg)

![](https://storage.googleapis.com/papyrus_images/0a92e7b574c127860f93095996aeb473a5d92c6eb596123b1cd5ffc28ab32d5f.jpg)

A reverse image search of the photo that Loyalist shared shows this is Kaunas, Lithuania.

![](https://storage.googleapis.com/papyrus_images/d342531eea1a7f75dc7de97af51583a7a8ec256152bda49ff78bf5b5e565ed58.png)

Loyalist proceeds to show real estate listings on Discord from Lithuania.

![](https://storage.googleapis.com/papyrus_images/8ee0ce9dab67915c11aea7388a3c2ae97a16e3f0b8519362bd7483dbbca31eb9.jpg)

The real estate website in the photo has a Lithuania domain.

In January 2023 it was revealed that [200 million Twitter users](https://www.bleepingcomputer.com/news/security/200-million-twitter-users-email-addresses-allegedly-leaked-online/) had their email addresses and other information leaked online as a result of an API issue from Q4 2021.

Searching the database revealed Loyalist’s personal email account along with the name of Lukas B. This info was also cross-referenced with other publicly available information.

*   Email | Name | Screenname | Followers | Created At
    
*   Email redacted | Loyalist.eth | loyalist | 175 | 2014-12-17
    

The email and other personal information has been redacted for privacy reasons but veracity has been confirmed and will be shared with victims and projects so legal action can be taken.

### Conclusion

Currently the address loyalist.eth has been inactive since Oct 2022 but [$1m DAI is currently held](https://debank.com/profile/0xa13d100e4b5571ee076d30350d7d133ffc304c99) in his alt address 0xa13 which has made transfers in the past two weeks. His primary exchange account has seen $2.9m in total deposits on Ethereum. Based on these number it’s fair to estimate at least $4m has been stolen by Loyalist as a result of running phishing scams and any other illicit activity.

![](https://storage.googleapis.com/papyrus_images/cf3548732904b22cab62a04a199d1d422930ed2edfb61547de0086664bcc8dcd.png)

[In total 1741 NFTs were found to have been stolen by Loyalist and 416 unique victims have been observed](https://www.chainabuse.com/report/cd9466e8-8c78-4ad8-b837-27d8123df957). Here are two graphs visualizing the number of thefts by collections and unique NFT phishing victim accounts per day.

![](https://storage.googleapis.com/papyrus_images/e786a8d2fdc6222546a27db3229133ac31b9a7cb036c2045e7c2c98e3ca60a00.jpg)

This first graph by [bax1337](https://twitter.com/bax1337) shows the number of NFTs phished by collection. Collections with a floor price below 0.1 ETH as of 2-14-23 were omitted.

![](https://storage.googleapis.com/papyrus_images/1d2e885c9591d6d970632812694270d6deddd0d3f4e983fa061b435924a7291c.jpg)

Loyalist’s activity was analyzed over a period of 7 months. This second graph by [bax1337](https://twitter.com/bax1337) shows the number of unique victims phished on each day he was active.

If you believe you were possibly a victim of Loyalist [please search your address here](https://github.com/lithiumfisherman/nft_theft_list/blob/main/theft_transactions.csv).

Hopefully in the near future we will see legal action taken against Loyalist (Lukas) for everyone he has harmed. The recent announcement of a seizure by the US FBI from another phishing scammer is promising and leads to me believe it will liekly be one of many to come.

If you find research like this interesting or perhaps if you were a victim of Loyalist yourself please consider donating to my wallet address. My work is entirely community funded with countless hours going into articles such as this one.

**ENS:**

zachxbt.eth

**For EVM compatible coins:**

0x9D727911B54C455B0071A7B682FcF4Bc444B5596

**Gitcoin:**

[

buidlbox
--------

Ongoing and upcoming hackathons. Every buidlers gateway into the digital frontier.

https://app.buidlbox.io

![](https://storage.googleapis.com/papyrus_images/1634aabd088e024af67b5910da5043e6575c70a49662dbb5ee7ef8334ff684b0.png)

](https://gitcoin.co/grants/5039/zachxbt-crypto-scam-research)

---

*Originally published on [Investigations By ZachXBT](https://paragraph.com/@investigations/loyalist-4m-stolen-from-over-400-victims)*
