The fake Moonshot vote names its payout wallet
A fake "listing vote" for BOB spread on X on Monday. Its code has the wallet the money goes to written into it. That wallet has already drained nine others.
On Monday evening, at least five X accounts posted the same message: "Attention $BOB Family! YOUR vote matters!" It linked, through tinyurl, to one of four look-alike pages on netlify.app offering a "community vote" to list BOB on Moonshot. We flagged it that night as a wallet drainer. Its code has since told us more: where the money goes.
The page's script is a kit, written for whoever bought it. A section headed "Hitter Config" sets targetWallet to 9kRW…iNpv, with the comment "your split wallet." Other settings "bypass estimated changes," which hides the preview a wallet shows before you sign, and set the "amount of tokens victim should see on prompt" to 25 of a fake XP token. All four copies of the page carry the same payout wallet. Opening the page reports your visit to the operator's server before you click anything.
That payout wallet has a record. Between 20 and 23 September it took part in 22 transactions, and nine different wallets lost tokens in them. Each drain was split: roughly two-thirds to three-quarters to the payout wallet, the rest to one or two of five other wallets. The payout wallet then sold what it got for SOL. It holds 21.16 SOL, and every bit is accounted for: 19.32 from selling drained tokens, 1.84 taken from victims directly.
The drains came two ways. Twice, the victim signed a transaction that emptied their own wallet. The other eight times, the victim signed nothing: one of two kit wallets, 9KrR…drmC or FPjX…cjkF, moved their tokens because the victim had earlier approved it to spend them. One of those approvals is still in place today, for an effectively unlimited amount.
The fake XP is real too. At 23:43 UTC on 20 September, one victim's tokens were drained, and in the same minute the same kit wallet sent that victim exactly 25 of the XP token the config names, the amount it tells the page to show.
The payout wallet's last transaction was on 23 September, five days before BOB launched, so none of this money came from BOB holders. We found no link between it and BOB's team; the drainer rides whatever coin is trending. As of 01:00 UTC on 29 September, the BOB campaign hadn't paid into this wallet. The pages have been reported to Netlify and tinyurl.
If you connected a wallet to one of these pages: move what's left to a new wallet, and revoke any token approvals you don't recognise. An approval keeps working after you close the page.
- Who runs the kit, and who bought this copy. The code reports each visit to a Telegram group chat; we don't know whose.
- How much the five wallets that took the smaller cut received in total. We traced only the payout wallet's side of each drain.
- Whether the BOB campaign has drained anyone yet. As of 01:00 UTC on 29 September nothing had reached the payout wallet, but the other wallets may have been paid first.
- What the page's transactions do in full. That code is scrambled, and reading it means running it; we haven't. The drains above come from the payout wallet's own record.
The evidence
each line links to the transactionThe payout wallet is written into the page
All four copies of the fake vote page set targetWallet to 9kRW…iNpv under a "Hitter Config" heading, commented "your split wallet." The same config hides the wallet's balance-change preview ("bypass estimated changes") and sets what the "victim should see on prompt." We read the code as text and never ran it.
Nine wallets drained into it, 20–23 September
22 transactions. Nine wallets lost tokens, each drain split between the payout wallet and one or two of five other wallets. The payout wallet then sold the tokens for SOL. Its 21.16 SOL balance is fully explained: 19.32 from those sales, 1.84 taken directly.
Tokens taken without the owner's signature
In eight of the ten drains the victim didn't sign. Two kit wallets moved the tokens as approved spenders: 9KrR…drmC five times, FPjX…cjkF three times. One victim's token account still lists 9KrR…drmC as its approved spender, for an effectively unlimited amount, as of 29 September.
The 25 fake XP, delivered
The config shows victims 25 of a spoof XP token. At 23:43 UTC on 20 September one victim was drained, and in the same minute the kit wallet sent them exactly 25 of that token.
No tie to BOB's team
The payout wallet's last transaction was on 23 September, five days before BOB launched. None of its 22 transactions involve BOB or BOB's creator, router or project wallets.
The wallets
10 on fileThe trail
how the wallets connectThe coins
Sources
Know more, or named here and want to reply? DM @trenchbookapp on X. A wallet's owner who proves control of it gets their reply printed.