Crypto trader and RugSeekers founder, Robert Browning.
Crypto trader and RugSeekers founder, Robert Browning. Photographer: Luke Sharrett/Bloomberg

How Crypto Vigilantes Are Hunting Scams in a $100 Billion Market

A ragtag team is trying to weed out fraudsters in a fast-moving corner of the crypto world that’s entirely unregulated.

On a Monday morning in October, in a southern Indiana basement, a 52-year-old grandfather in a Dogecoin hat is patrolling the darkest corners of the crypto world for Shit Coin scammers.

Robert Browning and his motley crew — named the RugSeekers for a popular pump and dump scam called the rug pull — are investigating a tip about a new coin called We Save Moon. They’re examining its source code, wallets and price charts for red flags indicating fraud. Browning enters the coin’s group chat on Telegram, the messaging app where this world hangs out. He starts typing under his alias RobAte25 — a reference to his grandson’s birthday, 8/25 — and moves in for the kill.

Browning asks for ‘mods,’ or the moderators of the chat associated with We Save Moon. ‘Gene Cernan,’ a mod named for an American astronaut, responds. The mod’s name will change throughout the exchange to other astronauts. In typical DeFi fashion, the mod encourages the group to ‘PUMP’ the coin — buy more of We Save Moon and boost the price.

Eric Mings, another RugSeeker, also joins and asks a question about the coin’s utility. In this world, coins that serve a purpose are often considered a better and safer investment. We Save Moon responds under a different name, Alan Bean, but doesn’t answer the question. Instead, Mings is directed to the group’s pinned messages.

Eventually, the moderator tells Mings that the utility of the coin is to get rewards, but doesn’t offer specifics. Meanwhile, Browning is asking whether the developers are ‘doxxed,’ meaning they've publicly shared their identities. If a coin creator is willing to go public, there’s less chance that they’ll scam people.

After being ignored, Browning identifies himself as a member of RugSeekers. Mings echoes his question about the doxx status of the creators. The developers say yes, and Mings asks for proof. Browning continues to be ignored. It’s clear whoever created this coin probably won’t cooperate.

Browning, a former contractor turned full-time crypto trader, is the self-appointed sheriff for weeding out fraudsters in decentralized finance, a fast-growing global market that has topped $100 billion in value. The policing comes not from Washington, but instead from places like this home a short drive northwest of Louisville, Kentucky, past corn fields, red barns and highway billboards.

Browning sits hunched over a small desk in the over-air-conditioned room, religious scripture and sports banners adorning the wall. A Ronald Reagan paperweight next to his laptop is etched with the reminder to “Trust, but verify.”

“I can look at a contract and within two seconds tell you if it’s a scam or not,” Browning says, his voice betraying his lower Midwestern roots.

For the We Save Moon takedown, Browning is sitting beside Mings, a friend whom he lured into the crypto world. Several other people, scattered across the country, are dialed into a group call, which Browning has on speaker phone.

Mings finds the We Save Moon website, looking for more information on the creators’ identities. He shares the team page, with cartoon characters, jokingly asking whether this is what they consider their doxx. The mod says it isn't, adding an “LOL.” Browning identifies himself again, but it looks like the mods are not going to engage with him. The Telegram group has several messages coming in every minute, from RugSeekers and others.

The RugSeekers aren’t the only ones in the group asking questions. Individual investors are also trying to figure out whether this coin is solid. When one investor asks if “this is a legit coin,” the developers almost lash out. “What kind of question is this?”

The developers walk back that answer here, deleting the previous text, and simply attesting to the fact that it is a real coin because people get rewards.

While the team’s in the chat, they’re also coordinating on a group call. One of the RugSeekers in Ohio is purchasing a small share of the coin as a test. That’s when they notice that when an investor sells any of the tokens, about $90 from the liquidity pool is transferred into another wallet. That’s known as a skim feature, where developers will slowly put a certain portion of the liquidity into their own wallets.

These types of scams are exploding in DeFi, the wild west of the crypto market. There, anyone and everyone can mint digital tokens — some that create outrageous fortunes, and far more that flop within hours. FOMO coin culture is the perfect breeding ground for fraudsters looking to take investors’ money and run.

The past month alone has seen the rise of so-called memecoins such as Squid Game, only to have them spectacularly collapse in suspected frauds.

Once Browning identifies a coin isn’t legit, his group goes on the attack.

Back in the chat, Browning is pressing the developers on the $90 skim feature. They ignore him. The diagnosis: a slow rug, the drawn out version of a rug pull, in which scammers will slowly steal the money that has been pumped into the coin and leave investors hanging. No one answers Browning’s questions about it.

Browning warns that he’s going to let others know about the potential scam on social media if they don’t start answering his questions. The review would label the coin as a scam on platforms like Twitter and in the RugSeekers Telegram group.

After that warning, Browning has been blocked, and his messages have been deleted, meaning investors who weren’t following along will miss the potential warnings. The moderator encourages the group to keep pumping the coin. Over the group call, Browning asks for backup while he turns to Twitter to tweet a warning and raise awareness as fast as possible.

Browning’s backup comes in to ask why they blocked him. These are the other RugSeekers that have been on the phone with him the entire time, running diagnostics on the coin. The developers of the coin act coy, pretending that they have no idea who RobAte25, the RugSeekers guy, is.

The developers explain that Browning was blocked for being a FUD: a person who instills fear, uncertainty and doubt.

