Apple

Dubai

<p><strong>Unsuspecting users lost an estimated $1.6 million to a fake cryptocurrency wallet that somehow slipped through Apples strict app review process in February.</strong> <strong>Magazine follows a trail of clues on the blockchain to find out who’s behind the fake wallet.</strong></p>
<p>The fraudulent app, posing as DeBanks Rabby Wallet, remained on the App Store for four days, siphoning funds from multiple victims before Apple removed it.</p>
<p>I never once thought it would be a scam since I had complete faith in the Apple App Store. About 20 to 30 minutes later, I opened my Rabby laptop wallet and saw my balance had basically gone to zero, a fake Rabby wallet victim tells Magazine.&nbsp;</p>
<p>One of the earliest victims to highlight the scam was X user Bthemouth, who reported his funds had been drained to the Rabby Drainer (RD) wallet <a href="https://etherscan.io/address/0x652211aFC6Cc27ba6312724720C804eAD8E0371F" target="_blank" rel="noopener noreferrer nofollow">0x652…0371F</a>.</p>
<figure class="wp-block-image aligncenter size-full is-resized">
 <img width="907" height="548" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/Bthemouth.jpg" alt="X victim report on Konpyl" style="width: 100%;height:auto">
 <figcaption>
  <em>Victims identify Rabby hackers wallet. (<a href="https://x.com/bthemouth/status/1758740973834666236" target="_blank" rel="noopener noreferrer nofollow">Bthemouth</a>)</em>
 </figcaption>
</figure>
<p>Blockchain analysis ties the RD wallet to <a href="https://etherscan.io/address/0x44BdB19dB1Cd29D546597AF7dc0549e7f6F9E480" target="_blank" rel="noopener noreferrer nofollow">0x44Bd9E480</a>, which was initially labeled Konpyl on the <a href="https://opensea.io/Pehuzlgo" target="_blank" rel="noopener noreferrer nofollow">NFT marketplace OpenSea</a>. While the account name has since been changed, its original label can still be verified at <a href="https://platform.arkhamintelligence.com/explorer/address/0x44BdB19dB1Cd29D546597AF7dc0549e7f6F9E480" target="_blank" rel="noopener noreferrer nofollow">Arkham Intelligence</a>, a blockchain data platform that tracks OpenSea accounts, among others.</p>
<p>A private investigator, who Magazine has confirmed is collaborating on the case with the authorities, claims that his investigation connects “Konpyl” to a larger web of at least 20 cases, and Magazine has independently confirmed links to seven of those.</p>
<p>The common denominator between this mountain of scams is the Konpyl address.</p>
<p>Hes been doing this for about seven years, [and] he goes after users who put their life savings in some of this stuff, not like the big protocols, the investigator tells Magazine.</p>
<figure class="wp-block-image aligncenter size-full is-resized">
 <img width="955" height="657" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/Konpyl-account-displayed-on-OpenSea.jpg" alt="Konpyl account displayed on OpenSea" style="width: 100%;height:auto">
 <figcaption>
  <em>Konpyl holds around $3 million in crypto assets as of Oct. 4. (Arkham Intelligence)</em>
 </figcaption>
</figure>
<p>The investigator shared images of Know Your Customer (KYC) records with Magazine, which were allegedly submitted to numerous exchanges by addresses linked to the scams.</p>
<p>The documents seen by Magazine are linked to Konstantin Pylinskiy, the CEO of Dubai-based investment firm Moonward Capital, who uses X and Telegram handles @konpyl. However, several fake KYC credentials and aliases were also used to open accounts, so Magazine is not suggesting Pylinskiy is Konpyl just that the name is linked to the accounts.&nbsp;</p>
<p>Initially, Konpyl greeted Magazine on Telegram with How can I help you? But when asked to clarify the connection between Konstantin Pylinskiy, the Konpyl online persona, and the Rabby wallet scam, he stopped responding.</p>
