In the largely unregulated world of bitcoin and cryptocurrency, fraudsters are getting rich by deliberately spreading false information to affect the price of their holdings using social media, scam news sites, and private chat apps.

Zak Tebbal / BuzzFeed News

On Saturday, Jan. 14, a Twitter account purporting to be that of John McAfee, the outlandish founder of cybersecurity firm McAfee, shared a bit of investment advice. “Coin of the day,” the account tweeted, promoting GVT, a new digital coin that had started trading in the fall of 2017. Despite his infamy (he founded one of the most successful antivirus software companies ever, fled from Belize police in 2012 after being wanted for questioning in the death of his neighbor, and ran for president in 2016), McAfee is still viewed by some as a cryptocurrency sage; he was touting bitcoin as the currency of the future long before its recent gains. And — for some — McAfee shilling for GVT was good reason to buy it, a premonition of future buying frenzies and a soaring valuation. So they bought. And they bought without noticing the additional "L" in the Twitter username or the missing verification check that distinguished the bogus McAfee account from the real one, @OfficialMcAfee. When the tweet was first broadcast at around 3 p.m. ET, GVT was bought and sold on the market at $30. By 3:04, it was at $45, and trading volume had doubled.

But by 3:19, GVT's price had fallen back to $30.29. The smart money — the early money —had gotten out, leaving the late money holding a bag of now-diminished value. It was a classic pump-and-dump scheme orchestrated in a chat room called “Big Pump Signal," which encouraged its members to retweet or otherwise promote the bogus McAfee and buy and sell GVT at the appointed times. In the wild world of cryptocurrency trading that's largely untouched by regulation, the spread of fake news and unsubstantiated rumors is becoming common practice among bad actors looking to prey on novices. It’s the perfect environment in which to proliferate misinformation; it's mercurial, confusing, and full of uneducated, overeager traders hoping to strike it rich. “A lot of this falls on the fact that people need to be more sober-minded in the space,” said Laz Alberto, a cryptocurrency investor and editor of the newsletter the Blockchain Report. “A lot of conversations that I have start with ‘my friend says’ or ‘I saw this on Twitter’ or ‘I saw this in a Telegram group.’ Before listening to anyone in crypto, you have to learn firsthand.” But learning takes time and finding good information can try your patience — particularly when it seems like everyone around you seems to be making money hand over fist by acting on the latest blogged or tweeted investment tidbit. Usman Chohan, an economist and researcher at the University of New South Wales, compares the current hysteria to the “irrational exuberance” of the dot-com era where paper fortunes rose and fell based on an illogical, capricious market.

@officiallmcafee Do you pump in the telegram? Dishonest!

Russia-based Genesis Vision, the company whose currency was exploited in the pump and dump above, is a good example. The total value of its four-month-old digital coin currently hovers around $75 million, even after the wild price swings. Genesis Vision doesn’t yet offer a single product or service; it has only a slick website and a white paper explaining its intent to build a decentralized, global trading network sometime this year. Even the company’s leadership views the valuation of GVT with a raised eyebrow. “There is currently no use for GVT right now,” Miroslava Egorova, Genesis Visions’ chief operating officer, told BuzzFeed News. But that clearly did weigh on the minds of those who ended up deciding to trade GVT. Seeing that it was a top-25 traded coin on Binance, a cryptocurrency exchange that allows for the trading of so-called alt coins, the leaders of Big Pump Signal, the free-to-join Telegram group, told their users on Saturday to expect “a different setup.” “Not a ussual [sic] pump,” the administrator wrote. “We are spreading news again, just like the OAX pump, one of our most succesful [sic] pumps.” That fake McAfee tweet, which a Big Pump Signal admin linked to in Telegram with instructions to retweet, may have been shared more than 1,300 times, according to screenshots. It was eventually deleted, along with its associated fake account and Telegram hyperlink. An early promoter and organizer of Big Pump Signal, one of dozens of pump-and-dump groups on Telegram, did not respond to a request for comment to BuzzFeed News. A spokesperson for Telegram did not respond to an emailed request for comment.

