Verify a decision

{"actor":"system:backfill","investigation_id":"4cc761ab-8c05-4f4d-bb88-7291b5a0d9cc","kind":"publish","page_slug":"input-output-group-iog-youtube-channel-hijack-deepfake-hoskinson-giveaway-scam","published_at":"2026-09-18T12:12:40.316Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Input Output Group (IOG) YouTube Channel Hijack – Deepfake Hoskinson Giveaway Scam","sections":[{"content":"On September 18, 2026, IOG's official YouTube channel was taken over by unknown parties who used it to broadcast a fraudulent livestream for approximately two hours. The broadcast featured what multiple outlets described as an AI-generated or AI-manipulated video of IOG founder Charles Hoskinson, presented in the context of a fake Project Catalyst town hall. Viewers were directed to scan a QR code and send cryptocurrency to a wallet address under the false promise that any ADA sent would be doubled and returned. IOG issued an immediate public advisory: 'Please avoid interacting with the IO Group YouTube channel until further notice,' and advised users against clicking any links, sending funds, or sharing personal information with content originating from the channel. Charles Hoskinson posted a warning on X confirming the breach and stating IOG was cooperating with YouTube to remove the unauthorized videos and restore the channel's credentials. The Cardano blockchain itself was not compromised, and user wallets were not at risk.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Cardano Developer Warns Over AI YouTube Crypto Scam – CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/cardanos-iog-warns-users-to-avoid-youtube-channel-amid-giveaway-scam"},{"credibility":2,"name":"Cardano's IOG warns users after YouTube channel hijack – crypto.news","type":"news_article","url":"https://crypto.news/cardano-iog-warns-users-after-youtube-channel-hijack/"},{"credibility":2,"name":"Scammers Hijacked Cardano's Official YouTube and Used a Fake Hoskinson to Steal Crypto – CoinCentral","type":"news_article","url":"https://coincentral.com/scammers-hijacked-cardanos-official-youtube-and-used-a-fake-hoskinson-to-steal-crypto"},{"credibility":2,"name":"Cardano's IOG YouTube channel hacked, Hoskinson warns users – CoinTurk","type":"news_article","url":"https://en.coin-turk.com/cardanos-iog-youtube-channel-hacked-hoskinson-warns-users-to-avoid-scam-giveaway/"}]},{"content":"The attackers structured the fraudulent broadcast to exploit the social trust IOG has built through its Project Catalyst governance program, which holds regular public town halls streamed on YouTube. By impersonating this format and using AI-generated footage of Hoskinson, the scammers sought to lower viewers' suspicion. The core mechanism was a classic advance-payment scheme: a QR code displayed during the stream directed viewers to send ADA to a wallet address with the promise of receiving double the amount in return. Legitimate cryptocurrency giveaways operated by known organizations do not require participants to send funds first. No verified scam wallet address or on-chain analysis quantifying total funds received by the attackers had been publicly disclosed as of the date of this report. IOG has not confirmed whether any funds were transferred by viewers.","heading":"Scam Mechanics","severity":"critical","sources":[{"credibility":2,"name":"Cardano's IOG warns users after YouTube channel hijack – crypto.news","type":"news_article","url":"https://crypto.news/cardano-iog-warns-users-after-youtube-channel-hijack/"},{"credibility":3,"name":"Cardano Founder Warns Users as Scammers Seize IOG YouTube Channel – 36Crypto","type":"news_article","url":"https://36crypto.com/cardano-founder-warns-users-as-scammers-seize-iog-youtube-channel/"}]},{"content":"As of September 18, 2026, IOG had not publicly disclosed how attackers gained access to its YouTube channel. The compromise method — whether credential phishing, session-token theft, a malicious OAuth application, or another vector — had not been confirmed. IOG did not state whether multi-factor authentication was in use on the account or how it was bypassed. No threat actor or group had claimed responsibility. The investigation remains open.","heading":"Attribution and Access Method","severity":"high","sources":[{"credibility":2,"name":"Cardano Developer Warns Over AI YouTube Crypto Scam – CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/cardanos-iog-warns-users-to-avoid-youtube-channel-amid-giveaway-scam"},{"credibility":2,"name":"Scammers Hijacked Cardano's Official YouTube and Used a Fake Hoskinson to Steal Crypto – CoinCentral","type":"news_article","url":"https://coincentral.com/scammers-hijacked-cardanos-official-youtube-and-used-a-fake-hoskinson-to-steal-crypto"}]},{"content":"The IOG incident is consistent with a documented and growing pattern of YouTube-based crypto giveaway scams that employ AI-generated deepfake video of prominent crypto figures. A similar campaign using deepfake footage of Elon Musk was documented by Cybernews and Techopedia, with one such operation reportedly netting approximately $600,000 before being taken down. During the 2026 Super Bowl a deepfake video of Donald Trump was used in a parallel 'double your crypto' scheme attracting an estimated 200,000 