<p>Magazine has attempted to contact Pylinskiy through alternative channels, but he did not respond.</p>
<div class="container">
 <a href="https://servedbyadbutler.com/go2/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank" rel="noopener noreferrer nofollow"><img src="https://servedbyadbutler.com/adserve/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img" alt="Fake Rabby Wallet scam linked to Dubai crypto CEO and many more victims"></a>
</div>
<div class="container">
 <a href="https://servedbyadbutler.com/go2/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank" rel="noopener noreferrer nofollow"><img src="https://servedbyadbutler.com/adserve/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img" alt="Fake Rabby Wallet scam linked to Dubai crypto CEO and many more victims"></a>
</div>
<p>Moonward Capital also did not respond to Magazines request to comment on this story.</p>
<p>Magazine has confirmed with a United States government agency that an ongoing investigation is linked to the Konpyl address.</p>
<p>The <a href="https://etherscan.io/tx/0xf4c688c3672079acab9761da3e6264161fcf5f5ee4f4eabfab9e5499296f981a" target="_blank" rel="noopener noreferrer nofollow">latest inbound transaction</a> to the Konpyl wallet is from an address flagged with a Fake_Phishing label on <a href="https://etherscan.io/address/0x4e937e67fb3ce0b57d411a013849f97c990c71c2" target="_blank" rel="noopener noreferrer nofollow">Etherscan</a>. Its <a href="https://etherscan.io/address/0x4e937e67fb3ce0b57d411a013849f97c990c71c2" target="_blank" rel="noopener noreferrer nofollow">interaction with Konpyl</a> is the sole outbound transaction.</p>
<h2 class="wp-block-heading" id="strong-the-fake-rabby-wallet-konpyl-connection-strong"><strong>The fake Rabby Wallet-Konpyl connection</strong></h2>
<p>He had a drain bot in my account, Bthemouth tells Magazine, referring to an automated script designed to siphon funds. Even after all these months, its still active.</p>
<p>The Rabby Drainer actor takes multiple steps to conceal its tracks, such as splitting criminal proceeds into multiple wallets and using DeFi services to obscure evidence and blend into the crowd.</p>
<figure class="wp-block-image aligncenter size-large is-resized">
 <img width="1024" height="850" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/Konpyl-Rabby-funds-01-1024x850.jpg" alt="Konpyl Rabby funds-01" style="width: 100%;height:auto">
</figure>
<p>The scammer then frequently consolidates large amounts of funds into subsequent wallets to deposit in centralized exchanges. Even after such obfuscation efforts, there are connections between RD and Konpyl.</p>
<p>Bthemouths drained funds went to Rhino, a multichain bridge that the Rabby wallet scammer frequents. The scammer deposited tokens into Rhino and withdrew them through another wallet.</p>
<p>Between February 15 and 18, RD drained several more victims, with most of the proceeds in ERC-20 tokens. On February 19, these tokens were converted to 52 ETH (approximately $151,000 at the time) using DeFi services like Uniswap and 1inch.</p>
<p>Later that day, the funds traveled to wallet <a href="https://etherscan.io/address/0xCE6A02438d6AB2504A4bE10DDC435a154A9b2Ac5" target="_blank" rel="noopener noreferrer nofollow">0xCE6A…b2Ac5</a>, which, along with Bthemouths money and <a href="https://etherscan.io/tx/0x9390d092276f9af21fb01ed6697a9eeb78b2115c621c21996b6b7f41321fe2a0" target="_blank" rel="noopener noreferrer nofollow">an additional 7 ETH</a>, transferred roughly $173,000 in Ether <a href="https://etherscan.io/tx/0xeefb57934a772d054344a84634bc218f977f29a3ce85365901e1493a96879746" target="_blank" rel="noopener noreferrer nofollow">to Rhino</a>.</p>
<figure class="wp-block-image aligncenter size-large">