“There are frankly a lot of groups that have now centered around misinformation."

“A lot of outside volume coming in this pump, amazing work by the helper who gave us the idea for this social media plan and amazing work by the ones who retweeted it, we really made a statement,” the administrator for Big Pump Signal wrote to the group at 3:42 p.m. ET, after the scheme was complete. “There were more outside users involved than any other time.” Those outside users may have seen a 33% drop in their holdings if they bought GVT at its peak. And they’re not the only ones who were hurt. A quick scan of Twitter turns up some of Big Pump Signal’s own members complaining about losing money. Oftentimes, the only people certain to benefit in a pump and dump are its organizers — and sometimes they're running smaller, more exclusive Telegram groups intended to further maximize their schemes. Last August, the Securities and Exchange Commission warned about cryptocurrency fraud and ICO-related scams on its public investor site, noting that bad actors engage “in market manipulation, such as by spreading false and misleading information about a company.” Still, it's only announced charges against one alleged ICO scam, and it’s unclear what government agency would have jurisdiction, or interest, in the pump and dumps that happen daily via Telegram groups. “There are frankly a lot of groups that have now centered around misinformation,” said Alberto. “It’s obviously illegal, but there’s no regulation and they’ve gotten away with it.”

How to spot a pump & dump (and why you should not join a PND Group) Here is a 1Hr chart zoomed in to a 1 min chart… https://t.co/vwdbs51R2J

The “Death” of Ethereum’s Creator While pump-and-dump scams typically target new ICOs, more established cryptocurrencies, like bitcoin and ethereum, are also vulnerable to manipulation via misinformation. In June, ethereum lost billions of dollars from its market capitalization after rumors of its creator's death began circulating on 4chan, the anonymous messaging board famous for its trolls and conspiracy theorists. “Vitalik Buterin confirmed dead,” the post read, referring to the 23-year-old genius behind the cryptocurrency that trades as ETH. “Insiders now unloading ETH. Fatal car crash. And now we have our answer. He was the glue. It will be difficult for ETH to recover and the entire crypto sphere is in big trouble.” At the time, ethereum — which had astonishingly charted a roughly 4,800% increase in price earlier in the year — was suffering a nasty downward slide. Rumors of Buterin’s death dramatically exacerbated its volatility. The digital currency began to stabilize only after Buterin posted a photo of himself confirming he was alive and well. Because bitcoin is still an emerging currency with no underlying assets, it is particularly susceptible to rumors as well. Among the most common is the constant discussion about which large institution or retailer will embrace bitcoin next, giving bitcoin validation and pushing it further into the mainstream.

Some have taken advantage of that. In September, James Altucher, a self-proclaimed bitcoin expert who runs various online ads for his “Masterclass on Cryptocurrencies” video courses, wrote in an online newsletter that “I am certain Amazon WILL ACCEPT Bitcoin.” (It's worth noting that in 2013, he had tweeted that “bitcoin is a fad, or a scam, or a ponzi scheme, or worse.”) “Amazon could make the announcement as early as October 26, at 4 p.m., during its next earnings conference call,” he wrote, citing a quote taken out of context from an Amazon executive and other speculative information. Despite this, the information was reported as fact on Squawker, a conspiracy website with about 225,000 total visits a month according to SimilarWeb, a web analytics firm. Then it was recycled in a report on CoinTelegraph, an online cryptocurrency publication, and German newspaper Die Welt.

“I said potentially as early as, not on this date."

“I said potentially as early as, not on this date,” Altucher told BuzzFeed News when asked about the information he spread in his ad. “There really is misinformation out there about cryptocurrencies and that’s what I’m trying to get people to avoid.” When Oct. 26 came and went with no bitcoin announcement from Amazon, Alutcher updated his newsletter to read, “Amazon could make the announcement as early as February 2, at 4 p.m., during its next earnings conference call.” Chohan also pointed to unverified screenshots posted to Reddit that showed an Amazon customer service representative suggesting that Amazon is “working on” a solution to accept bitcoin. “Think about how easy it is to forge a chat like that,” he said. “If you bought some bitcoin, you would have every incentive to put that on Reddit so that the bigger fool comes in and buys it.” A source close to Amazon said the company has no plans to add bitcoin or cryptocurrency support in the near future.

