{"investigation":{"slug":"vitalik-buterin","entity_name":"Vitalik Buterin","trust_score":25,"severity_base":null,"score_modifier":-10,"confidence":1,"status":"published","content_type":"investigation","summary":"Vitalik Buterin is the legitimate co-founder of Ethereum and is not himself a scam actor. However, his name, likeness, and social media presence constitute one of the most heavily weaponized impersonation surfaces in crypto. Documented threats include a September 2023 SIM-swap of his X account (linked to Pink Drainer, resulting in ~$691K stolen from followers), persistent fake giveaway livestreams on YouTube, thousands of fraudulent Instagram accounts, and an escalating campaign of AI-generated deepfake videos distributing wallet-drainer phishing links.","sections":[{"content":"On September 9, 2023, an attacker SIM-swapped Buterin's T-Mobile number, gaining the ability to reset his X (Twitter) account password even though the phone number was not configured as a 2FA method. The compromised account, which had approximately 4.9 million followers, posted a link advertising free 'commemorative NFTs' celebrating Ethereum's Proto-Danksharding upgrade, in an alleged partnership with Consensys. Users who connected their wallets to the phishing site had their assets drained. On-chain investigator ZachXBT tracked losses in real time, reporting approximately $691,000 stolen — including CryptoPunk #3983 (last valued at approximately $244,000). The attack wallet was flagged on Etherscan as interacting with a Pink Drainer wallet, linking the theft to the Pink Drainer phishing kit, which at the time had been attributed to over $18 million stolen from more than 9,000 victims across multiple platforms. Buterin subsequently confirmed the SIM-swap vector and recommended that users remove phone numbers from their X account settings entirely, noting that X's account recovery system can be exploited via phone number even absent explicit 2FA enrollment.","heading":"2023 X (Twitter) Account SIM-Swap and Phishing Attack","sources":[],"severity":"medium"},{"content":"A persistent and long-running threat uses real footage of Vitalik Buterin — sourced from conference talks and public appearances — to run fraudulent cryptocurrency giveaway livestreams on YouTube. Between February 16 and 18, 2022, cybersecurity firm Group-IB documented 36 such fabricated livestreams, attracting more than 165,000 combined viewers. Wallets controlled by the scammers received over $1.6 million in 281 transactions during that window alone. The channels hosting the streams typically bore names associated with the speaker in the rogue footage and were either compromised legitimate accounts or purchased on underground markets. Visitors to associated phishing websites were prompted to enter seed phrases to 'connect' their wallets; sharing a seed phrase gave attackers full wallet control. The same technique has been employed by a group tracked as 'CryptoCore,' which also exploited footage of Elon Musk, Michael Saylor, and Larry Fink. CoinDesk reported that crypto giveaway scams of this type were already widespread on YouTube by 2020, indicating a multi-year persistent threat. In Q2 2024, Gen Digital reported that $5 million in crypto was lost to AI-assisted deepfake scam campaigns that frequently featured Buterin alongside other prominent figures.","heading":"Fake Giveaway Scams on YouTube","sources":[],"severity":"medium"},{"content":"Vitalik Buterin has publicly stated that he maintains no official Instagram account. Despite this, thousands of fraudulent accounts bearing his name and likeness have operated on the platform. A documented 2018 incident involved a fake account (@buterin_vitalik) with over 24,000 followers that ran a 'Special Event for Instagram Community' giveaway, collecting 37.491 ETH from seven victims who were promised a 100 percent return on sent funds via a Telegram bot; no funds were returned. By January 2022, an impersonation account using the handle @vitalik.eth had amassed over 570,000 followers and was running paid sponsored advertisements directing users to staking scams. In August 2022, Buterin issued a public warning via his verified Twitter account stating: 'All 5000+ of my Instagram accounts are fake profiles and have nothing to do with