 <img width="1024" height="134" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/Victim-funds-from-RD-head-to-Rhino-1024x134.jpg" alt="Victim funds from RD head to Rhino">
 <figcaption>
  <em>Rabby scammer using Rhino to launder funds. (Etherscan) </em>
 </figcaption>
</figure>
<p>Onchain detectives <a href="https://x.com/tayvano_/status/1760368747687419984" target="_blank" rel="noopener noreferrer nofollow">Tay and SomaXBT</a> identified wallet <a href="https://etherscan.io/address/0x4E9395cc1075b57016BF8b5bF8782BFEF94c71C2" target="_blank" rel="noopener noreferrer nofollow">0x4E93…c71C2</a> as the Rhino output recipient. It acquired $173,388 in USDT in three transactions, with the first batch arriving around 10 minutes following the initial deposit.</p>
<p>Blockchain records show that the same Rhino output wallet received nearly $100,000 from Konpyl over six monthly transactions between February and July.</p>
<figure class="wp-block-image aligncenter size-full is-resized">
 <img width="917" height="362" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/Konpyl-transactions-to-Rabby-Output-Bridge.jpg" alt="Konpyl transactions to Rabby Output Bridge" style="width: 100%;height:auto">
 <figcaption>
  <em>Konpyls direct interactions with the Rhino output wallet. (Arkham Intelligence)</em>
 </figcaption>
</figure>
<p>These funds eventually make their way to OKX.</p>
<p>The scammer appears to use several exchanges, typically employing more than one deposit address per exchange.</p>
<p>When analyzing wallets suspected of association with hacks, their first inbound transactions often leave important clues to associated wallets. Sometimes, they can show who funded the wallets gas fees.</p>
<p>But this is not a characteristic of Konpyl-related scams.</p>
<p>[Konpyl] funds these accounts with victims wallets, says the private investigator.</p>
<p>Hell take from other hacks to fund these hacker wallets, so you have no idea that its him.</p>
<div class="article-suggest">
 <div class="article-suggest__title display3">
  Read also
 </div>
 <div class="article-suggest__items">
  <div class="article-suggest__item">
   <a href="https://cointelegraph.com/magazine/daft-punk-meets-cryptopunks-as-novo-faces-up-to-nfts/" rel="noopener noreferrer nofollow"> <span>Features</span> <p>Daft Punk meets CryptoPunks as Novo faces up to NFTs</p> </a>
  </div>
  <div class="article-suggest__item">
   <a href="https://cointelegraph.com/magazine/crypto-regulation-sec-chair-gary-gensler-final-say/" rel="noopener noreferrer nofollow"> <span>Features</span> <p>Crypto regulation: Does SEC Chair Gary Gensler have the final say?</p> </a>
  </div>
 </div>
</div>
<h2 class="wp-block-heading" id="strong-rabby-wallet-drainers-total-damage-strong"><strong>Rabby Wallet drainers total damage</strong></h2>
<p>Including RD, which drained an estimated $152,257 from victims, there are at least 10 addresses identified by public victim reports. These addresses are responsible for over $1 million in losses after users downloaded Februarys fake Rabby wallet from the App Store.</p>
<p>The February incident wasnt the first time a fake Rabby wallet appeared on the App Store. Another iteration of the scam used at least two other Konpyl-linked wallets to drain approximately $93,000 from victims in late 2023.</p>
<p>Magazine has confirmed that the older Rabby wallet scam is connected to Konpyl, with fund trails pointing to the <a href="https://etherscan.io/tx/0x974524ffcf1d630f4a3c2299b05919561893ab0b604d9bf79cc2df30a1cd4c7e" target="_blank" rel="noopener noreferrer nofollow">same Rhino output address</a> used in Bthemouths case.</p>
<figure class="wp-block-image aligncenter size-large is-resized">
 <img width="1024" height="429" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/Konpyl-connected-wallet-to-Rhino-bridge-1024x429.jpg" alt="Konpyl connected wallet to Rhino bridge" style="width: 100%;height:auto">
