The Sandbox CEO’s Twitter was hacked, used to promote alleged ‘airdrop’ scam

Arthur Madrid, co-founder and CEO of meta­verse project The Sand­box, was the vic­tim of a Twit­ter account hack on May 26, accord­ing to a post from Madrid that was appar­ent­ly made after he recov­ered the account. The attack­er alleged­ly used Madrid’s account to pro­mote a fake “air­drop” phish­ing scam.

In Madrid’s post, he warned Sand­box users that they should “nev­er click on any link that pro­mote Air­drop or URL and look SCAMMY — and not 100% using our prop­er and unique URL/domain name : http://sandbox.game.”

My Twit­ter was hacked today. and now is back. Please nev­er click on any link that pro­mote Air­drop or URL and look SCAMMY — and not 100% using our prop­er and unique URL/domain name : https://t.co/X3rXN9z8z7

— Arthur Madrid (@arthurmadrid) May 26, 2023

Four hours before Madrid’s post, The Sandbox’s offi­cial Twit­ter account also warned that a scam­mer had tak­en con­trol of the account and was pro­mot­ing “a scam / phish­ing link for a fake air­drop of SAND tokens.”

The post includ­ed a screen­shot of the alleged scam post, which adver­tised a SAND token air­drop and encour­aged users to “check eli­gi­bil­i­ty and claim on the site,” refer­ring users to a web­site with a dif­fer­ent URL than the offi­cial one.

The Sand­box team stat­ed that they were “work­ing on get­ting the site down and fix it ASAP.”

⚠️ Our CEO & Co-Founder Arthur Madrid’s Twit­ter account has been hacked ⚠️

The hack­er is post­ing a scam / phish­ing link for a fake air­drop of SAND tokens.

⛔️Do NOT click on the link and instead report the post so it is blocked. 

We’re work­ing on get­ting the site down and fix… pic.twitter.com/sOqzAV5OUT

— The Sand­box (@TheSandboxGame) May 26, 2023

As of 8:26 pm UTC, the alleged scam site appears to have been tak­en down, as it now pro­duces a 404 error.

Relat­ed: Six Tools Used by Hack­ers to Steal Cryp­tocur­ren­cy: How to Pro­tect Wallets

Phish­ing attacks have become a fre­quent prob­lem in the cryp­to com­mu­ni­ty. On May 19, a scam-as-a-ser­vice called “Infer­no Drain­er” was report­ed­ly dis­cov­ered to be oper­at­ing on Telegram, recruit­ing web­site builders to cre­ate hun­dreds of these phish­ing scam sites. By the time it was dis­cov­ered, it had report­ed­ly stolen near­ly $6 mil­lion from users.

On April 15, cyber­se­cu­ri­ty firm Kasper­sky report­ed that these types of attacks increased by 40% in 2022 com­pared to the pre­vi­ous year.