All along, the coin’s group chat is buzzing with investors encouraging their peers to buy! buy! buy! They share memes of rocket ships and the question ‘Wen Lambo?,’ code for ‘When will this make us rich enough to buy a Lamborghini?’ Here one of the developers is seen rallying the crowd telling everyone to get on board the rocket ship.

One of the RugSeekers’ allies shares the tweet Browning posted from the RugSeekers Twitter page, with the old-timey Wanted! poster warning investors about We Save Moon.

The warning is on the message thread for about 8 seconds before it’s deleted because the person who shared it has also been blocked. A few minutes later, Mings is banned from the group as well. The whole process, from when Browning entered the chat to this latest blocking, takes 46 minutes.

In a matter of days, the developers will slowly pull the money out of the coin, leaving behind investors lamenting in the Telegram group about falling for yet another scam and, in some cases, losing thousands of dollars.

The moderators of the We Save Moon chat didn’t respond to messages from Bloomberg News seeking comment.

In the first half of this year, there were $681 million in major crypto thefts, hacks and frauds, according to research from CipherTrace, a cryptocurrency intelligence firm. DeFi-related hacks made up 54% of major crypto fraud volume, compared with only 3% for all of last year. The data showed that at $361 million, the amount netted from DeFi-related hacks through July already surpassed the $129 million stolen throughout all of 2020.

The money at stake for individuals can be paltry by Wall Street standards, with $10, $100, maybe $1,000 investments at a time. But in the world of crypto trading, filled with amateur investors making bets from their couches, these sums can have a big impact on people’s savings.

Regulators, more apt to go after big traders, just can’t keep up.

Gary Gensler, chair of the Securities and Exchange Commission, warned in August that the cryptocurrency market is “rife with fraud, scams and abuse” and that “a lot of people will be hurt” if the government doesn’t boost investor protections. Behind the scenes, the agency’s enforcement attorneys have sent out several subpoenas and other information requests to firms asking about DeFi offerings, according to people familiar with the matter.

Still, SEC cases usually take months or even years to bring as the agency is obligated to respect defendants’ legal rights under due process laws. And with limited resources, it’s impossible for the regulator to go after every scam in real time, especially since the DeFi world moves so quickly, with cons playing out in a matter of hours.

RugSeekers calls out potential crypto con artists on Twitter to help investors avoid fake coin scams.
RugSeekers calls out potential crypto con artists on Twitter to help investors avoid fake coin scams. Photographer: Luke Sharrett/Bloomberg

“The SEC brings big cases to send big messages because they don’t have infinite resources and they’re really looking to change the marketplace,” said John Reed Stark, who worked as an enforcement attorney for the agency for 20 years. “The SEC can be slow and methodical and sometimes short-staffed, but sooner or later they’ll get you.”

The SEC declined to comment.

In the absence of regulators, it’s hard to know where to look for vetted information about the legitimacy of a coin. Scanners like TokenSniffer run through contracts looking for potential red flags, but those alone don’t always weed everything out. (TokenSniffer rated We Save Moon as “medium risk.”) The most effective way of exposing crypto scammers is by calling them out in their own group chats, on their own turf, and gaging their reaction.

Marcos Araujo, a 27-year-old from northeast Brazil, says he lost about $2,000 from his investment in We Save Moon. He ended up pulling out what little he had left before the coin totally crashed, but not before pleading to the developers in the Telegram group, “I put a lot of money into this project,” he wrote. “Please do something.”

Araujo, who had invested in cryptocurrencies for about six months, had never heard of the RugSeekers and didn’t see any of the messages of concern Browning had sent — for one, because things on Telegram move so quickly, with thousands of messages coming through a day, but also because once you’re banned from a group, the messages you had sent disappear. There was no trace that Browning had ever been in the chat at all.

Browning started RugSeekers after his own crypto bet gone wrong in July. He was promoting a coin called Altex, which boasted plans for something called a “CryptoCard,” a sort of credit card for meme coin investors, and a crypto university. Disaster ensued when bots infiltrated the project, causing the developers to panic-sell their stakes and sending the coin’s value plummeting, according to Browning.

He describes the personal devastation of being a scam victim as wrecking your car, going to a funeral and breaking up with your partner all at the same time. Even worse, he had lured Mings — the father of his teenage daughter’s boyfriend — into Altex for his first crypto bet.

“I sat right here in this chair on July 11 and I was taken badly,” Browning says. “I watched an $8,200 bag turn into $86 dollars. I had that feeling in my throat where you can’t swallow, because you feel so used and so rejected. It’s the worst of everything.”

Browning says he now spends most of his waking hours looking for scams. He also still invests, dabbling in coins such as Cardano, Solana and Ethereum, and estimates he has made about $80,000 from the bets this year. He doesn’t make money off the scam-hunting work, though the RugSeekers launched a coin of their own to try to raise funds for support.

He recognizes that the RugSeekers have a tiny footprint. Two days after Browning tweeted about We Save Moon and his concerns, the post had 4,145 impressions. “It’s nothing” compared to the population of crypto investors worldwide, he says.

Still, he continues, and the RugSeekers are on to the next coin. If he can save just one more person from investing in a scam, it’ll be worth it, he says.

“There’s not many places where I can tell you someone’s going to make $20 million today or some coin is going to be up 15,000% today,” Browning says. “The fear of missing out is the biggest thing, and that’s where people make the most mistakes.” —With Matt Robinson, Jesse Westbrook and Blake Schmidt

More On Bloomberg