 <figcaption>
  <em>Sample transaction ties Konpyl to older scam cases as proceeds from both cases are funneled to the Rhino output address. (Etherscan)</em>
 </figcaption>
</figure>
<p>The private investigator tells Magazine that three other suspicious wallets, suspected of being connected to the Rabby wallet scheme, drained $278,872, though these cases werent publicly reported by victims.</p>
<p>In addition, Magazine is aware of at least three more wallets that werent part of the Rabby fake wallet scheme but stole funds using other tactics, such as phishing links shared on social media. This trio of wallets also displays connections to Konpyl by using a common OKX deposit address as the Rabby wallet scammer and transferring funds to the Rhino output wallet.</p>
<p>Together, they drained $93,261 from victims, bringing the estimated loss connected to the Rabby fake wallet saga to at least $1.6 million.</p>
<div class="article-suggest">
 <div class="article-suggest__title display3">
  Read also
 </div>
 <div class="article-suggest__items">
  <div class="article-suggest__item">
   <a href="https://cointelegraph.com/magazine/fake-employees-social-attacks-crypto-recruiting-minefield/" rel="noopener noreferrer nofollow"> <span>Features</span> <p>Fake employees and social attacks: Crypto recruiting is a minefield</p> </a>
  </div>
  <div class="article-suggest__item">
   <a href="https://cointelegraph.com/magazine/crypto-home-loan-bitcoin-mortgage-risky/" rel="noopener noreferrer nofollow"> <span>Features</span> <p>Home loans using crypto as collateral: Do the risks outweigh the reward?</p> </a>
  </div>
 </div>
</div>
<h2 class="wp-block-heading" id="other-scams-linked-to-the-fake-rabby-wallet">Other scams linked to the fake Rabby Wallet</h2>
<p>The 2024 Rabby wallet scam is not the first illicit activity with strong blockchain ties to the Konpyl address, blockchain records identified by the private investigator show.</p>
<p>For example, a <a href="https://www.reddit.com/r/ledgerwallet/comments/hv6aou/all_funds_stolen_from_ledger_live/" target="_blank" rel="noopener noreferrer nofollow">victim report on Reddit</a> states that a users funds were drained by wallet <a href="https://etherscan.io/address/0x0000000937e390bd7753b2b30a1b2d96154e9aba" target="_blank" rel="noopener noreferrer nofollow">0x00004e9Aba</a> (which we refer to as LS1 for Ledger Scam). A closer look at LS1 reveals similar deposit strategies to those used in the 2024 Rabby fake wallet schemes.</p>
<figure class="wp-block-image aligncenter size-large">
 <img width="1024" height="919" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/Konpyl-Ledger-fund-movement-01-1024x919.jpg" alt="Konpyl Ledger fund movement-01">
</figure>
<p>In 2020, LS1 used deposit address <a href="https://etherscan.io/address/0x05a8fC18C8150cBD6cEc07621dE2aA7c426a21e6" target="_blank" rel="noopener noreferrer nofollow">0x05a8a21e6</a> (YB1) to move funds into the cryptocurrency exchange Yobit.&nbsp;</p>
<p>LS1 frequently interacts with <a href="https://etherscan.io/address/0x1111111bAeD9942134B1D3Ae62e9A67d049858eB" target="_blank" rel="noopener noreferrer nofollow">0x1111858eB</a> (LS2), sending and receiving over $51,000 of crypto with each other over 14 transactions for a year starting from April 2020.</p>
<figure class="wp-block-image aligncenter size-full">
 <img width="902" height="710" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/LS1-and-LS2-relationship.jpg" alt="LS1 and LS2 relationship">
 <figcaption>
  <em>Fund movements between Ls1 and LS2. (Arkham Intelligence)</em>
 </figcaption>
</figure>
<p>The two wallets appear to use different deposit addresses on Yobit, as LS2 favors <a href="https://etherscan.io/address/0x7e179E3DDF5e1f15bFAe4F10715Fda703d3873cE" target="_blank" rel="noopener noreferrer nofollow">0x7e17873cE</a> (YB2).</p>