viewers. TRM Labs' 2026 AI-in-Crime Adoption Index assigned a score indicating widespread AI adoption across crypto crime. The common operational pattern involves hijacking or purchasing established channels with existing subscriber bases to exploit pre-existing audience trust before platform moderation can respond.","heading":"Deepfake Technology and Broader Threat Landscape","severity":"high","sources":[{"credibility":2,"name":"YouTube Deepfake Crypto Scams Take $600K – Techopedia","type":"news_article","url":"https://www.techopedia.com/youtube-deepfake-crypto-scams-take-600k"},{"credibility":2,"name":"Deepfake Musk crypto giveaways resurface on YouTube – Cybernews","type":"news_article","url":"https://cybernews.com/news/youtube-deepfake-musk-crypto-giveaways-resurface/"},{"credibility":3,"name":"Deepfake Elon Musk Videos Are Fueling Crypto Investment Scams in 2026 – Geek Metaverse News","type":"news_article","url":"https://www.geekmetaverse.com/deepfake-elon-musk-videos-are-fueling-crypto-investment-scams-in-2026/"}]},{"content":"The September 2026 IOG YouTube hijack is not the first time the Cardano ecosystem's official communication channels have been targeted. In December 2024, the Cardano Foundation's official X (formerly Twitter) account was compromised by an unknown party who used it to promote a fraudulent Solana-based token called $ADASOL and to post a fabricated announcement claiming the SEC had filed a lawsuit against the Foundation. The fake token generated over $500,000 in trading volume on DexScreener before the scam was recognized. The false SEC lawsuit post accumulated over 256,000 views before the account was recovered. The Cardano Foundation confirmed the compromise and stated it would announce restored access via LinkedIn. These incidents collectively indicate that IOG and affiliated Cardano entities are a recurring target for social-media account takeover attacks, and that attackers adapt their techniques across platforms.","heading":"Pattern of Targeting: Prior Cardano / IOG Ecosystem Compromises","severity":"high","sources":[{"credibility":1,"name":"Hacked Cardano Foundation X account posts fake token, false SEC lawsuit notice – The Block","type":"news_article","url":"https://www.theblock.co/post/329879/hacked-cardano-foundation-x-account-posts-fake-token-false-sec-lawsuit-notice"},{"credibility":2,"name":"Cardano X Account Hacked, Spreading False SEC Lawsuit Claims – CryptoNews","type":"news_article","url":"https://cryptonews.com/news/cardano-x-account-hacked-spreading-false-sec-lawsuit-claims/"},{"credibility":2,"name":"Cardano Foundation X account under attack, hackers spread misinformation about SEC lawsuit – CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/cardano-foundation-hacked-false-sec-claims/"}]},{"content":"IOG responded publicly via its official X account on September 18, 2026, instructing users to cease all interaction with the YouTube channel until further notice and to avoid clicking links, sending funds, or sharing personal information. Charles Hoskinson separately posted on X warning followers to distrust all video content on the compromised channel and to avoid any links it displayed. Hoskinson confirmed IOG was working directly with YouTube to remove the unauthorized content and reset the channel's security credentials. Neither IOG nor Hoskinson had publicly confirmed full channel recovery as of the time of initial reporting. IOG did not disclose whether any users sent funds or whether losses had been quantified.","heading":"IOG and Hoskinson Response","severity":"medium","sources":[{"credibility":2,"name":"Cardano's IOG warns users after YouTube channel hijack – crypto.news","type":"news_article","url":"https://crypto.news/cardano-iog-warns-users-after-youtube-channel-hijack/"},{"credibility":2,"name":"Cardano Developer Warns Over AI YouTube Crypto Scam – CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/cardanos-iog-warns-users-to-avoid-youtube-channel-amid-giveaway-scam"},{"credibility":3,"name":"Cardano Founder Warns Users as Scammers Seize IOG YouTube Channel – 36Crypto","type":"news_article","url":"https://36crypto.com/cardano-founder-warns-users-as-scammers-seize-iog-youtube-channel/"}]},{"content":"As of September 18, 2026, no verified figure for total funds lost to the scam had been publicly disclosed. IOG confirmed it was unaware of confirmed victim transactions and had not released any on-chain analysis linking specific wallet transfers to the September 18 broadcast. The scam wallet address displayed via QR code during the stream was not publicly reported by any outlet at the time of writing. Claims of losses circulating in community forums are unverified and should be treated as low-confidence until supported by on-chain evidence or an official statement.","heading":"Financial Impact and Known Losses","severity":"high","sources":[{"credibility":2,"name":"Cardano's IOG warns users after YouTube channel hijack – crypto.news","type":"news_article","url":"https://crypto.news/cardano-iog-warns-users-after-youtube-channel-hijack/"}]},{"content":"Available reporting confirms that the compromise was limited to IOG's YouTube channel account credentials. The Cardano blockchain protocol, user ADA wallets, and other IOG-operated infrastructure were