me. Anything you see Vitalik Buterin posting on Instagram is a scam.' The scale of the ongoing Instagram impersonation ecosystem renders it a persistent and documented threat surface for anyone interacting with accounts claiming to be Buterin on that platform.","heading":"Instagram Impersonation Accounts","sources":[],"severity":"medium"},{"content":"Beginning in late 2023 and accelerating through 2024 and 2025, scammers have deployed AI-generated deepfake videos of Vitalik Buterin to promote wallet-drainer phishing sites and fraudulent investment schemes. On February 7, 2024, blockchain security firm CertiK disclosed a synthetic video falsely depicting Buterin endorsing a wallet-draining phishing scheme. A separate deepfake campaign in late 2023 featured Buterin allegedly promoting a fraudulent meme token. The CryptoCore threat group, identified by Gen Digital, employs face-swap software and AI voice cloning to produce videos of Buterin and other prominent figures appearing to endorse exclusive crypto events or investment opportunities; these are distributed across X, YouTube, and TikTok. Gen Digital's Q2 2024 report attributed $5 million in losses to deepfake-driven crypto scam operations in a single quarter. Reports from 2025 indicate that AI-generated impersonation videos of celebrities surged 500 percent year-on-year, with Buterin remaining among the most frequently targeted subjects. Buterin himself has publicly highlighted the threat of AI deepfakes to identity verification in the crypto space.","heading":"AI Deepfake Video Campaigns","sources":[],"severity":"medium"},{"content":"A sustained pattern involves scammers using hijacked or purchased verified Twitter accounts — or fake accounts mimicking Buterin's handle — to post scam replies under legitimate Buterin tweets, directing followers to phishing sites. In 2022, an attacker compromised the verified Twitter account of journalist Aaron Goldfarb, redesigned it to impersonate Buterin, and launched phishing campaigns targeting followers. The scam format typically promises a limited-time ETH giveaway, sending recipients to websites that request wallet connections. ZachXBT tracked several iterations of this pattern and reported on the broader SIM-swap campaign context, noting that in the period preceding the September 2023 Buterin hack, 54 SIM swaps had drained $13.3 million from crypto community members over four months. Buterin's real account does not participate in giveaways; any such posts should be treated as scams.","heading":"Twitter Reply Scams and Hijacked Verified Accounts","sources":[],"severity":"medium"},{"content":"The Pink Drainer phishing kit — a commercial malware-as-a-service tool sold on underground markets — was directly implicated in the September 2023 attack via Buterin's compromised X account. Pink Drainer had by that point been linked to phishing attacks on the Discord servers of Orbiter Finance, LiFi, Flare, and Evmos, as well as the X account of musician Steve Aoki. Its developer acknowledged the tool had facilitated over $53 million in total theft, while third-party estimates placed the figure at over $18 million from more than 9,000 victims. The kit automates wallet-draining transactions once a victim connects a wallet to a phishing site, requiring no manual action by the attacker to complete a theft. The use of high-credibility impersonation targets such as Buterin makes the kit significantly more effective, as victims are less likely to scrutinize transactions they believe are endorsed by known legitimate figures.","heading":"Pink Drainer Toolkit and Broader Threat Infrastructure","sources":[],"severity":"medium"},{"content":"Vitalik Buterin has no official Instagram presence; all Instagram accounts claiming to be him are fraudulent. Buterin's only verified social media accounts are on X (Twitter) and Farcaster (Warpcast). He has never run a crypto giveaway and has stated publicly that any account promising to double or return sent ETH is a scam. When evaluating content claiming to feature Buterin: (1) Buterin does not conduct token giveaways of any kind; (2) deepfake video quality has improved to near-broadcast standard and visual inspection alone is insufficient to detect fraud; (3) any unsolicited prompt to connect a wallet