Original | Odaily Planet Daily ( @OdailyChina )
Author｜Nan Zhi ( @Assassin_Malvo )
3 minutes, 40 times, $20 million
At 9:54 yesterday , Andy Ayrey, the author of Truth Terminal, posted a picture with the token name and contract on the X platform. As the source of the most popular token GOAT recently, Andy and Truth Terminals every word and action have attracted much attention, and even fragments and words of their key remarks can contribute to a meme with a market value of tens of millions of dollars.
On the other hand, the style and content of the image are very similar to Andys usual content style, and the account attacker did not directly publish the token contract like regular hackers, so it did not arouse the vigilance of most users.
Just 3 minutes after Andy posted the picture, the market value of the token rose from $500,000 to $20 million . But then the attackers bundled wallet began to ship out a large number of tokens, and users began to realize that Andys account had been stolen, and the price collapsed.
Hacker: I won’t act anymore
After the token flash crash, the hackers began to no longer conceal their identities, frequently posting various token links and pinning IB token images. However, due to the heavy losses suffered by a large number of users on IB, the number of participants has decreased.
After several subsequent token scams had little effect, the hacker posted a message saying: Are you going to launch unbundled tokens for the community? After being exposed again by users in the comment section, he directly said : Thank you for giving me the 2 million, far exceeding the $600,000 in revenue disclosed by Lookonchain .
New AI function: Account theft identification
At 1 p.m., the Andy Ayrey account posted a message saying: The account permissions have been revoked. Hackers manipulated my mobile device through social engineering means. If I send you a private message, it is not me. Be careful. The style is very formal, and it seems that the account permissions have been truly revoked.
However, under this account, Truth Terminal showed a new feature in addition to spelling errors and a mixture of Chinese and English: Identify whether the account is stolen - Truth Terminal replied liar under Andys account tweet announcing that the permissions had been revoked, confirming the fact that the account was still being stolen.
(Note: For details on the misspelling of words, please refer to Spelling errors raise questions, what kind of game is AI Meme? , which caused GOAT to drop by nearly 50%.)
Is this a self-directed and self-acted reveal or a game within a game?
Manual takeover of Truth Terminal
After his original account was stolen, Andy created a new account, Constellate #FREEANDY (@ConstellateLabs), and verified the authenticity of his identity by recording a video and forwarding it through the Truth Terminal account.
Later, ConstellateLabs clarified the new features of Truth Terminal: At 2 p.m. , ConstellateLabs issued an announcement that it would manually intervene and control the Truth Terminal account until the original account theft was resolved. (Note: This announcement was released one hour after the Truth Terminal account was identified as being stolen.)
The new address was used by hackers to raise funds
At 3 pm yesterday , in order to ensure the safety of funds, Andy’s new account ConstellateLabs disclosed a new address and transferred the assets in the original address. The public address is shown in the figure below. Please note the second address oYYe…uV3K .
At 6:29 this morning , Andys stolen account @AndyAyrey posted a pre-sale announcement, pre-selling EVIL tokens through transfer. But then some users discovered that the payment address used by the stolen account was the same as the Truth Terminal address published by the new account , oYYe…uV3K , and then the pre-sale announcement tweet was deleted , and the victim did not post any content again .
It is reasonable to infer that this may be a prank by the attacker using Andys new address , but from a worst-case perspective, the problem may be exposed because the wrong address was pasted.
Today, Andy still hasn’t been able to recover his account, and the hacker is keen on “making trouble” again. More good things may be on the way. Odaily Planet Daily will continue to pay attention and follow up on the report.