not affected by this incident. IOG's website, GitHub repositories, and other social accounts showed no signs of concurrent compromise at the time of reporting.","heading":"Scope of Compromise","severity":"low","sources":[{"credibility":2,"name":"Scammers Hijacked Cardano's Official YouTube and Used a Fake Hoskinson to Steal Crypto – CoinCentral","type":"news_article","url":"https://coincentral.com/scammers-hijacked-cardanos-official-youtube-and-used-a-fake-hoskinson-to-steal-crypto"},{"credibility":2,"name":"Cardano Developer Warns Over AI YouTube Crypto Scam – CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/cardanos-iog-warns-users-to-avoid-youtube-channel-amid-giveaway-scam"}]}],"sources_used":[{"credibility":2,"name":"Cardano Developer Warns Over AI YouTube Crypto Scam – CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/cardanos-iog-warns-users-to-avoid-youtube-channel-amid-giveaway-scam"},{"credibility":2,"name":"Cardano's IOG warns users after YouTube channel hijack – crypto.news","type":"news_article","url":"https://crypto.news/cardano-iog-warns-users-after-youtube-channel-hijack/"},{"credibility":2,"name":"Scammers Hijacked Cardano's Official YouTube and Used a Fake Hoskinson to Steal Crypto – CoinCentral","type":"news_article","url":"https://coincentral.com/scammers-hijacked-cardanos-official-youtube-and-used-a-fake-hoskinson-to-steal-crypto"},{"credibility":2,"name":"Cardano's IOG YouTube channel hacked, Hoskinson warns users – CoinTurk","type":"news_article","url":"https://en.coin-turk.com/cardanos-iog-youtube-channel-hacked-hoskinson-warns-users-to-avoid-scam-giveaway/"},{"credibility":3,"name":"Cardano Founder Warns Users as Scammers Seize IOG YouTube Channel – 36Crypto","type":"news_article","url":"https://36crypto.com/cardano-founder-warns-users-as-scammers-seize-iog-youtube-channel/"},{"credibility":1,"name":"Hacked Cardano Foundation X account posts fake token, false SEC lawsuit notice – The Block","type":"news_article","url":"https://www.theblock.co/post/329879/hacked-cardano-foundation-x-account-posts-fake-token-false-sec-lawsuit-notice"},{"credibility":2,"name":"Cardano X Account Hacked, Spreading False SEC Lawsuit Claims – CryptoNews","type":"news_article","url":"https://cryptonews.com/news/cardano-x-account-hacked-spreading-false-sec-lawsuit-claims/"},{"credibility":2,"name":"Cardano Foundation X account under attack, hackers spread misinformation about SEC lawsuit – CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/cardano-foundation-hacked-false-sec-claims/"},{"credibility":2,"name":"YouTube Deepfake Crypto Scams Take $600K – Techopedia","type":"news_article","url":"https://www.techopedia.com/youtube-deepfake-crypto-scams-take-600k"},{"credibility":2,"name":"Deepfake Musk crypto giveaways resurface on YouTube – Cybernews","type":"news_article","url":"https://cybernews.com/news/youtube-deepfake-musk-crypto-giveaways-resurface/"},{"credibility":3,"name":"Cardano's IOG warns users to avoid YouTube channel amid apparent hijack – CoinSpectator","type":"news_article","url":"https://coinspectator.com/cointelegraph/2026/09/18/cardanos-iog-warns-users-to-avoid-youtube-channel-amid-apparent-hijack/"}],"summary":"On September 18, 2026, unknown attackers hijacked the official YouTube channel of Input Output Group (IOG), the core development company behind the Cardano blockchain, and broadcast an approximately two-hour fraudulent livestream. The broadcast used suspected AI-generated video of IOG founder Charles Hoskinson to impersonate a Project Catalyst town hall and solicit cryptocurrency from viewers via QR code, promising to double any ADA sent. IOG and Hoskinson publicly warned users not to engage with channel content, and IOG confirmed it was working with YouTube to recover the account. This incident was not an attack on the Cardano blockchain or user wallets; it was a social-media account compromise targeting IOG's YouTube presence.","timeline":[{"date":"2024-12-08","event":"Cardano Foundation's official X account was compromised. Attackers posted a fabricated Solana-based token ($ADASOL) and a false claim that the SEC had filed a lawsuit against the Foundation. The fake token generated over $500,000 in trading volume before the scam was identified.","source":"The Block","source_url":"https://www.theblock.co/post/329879/hacked-cardano-foundation-x-account-posts-fake-token-false-sec-lawsuit-notice"},{"date":"2026-09-18","event":"Unknown attackers hijacked IOG's official YouTube channel and began broadcasting a fraudulent approximately two-hour livestream featuring suspected AI-generated video of Charles Hoskinson, impersonating a Project Catalyst town hall and soliciting ADA via QR code.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/cardanos-iog-warns-users-to-avoid-youtube-channel-amid-giveaway-scam"},{"date":"2026-09-18","event":"IOG posted a public advisory on X urging all users to avoid interacting with the YouTube channel until further notice, warning against sending funds or clicking links. Charles Hoskinson separately confirmed the breach on X and stated IOG was working with YouTube to remove content and restore channel credentials.","source":"crypto.news","source_url":"https://crypto.news/cardano-iog-warns-users-after-youtube-channel-hijack/"}]},"v":1}