Is OxyCapitals a scam?

Yes, OxyCapitals (oxycapitalsltd.com) is a confirmed cryptocurrency scam that has stolen over $54,000. They impersonate legitimate Discord admins using typosquatting (changing one letter in usernames like "salmaogs" to "sajmaogs") to trick victims into depositing Bitcoin and other cryptocurrencies. We have documented blockchain evidence showing stolen funds being cashed out through exchanges.

Yes, MirrorExp (mirrorexp.com) is a confirmed cryptocurrency scam that has stolen over $30,000. They use typosquatting to impersonate Discord admins (changing ".atraveller" to "_atraveller") to direct victims to their fake trading platform. Funds are rapidly moved through staging wallets to exchanges within minutes of deposit.

What are the OxyCapitals scam wallet addresses?

Known OxyCapitals scam wallet addresses include: Bitcoin Collection (1NTXSjeydYLhWuXS8cVWx57VqyRFqz4gaC), Bitcoin Personal (1GC4fSsmgJMCtMh643WBCi5pBnTpqqCXP2), Bitcoin ByBit (192UAp4TEGApNdxPbSN5veQZ8ynyixjqvB), Bitcoin SegWit (bc1qz5xlayxpa3dk4u8vduwvx0r4f3v2sf0eejpd46), Ethereum (0x5f9ce0dA56c867D1BD06185D6d21744daC83cb09), and USDT Tron (TCgcYUD74LoeMoKRb7X6WcYPVD3VgZccZR). Do NOT send any cryptocurrency to these addresses.

What are the MirrorExp scam wallet addresses?

Known MirrorExp scam wallet addresses include: Bitcoin Primary (bc1qy28j32l0ntncyuqczzeau2k9yslh76djy0nh5v), Ethereum/USDC (0xE28425B27d555f870d3CaCAC4Bf7F549c768022F), and USDT (0xF4eE6d12f95f401BF6b0aB488Ec18E43bfdbeAFC). These wallets are part of a larger criminal operation with connections to a $2.1M exchange consolidation pool.

How does typosquatting work in crypto scams?

Typosquatting is when scammers create usernames nearly identical to trusted admins by changing just one character. Examples: "salmaogs" becomes "sajmaogs" (l→j), or ".atraveller" becomes "_atraveller" (period→underscore). These tiny changes are easy to miss at a glance, allowing scammers to impersonate trusted community members.

How do I report a cryptocurrency scam?

Report cryptocurrency scams to: 1) FBI IC3 at ic3.gov, 2) FTC at reportfraud.ftc.gov, 3) Chainabuse.com and BitcoinAbuse.com to flag wallet addresses, 4) The cryptocurrency exchanges (Binance, Coinbase, etc.) where scammers cash out, 5) Discord Trust & Safety for impersonation accounts, 6) Domain registrars like Namecheap to get scam websites taken down.

How can I identify crypto impersonation scams?

Red flags include: 1) Unsolicited DMs about investment opportunities, 2) Usernames with subtle differences from real admins (check character by character), 3) Pressure to act quickly, 4) Requests to use unfamiliar trading platforms, 5) Promises of guaranteed returns, 6) Requests to send crypto to "verify" your wallet. Always verify identities through official channels.

What should I do if I sent money to a crypto scam?

If you have been scammed: 1) Document everything - save messages, wallet addresses, transaction IDs, 2) Report to FBI IC3 and FTC immediately, 3) Report the wallet addresses to blockchain abuse databases, 4) Contact the exchange where funds were sent (they may be able to freeze accounts), 5) Report impersonation accounts to the platform (Discord, Telegram), 6) Share your experience to warn others.

How much money has been stolen by these crypto scams?

Based on blockchain analysis: OxyCapitals has stolen $40,400+ across Bitcoin, Ethereum, and Tron. MirrorExp has stolen $22,000+ primarily in Bitcoin. TruCopy has stolen $30,869+ across Bitcoin, Solana, and Ethereum. BridgeStocks stole $35,389 in Bitcoin before being taken down. Combined documented losses exceed $150,200 across 6 scam operations. Actual losses are likely higher as many victims do not report and some transactions may not be captured in our analysis.

