yadirap12
Debugging Automation Strategist
LEVEL 1
400 XP
Discord is a popular communication platform for many online communities, including cryptocurrency and NFT projects. However, some malicious individuals exploit vulnerabilities, such as hijacking Discord handles of inactive or "dead" projects, to scam people through social engineering and phishing. This guide aims to describe how such an exploit works and teach you how to do it yourself.
Step-by-Step Breakdown of Discord Hijack Draining
Targeting Dead Projects
Step-by-Step Breakdown of Discord Hijack Draining
Targeting Dead Projects
- Finding a Discord Handle: First, you would visit platforms such as OpenSea.io, which list various crypto and NFT projects. Many of these projects are tied to Discord servers for communication and community engagement.
- Identifying Dead Projects: Look for projects that have become inactive or abandoned. These “dead” projects typically have Discord handles that are no longer actively maintained by their creators.
- Setting Up a New Discord Server: Once you identify an inactive Discord server, you create a new Discord server using the same or a similar name to the original dead project.
- Boosting to Level 3: To make the fake server appear legitimate, you would need to boost the server to Level 3 on Discord. Boosting allows you to claim a custom invite link, enabling you to make the URL look authentic (e.g. discord.com/invite/{project_name} ).
- Creating a Fake Verification Process: After setting up the fake Discord server, the next step involves adding a malicious link disguised as a verification process.
- Fake Collab.Land Site: Collab.Land is a popular tool in crypto communities used for verifying ownership of digital assets. You need to create a fake site mimicking Collab.Land and attach a drainer.
- Server Setup: In the newly created server, you will lock down most channels and create a dedicated channel titled something like "Verification." The channel will instruct users to verify their wallets to access the server’s content or perks.
- Adding the Phishing Link: A button or link labeled as "Verify" will be placed in the channel, which directs users to the fake Collab.Land site. Once they attempt to connect their crypto wallet for verification, the drainer steals their funds.
- Social Engineering (SE): To attract victims, you can employ social engineering tactics like pretending to be an admin or trusted figure from the original project, reaching out to community members through direct messages or other channels.
- Spamming: Alternatively, you might spam messages across related Discord servers, email spams, Reddit communities, or other crypto/NFT forums, advertising your fake Discord invite.
- Passive Exploitation: You could also choose to leave the fake server running, letting it catch victims who randomly discover the Discord link over time.
- Leaving the Server Active: Once the scam is set up, the server could remain active, waiting for victims to stumble upon it or through organic discovery. Each time someone tries to "verify" their wallet, they will unknowingly lose assets to the drainer.
- Obtaining a Drainer: You can get your drainer at auradrainer.app or use other strong drainers.