Facebook Pushes Bitcoin Scam Ads Traditional fake news pushers have also turned to cryptocurrency as a new vector to spread their online scams. In capitalizing on the gold rush, they’ve created sites that mimic mainstream media web pages, with the hopes of getting internet users to click through to scams that promise people they can “earn one bitcoin a day” after they’ve entered in personal data and credit card information. “Richard Branson And Elon Musk Invested $17-Million In a Bitcoin Tech Startup,” read one such headline on a website that spoofed CNN, sporting the same layout as CNN’s real site, the byline of an actual CNN Technology reporter, a faked Facebook comments section, and a bogus CNN-money-report.com URL. The website, which discussed a bitcoin trading system dubbed “the Bitcoin Code,” used social media to bring in more than 425,000 total visits between September and December, according to traffic estimations from SimilarWeb. A Google search of the Bitcoin Code immediately brings up fraud alerts, warning users against handing their money over to the website. And while the fake CNN URL has been scrubbed from Facebook, a simple Twitter search suggests people shared and fell for the hoax last fall. It’s also not the only website in the network spreading false stories for financial gain. A search of other sites that share the same IP address reveals a network of 72 web addresses — some active, some not — promoting the Bitcoin Code. A SimilarWeb search of a handful of these sites shows the vast majority of their visitors come from social media. That’s the case with Dorothylewis.online, one of the 72 sites, which received roughly 50,000 visits between September and October by sharing fake bitcoin investment news about Musk and, as one Twitter user pointed out, purchased sponsored posts on Facebook to increase the audience. Facebook didn't answer specific questions about those ads, which were also seen by Gavin Sheridan, a journalist and founder of legal startup Vizlegal. Sheridan began tweeting about them last Sunday after he was targeted by paid a post from a Facebook page belonging to “Ireland Crypto.” The sponsored ad featured a picture of Virgin Group founder Richard Branson and a caption that news caption that read, “Richard Hacks Multiple Crypto Exchanges!”

“I’ve seen this stuff for years on Facebook, and it’s something they’ve chosen to ignore.”

“I knew straight away it was a scam,” said Sheridan. “But if you’re a vulnerable older relative of mine, or using a device that’s not a laptop, it’s harder to interrogate the provenance of that link.” Sheridan traced the ad to another spoof CNN page with the headline, “Richard Branson Reveals Trading Bitcoins Will Make You Quit your job in 30 Days!” That page, in turn, linked to a page called ConsistentProfits.co with an autoplay video that promises to teach people how to make 10 bitcoins every week. A domain search on the site reveals a likely front company with ties to addresses in Israel and Las Vegas. “You watch the video, it tries to hook you, you sign up there, you put in your credit card, and there is no data protection,” said Sheridan. “I’ve seen this stuff for years on Facebook, and it’s something they’ve chosen to ignore.” Rob Goldman, Facebook’s vice president of ads, eventually caught wind of Sheridan’s tweets, and the page was taken down, but it’s unclear how long it was up, how widely it was promoted, and how many people it engaged. “These ads violate not only our policies, but our principles as well,” he tweeted. “We have zero tolerance for this sort of behavior on the platform.” That zero tolerance is hypothetical, at the moment, as other pages that promote cryptocurrency scams continue to proliferate on Facebook. A September post from Dorothylewis.online claiming Elon Musk invested $770 million in a bitcoin startup was still online when this article published. It has been broadcast through Facebook’s ad network, amassed 1,500 likes, and has been shared more than 300 times. Many commenters are skeptical of the story. Others, not so much. “In Elon we trust,” one person wrote. ●