following a Buterin-branded post should be treated as a drainer attempt; (4) SIM-swap compromise of even high-profile verified accounts is a documented and recurring attack vector, meaning that content appearing to originate from a verified account is not proof of legitimacy.","heading":"User Guidance and Red Flags","sources":[],"severity":"medium"}],"timeline":[{"date":"2018-10-03","event":"Fake Instagram account @buterin_vitalik with 24,000 followers collects 37.491 ETH (~$7,500 at the time) via a fake giveaway directing victims through a Telegram bot.","source":"","source_url":"https://cryptoslate.com/vitaliks-impostor-instagram-account-collects-37-ether-in-apparent-giveaway-scam/"},{"date":"2020-07-10","event":"CoinDesk reports that crypto giveaway scams impersonating Buterin and other figures are flourishing on YouTube, constituting an established multi-year threat vector.","source":"","source_url":"https://www.coindesk.com/markets/2020/07/10/crypto-giveaway-scams-continue-to-flourish-on-youtube"},{"date":"2022-01-04","event":"A fraudulent Instagram account using the handle @vitalik.eth accumulates over 570,000 followers and runs sponsored paid advertisements to promote staking scams.","source":"","source_url":"https://u.today/scam-alert-someone-allegedly-impersonates-vitalik-buterin-on-instagram-pulling-off-crypto-scams"},{"date":"2022-02-18","event":"Group-IB documents 36 fabricated YouTube giveaway livestreams using Buterin footage over a 48-hour window; scammer wallets receive over $1.6 million in 281 transactions from more than 165,000 viewers.","source":"","source_url":"https://www.group-ib.com/media-center/press-releases/crypto-trap/"},{"date":"2022-08-15","event":"Vitalik Buterin publicly warns via his Twitter account that all 5,000+ Instagram accounts claiming to be him are fake and constitute scams.","source":"","source_url":"https://thecryptobasic.com/2022/08/15/all-5000-of-my-instagram-accounts-are-fake-ethereum-founder-vitalik-buterin-gives-a-reminder/"},{"date":"2022","event":"Attacker compromises verified journalist Aaron Goldfarb's Twitter account, redesigns it to impersonate Vitalik Buterin, and uses it to launch phishing campaigns targeting followers.","source":"","source_url":"https://u.today/vitalik-buterin-scam-hits-verified-account-of-famous-journalist","date_original":"2022-01-01"},{"date":"2023-09-09","event":"Attacker SIM-swaps Buterin's T-Mobile number, resets his X account password, and posts a phishing link for a fake 'Proto-Danksharding commemorative NFT.' ZachXBT tracks losses reaching ~$691,000, including CryptoPunk #3983 (~$244,000). Attack wallet is linked to Pink Drainer.","source":"","source_url":"https://decrypt.co/155738/hacker-steals-690000-after-hijacking-vitalik-buterin-x-account"},{"date":"2023-09-12","event":"Buterin confirms publicly via Farcaster that the attack was a SIM swap via T-Mobile, and advises users to remove phone numbers from X account settings.","source":"","source_url":"https://decrypt.co/156000/vitalik-buterin-sim-swap-attack-behind-700000-twitter-hack"},{"date":"2024-02-07","event":"CertiK discloses a deepfake video falsely depicting Buterin endorsing a wallet-drainer phishing site, marking an escalation from text-based impersonation to synthetic AI-generated video.","source":"","source_url":"https://crypto.news/analysts-discover-deepfakes-of-vitalik-buterin-promoting-scam-crypto-wallet/"},{"date":"2024-08","event":"Buterin publicly highlights the threat of AI deepfakes to identity verification, noting the increasing difficulty of distinguishing authentic from synthetic video content.","source":"","source_url":"https://cointelegraph.com/news/ai-deepfake-crypto-scams-2024","date_original":"2024-08-01"},{"date":"2025","event":"Reports indicate AI-generated deepfake impersonation videos of Buterin and other crypto figures surged 500 percent year-on-year, with $5 million attributed to deepfake crypto scam operations in Q2 2024 alone.","source":"","source_url":"https://yellow.com/research/crypto-fraud-in-2025-hits-record-highs-from-youtube-deepfakes-to-pig-butchering-scams","date_original":"2025-01-01"}],"sources_used":[],"source_tags":["youtube","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:05:02.188663+00:00","updated_at":"2026-08-29T01:34:28.049+00:00"}}