Are OxyCapitals and MirrorExp related scams?

Both scams use identical methodology: Discord admin impersonation via typosquatting, fake trading platforms, rapid fund extraction to exchanges. While we cannot confirm they are run by the same operators, the operational patterns are strikingly similar, suggesting either the same group or shared scam playbooks within criminal networks.

Active phishing — do not enter secrets

Fake MetaMask

MetaMask “Launchpad” phishing on Vercel

A hosted site impersonates MetaMask and instructs victims to "restore" a wallet and import a seed phrase, keystore, or private key. It was promoted in Discord DMs pretending to be Hyperliquid support. This page documents technical IOCs for takedowns and public awareness — never submit real credentials to test it.

Phishing host (IOCs — report, do not visit casually)

metamask-launchpad.vercel.app

How the scam works

Attackers DM victims using Hyperliquid-themed display names (e.g. "Hyperliquid Server Chat," "Support," etc.).
They invent a deposit or wallet issue and send a link to the fake "MetaMask launchpad" with steps to restore / import a wallet.
The phishing connect.html page uses HTML forms that POST stolen data to a third-party form mailer — not on-chain logic — so victims lose full wallet access immediately.
A separate deposit address may be given in parallel for ETH/USDT; on-chain tracing is separate from the phishing site itself.

Technical IOCs (passive review)

Primary URL: https://metamask-launchpad.vercel.app/ → connect.html (harvest page)
Post-submit redirect: /access/point/barcode-generated.html (fake confirmation; HTTrack mirror comments reference older hosts such as fixuserwallet.vercel.app and dapperconnect.live)
Exfiltration: forms POST to formsubmit.co endpoints tied to throwaway Gmail addresses — report to FormSubmit and Google abuse; do not engage.
Landing page: cloned MetaMask Webflow marketing content; CTAs relabeled as "Restore Account" pointing to the harvester.

Evidence (screenshots)

Discord context and URL embed preview from the investigation archive (click to enlarge).

Fake MetaMask website from 2020 — Fake website — cloned MetaMask page (circa 2020)

Real MetaMask website for comparison — Real website — official MetaMask for comparison

Reporting & takedowns

Vercel — abuse reporting for phishing on vercel.app subdomains.
FormSubmit / email provider — abuse for credential collection endpoints.
Discord — Trust & Safety with user IDs and message links from exports.
MetaMask / Consensys — phishing reports for brand misuse.

What To Do If You've Been Scammed

1. Report to Authorities

• FBI IC3: ic3.gov (Internet Crime Complaint Center)
• FTC: reportfraud.ftc.gov
• Local law enforcement

2. Report Wallet Addresses

• Chainabuse: chainabuse.com
• Bitcoin Abuse: bitcoinabuse.com
• Report to exchanges (Binance, Coinbase, Kraken, etc.)

3. Report the Discord Account

Report the impersonator account to Discord Trust & Safety with screenshots of the conversation and the fake username.

4. Document Everything

Save all messages, transaction records, wallet addresses, and screenshots. This evidence is crucial for any investigation.

5. Warn Others

Share this page to help prevent others from falling victim to this scam.

Related Scam Operations

This scam uses identical methodology to other known operations

OxyCapitals

$54,000+ stolen

View Investigation

MirrorExp

$30,000+ stolen

View Investigation

TruCopy

$30,000+ stolen (8 chains)

View Investigation

BridgeStocks

$35,389 stolen (TAKEN DOWN)

View Investigation

EverrexTrade

Under Investigation

View Investigation

AffluenceAura

$0 stolen (abandoned)

View Investigation

Pattern Match: These scams use Discord impersonation, fake trading platforms, and shared infrastructure. They may be operated by the same criminal network.