<p>YB2 was regularly used by Konpyl at that time to move funds to Yobit. Konpyl sent over $41,000 of ETH across 23 transactions from September 2020 to February 2021.</p>
<figure class="wp-block-image aligncenter size-full">
 <img width="892" height="337" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/10/Konpyl-to-YB2.jpg" alt="Konpyl to YB2">
 <figcaption>
  <em>Konpyls deposits to YB2. (Arkham Intelligence)</em>
 </figcaption>
</figure>
<p>YB1 and YB2 are further connected by <a href="https://etherscan.io/address/0xBd7D80D065508dd8509DE550203211d6C28A2DB7" target="_blank" rel="noopener noreferrer nofollow">0xBd7D…A2DB7</a>. It uses the second deposit address five times for $196,000 in ETH while logging a 2.4-ETH transaction to YB1.</p>
<p>This wallet also has two direct transactions from Konpyl for 6 ETH.</p>
<div class="article-suggest">
 <div class="article-suggest__title display3">
  Read also
 </div>
 <div class="article-suggest__items">
  <div class="article-suggest__item">
   <a href="https://cointelegraph.com/magazine/animism-japanese-characters-nft-blockchain/" rel="noopener noreferrer nofollow"> <span>Features</span> <p>Why Animism Gives Japanese Characters a NiFTy Head Start on the Blockchain</p> </a>
  </div>
  <div class="article-suggest__item">
   <a href="https://cointelegraph.com/magazine/defi-wrong-not-market-synthetix-founders-plan-to-fix-it/" rel="noopener noreferrer nofollow"> <span>Features</span> <p>Synthetix founder Kain Warwick: Its DeFi thats wrong, not the market</p> </a>
  </div>
 </div>
</div>
<h2 class="wp-block-heading" id="investigation-into-fake-rabby-wallet-and-other-scams-continues">Investigation into fake Rabby Wallet and other scams continues</h2>
<p>One of my goals is for Apple to get off their ass and go after scammers on their App Store. I reported to Apple months ago but never heard back, the investigator tells Magazine.</p>
<p>Rival tech giant Google previously set a precedent of responding to such fraud schemes earlier this year when it sued a group of alleged crypto scammers for defrauding more than 100,000 people by uploading <a href="https://cointelegraph.com/magazine/google-sues-crypto-app-scammers-crypto-com-korea-asia-express/" target="_blank" rel="noopener noreferrer nofollow">dodgy apps on its marketplace Google Play</a>.</p>
<p>Bthemouth has given up on recovery efforts and says hes already done everything that he can.</p>
<p>A victims group was formed early on, but by now, everyone went on with their lives.</p>
<p>Its a dead end, Bthemouth says.</p>
<p>But there is still some hope for victims.&nbsp;</p>
<p>Investigations by law enforcement agencies and private blockchain detectives are ongoing, with Konpyl and associated wallets remaining at the center of suspicion.</p>
<div class="subscribe subscribe--inner">
 <div class="container">
  <div class="subscribe__inner">
   <div class="subscribe__content">
    <div class="subscribe__title display2">
     Subscribe
    </div>
    <div class="subscribe__desc text-l">
     The most engaging reads in blockchain. Delivered once a week.
    </div>
    <div class="wpcf7 no-js" id="wpcf7-f13672-o1">
     <div class="screen-reader-response">
      <p></p>
      <ul></ul>
     </div>
     <div style="display: none;">
     </div>
     <p>Email address</p>
     <p>SUBSCRIBE</p>
     <div class="wpcf7-response-output"></div>
    </div>
   </div>
   <div class="subscribe__img">
    <img src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2022/10/reading-copy.png" alt="Subscribe to Magazine by Cointelegraph Newsletter.">
   </div>
  </div>
 </div>
</div>

Fake Rabby Wallet scam linked to Dubai crypto CEO and many more victims

Table of Contents

Cointelegraph

Other articles published on Oct 16, 2024

Join our free newsletter for daily crypto updates!