# Scavenging: Don’t be too kind By [Officer's Blog](https://paragraph.com/@officercia) · 2022-07-16 --- **Today I want to remind you about an old scam implementation which is called a _scavenging_. Just remember as a golden rule — the 12-word or private key scam is a pretty common one on TG and if anyone giving you their private key/seed — he is scamming you!** **❗️ Please report scam here:** * [chainabuse.com](https://www.chainabuse.com) * [cryptoscamdb.org](https://cryptoscamdb.org) [ 12-word-scam-examples! ---------------------- Be aware and never use these words! Read officercia.medium.com/scavenging-dont-be-too-kind-56a9bd8... https://www.flickr.com/ ![](https://storage.googleapis.com/papyrus_images/b417146358a290bf97f40247f8a249d0590fb3f045530e55538c72a6a46ee1c4.jpg) ](https://flic.kr/s/aHBqjzYfh4) **Any funds you transfer in to facilitate the swap will be immediately drained via contract before you can make a tx with it! Do not try to withdraw funds on those wallets!** [![User Avatar](https://storage.googleapis.com/papyrus_images/bd2b258b7ba1566373dc378644b18ddfc338c1c4fef4b6f272d1d8dbbd29f79b.jpg)](https://twitter.com/zellic_io) [Zellic](https://twitter.com/zellic_io) [@zellic\_io](https://twitter.com/zellic_io) [![Twitter Logo](https://paragraph.com/editor/twitter/logo.png)](https://twitter.com/zellic_io/status/1552041592617328643) 1/ First, the attacker shares a private key or mnemonic. Either by: a) asking for help in Twitter DMs b) pretending to be naïve & leaking it in a Telegram chat. To dig deeper, [![Like Icon](https://paragraph.com/editor/twitter/heart.png) 6](https://twitter.com/zellic_io/status/1552041592617328643)[ 4:22 PM • Jul 26, 2022 ](https://twitter.com/zellic_io/status/1552041592617328643) **Usually such attacks happen on side-chains (majority on BSC) and blockchains with poor MEV, so using whitehat.flashbots.net or private pool won’t help. If they target specific project they use its governance tokens, if no then just use blacklisted USDT ETH Mainnet addresses or just honeypot tokens.** [![User Avatar](https://storage.googleapis.com/papyrus_images/fdfa52e2ac77f89c4dfd5e58f6d2cb216f1827021498dabcf9b647a2221a6205.jpg)](https://twitter.com/TalBeerySec) [Tal Be'ery](https://twitter.com/TalBeerySec) [@TalBeerySec](https://twitter.com/TalBeerySec) [![Twitter Logo](https://paragraph.com/editor/twitter/logo.png)](https://twitter.com/TalBeerySec/status/1551851807697244162) 1/ The answer was more advanced than I thought! thanks [@amanusk\_](https://twitter.com/amanusk_) Apparently, in [#TronNetwork](https://twitter.com/hashtag/TronNetwork) you can set the spending permission to be of another address! Therefore, the attackers do not risk anything by disclosing the private seed of the address. See: [tronscan.org/#/address/TRFq…](https://t.co/sb2HeW1MgR) ![](https://storage.googleapis.com/papyrus_images/ba77f7fdadfaafa44c1ddfe8047becfc1ce829e29964edfb18e59aa93d427bcd.jpg) [![User Avatar](https://storage.googleapis.com/papyrus_images/fdfa52e2ac77f89c4dfd5e58f6d2cb216f1827021498dabcf9b647a2221a6205.jpg)](https://twitter.com/TalBeerySec) [Tal Be'ery](https://twitter.com/TalBeerySec) [@TalBeerySec](https://twitter.com/TalBeerySec) [![Twitter Logo](https://paragraph.com/editor/twitter/logo.png)](https://twitter.com/TalBeerySec/status/1546907463580110851) Advanced question ![🧠](https://abs-0.twimg.com/emoji/v2/72x72/1f9e0.png)![🤔](https://abs-0.twimg.com/emoji/v2/72x72/1f914.png): why is the scam in [#TRON](https://twitter.com/hashtag/TRON) and not in [#Ethereum](https://twitter.com/hashtag/Ethereum) ? CC: [@amanusk\_](https://twitter.com/amanusk_) [![Like Icon](https://paragraph.com/editor/twitter/heart.png) 12](https://twitter.com/TalBeerySec/status/1551851807697244162)[ 3:47 AM • Jul 26, 2022 ](https://twitter.com/TalBeerySec/status/1551851807697244162) **In past, when these scammers existed mostly on ETH main-net (without using frozen USDT) and when MEV was not as popular as it is now, researchers made several successful attempts of beating them, let’s take a look:** * [**blog.mycrypto.com/how-to-beat-an-ethereum-based-sweeper-and-recover-your-assets**](https://blog.mycrypto.com/how-to-beat-an-ethereum-based-sweeper-and-recover-your-assets) * [**consensys.net/blog/metamask/spoofing-sweepers-and-clipboard-hacks-how-to-stay-safe-from-scams/**](https://consensys.net/blog/metamask/spoofing-sweepers-and-clipboard-hacks-how-to-stay-safe-from-scams/) **In short, it targets human greed. There was also this type of attack mixed with more** [**brutal**](https://twitter.com/officer_cia/status/1540597041138638848) **social engineering which targets human anger. The scammer will withdraw assets you sent for funding a gas for transaction and his _honeypot will stay untouched._** **You will loose 10-30$, not too much, but one of the** [**wallets**](https://etherscan.io/address/0x6dddddfe4147d1e246d22c65c55fdfcb0e9ea6b5) **(**[**2nd wallet**](https://etherscan.io/address/0x39C81cc102c71cC05915D572b0C8DDc228F59898)**) receiving those scammed ethers is doing quite well.** [**Another wallet — here**](https://etherscan.io/address/0x00a329c0648769A73afAc7F9381E08FB43dBEA72)**, one of the oldest scammers. Still active.** [ Vladimir S. | Officer's Channel ------------------------------- Watch out fam, looks like there is a scammer who is giving away his seed phrase... That's what he sent me: \* telegra.ph/Scam-Example-02-15 Read more about this scam: \* officercia.mirror.xyz/bO8lYsvxvbdAQI9ArmMDno0rTW8-pE1Fe91NAUuBiVM There's an extra sneaky variant of this attack in Tron: \* twitter.com/TalBeerySec/status/1551851807697244162 Stay safe! https://t.me ![](https://storage.googleapis.com/papyrus_images/0098819851397d29aad7969b7f74e2b8e4bfd5f1a9e6d662d72dc865f506474d.jpg) ](https://t.me/officer_cia/917) **Stay safe! Now you know what to show to the next “coinbase or metamask support” message you randomly get from a scammer-impersonator asking for your seed phase 🙂** Support is **very** important to me, with it I can spend less time at work and do what I love — educating DeFi & Crypto users * [Check out my GitHub](https://github.com/OffcierCia/) * [Follow my Twitter](https://twitter.com/officer_cia) * [Track all my activities](https://start.me/p/QRg5ad/officercia) * [All my Socials](https://linktr.ee/officercia) * [Join my TG channel](https://t.me/officer_cia) If you want to support my work, you can send me a donation to the address: * [**0xB25C5E8fA1E53eEb9bE3421C59F6A66B786ED77A**](https://etherscan.io/address/0xB25C5E8fA1E53eEb9bE3421C59F6A66B786ED77A) or [officercia.eth](https://etherscan.io/enslookup-search?search=officercia.eth) — ETH, BSC, Polygon, Optimism, Zk, Fantom, etc * [**17Ydx9m7vrhnx4XjZPuGPMqrhw3sDviNTU**](https://blockchair.com/bitcoin/address/17Ydx9m7vrhnx4XjZPuGPMqrhw3sDviNTU) — BTC * **4AhpUrDtfVSWZMJcRMJkZoPwDSdVG6puYBE3ajQABQo6T533cVvx5vJRc5fX7sktJe67mXu1CcDmr7orn1CrGrqsT3ptfds — Monero XMR** ### Thank you! ❤️ --- *Originally published on [Officer's Blog](https://paragraph.com/@officercia/scavenging-don-t-be-too-kind)*