pricebagcrypt

What this scam pattern is

An attacker utilized fraudulent Telegram channels (@PriceBagCrypt, @juluobtc) to lure the victim into a fake crypto investment scheme. The victim was directed to set up a Web3 wallet and connect it to a malicious decentralized exchange platform operating at [hxxps://dexorbit[.]app/#](hxxps://dexorbit[.]app/#). Upon interacting with the connection prompt on the fake interface, a malicious wallet drainer script executed an unauthorized transaction, completely draining the victim's wallet balance. Following the theft, the perpetrator attempted further extortion by demanding additional deposits, claiming a higher minimum balance was required to reconnect the wallet and recover the funds. 1. Incident & Initial Breach Details Stolen Asset & Volume: Total reported loss of 32.8 SOL (Primary tracked tranche: 25.853047836 SOL). Malicious Infrastructure & Profiles: Fraudulent Website: [hxxps://dexorbit[.]app/#](hxxps://dexorbit[.]app/#) Suspect Telegram Accounts: @PriceBagCrypt, @juluobtc Unauthorized Theft Transaction: Tx Hash: 2eyrUYUqnwC6wbHV5SXjdavEXz8Hvj7cg4rqyP4F8gju7G4tJ4DLThcwdrB4ZFBmzaUTjdA5AJ3irAbcXwZXM6yi Primary Attacker Receiver Wallet: Address: GrRg782WVCsDLsXZygjmBAcdWiDCW1B63YdpTFX5mYXp 2. Comprehensive On-Chain Trace & Hop Analysis (Solana Network) On-chain forensic reconstruction reveals a multi-hop obfuscation path designed to disguise the origin of the stolen assets before off-ramping: Hop 1 — Mixer & Dispenser Injection: Immediately following the drain event, the stolen funds were transferred from the primary receiver wallet (GrRg782WVCs...) into a central mixer and dispenser pool to sever direct visual links on the ledger: Dispenser Address: FgKd74wgyR2y3nnXJLPTEBpnDDrrKcYAibkMNb1fVCBY Hop 2 — Sub-Wallet Splitting & Consolidation: The assets were subsequently split across intermediate sub-wallets. The victim's specific tranche was isolated, consolidated, and prepared for transfer: Intermediate Sub-Wallet (Hop 1): 6jD8hU5VuosMrP434wGVugNhhjpSVSqCrTB9tC9k9NRM (Isolated Tranche: 25.853047836 SOL, accounting for minor transaction/network fees) Deposit Conduit Wallet (Hop 2): 97SSUsoZRVrs5pU7VTBX4SedHLjGAWFqekJ5cDgFwEj9 Hop 3 — Centralized Exchange Off-Ramp Deposit: From the conduit address (97SSUsoZRVrs...), the isolated tranche of 25.853047836 SOL was transferred in a single direct transaction into a hot wallet belonging to a centralized cryptocurrency exchange: Deposit Source Address: 97SSUsoZRVrs5pU7VTBX4SedHLjGAWFqekJ5cDgFwEj9 Destination Hot Wallet: BmFdp 3. Status & Regulatory Roadmap All transaction steps have been independently verified and indexed on the Solana blockchain ledger. Because the stolen assets were transferred directly into a centralized exchange deposit infrastructure, verifiable account identity records (KYC, IP logs, linked withdrawal routes) exist for the receiving account. The complete evidence package has been formatted for law enforcement submission to facilitate formal legal requests, account freezes, and subpoena procedures through official law enforcement channels.

How it approaches people

Fake Trading Groups Deposits or phishes with fake exchange sites for seed phrases.

What it asks for

Deposits or phishes with fake exchange sites for seed phrases. Fake Trading Groups Crypto Portfolio - Min 10k to start

Platforms and payment methods involved

Platforms: Telegram

Payment methods: Crypto, ETH, SOL

Personas and aliases used

Invented company, broker or profile names reported in connection with this pattern.

How to recognise it

• juluobtc
• PriceBagCrypt
• Vaultashley

If you already paid

Victims of Web3 drainer scams should immediately abandon the compromised wallet and refrain from sending any additional funds or attempting reconnection. All further communication with the scammer should be cut off, while full chat logs and transaction hashes should be saved for law enforcement filings. To prevent future attacks, users should install wallet simulation tools like Pocket Universe or Blowfish and avoid connecting funds to unverified platforms encountered via private messaging.

• Stop all payments and contact. Do not send a "release fee", tax or withdrawal charge — that is how the loss grows.
• Call your bank or card issuer straight away and ask about a recall or chargeback. For bank transfers, the first 72 hours matter most.
• Keep every message, receipt, wallet address and profile link. Screenshots with dates help the police and your bank.
• Report it to the police and, if the money went through a platform, to that platform. How to report a scam.
• Never pay anyone who promises to recover lost money — see recovery scams.

What we hold

Wallet and payment indicators, channel and group identifiers, handles used in the scam, and the reporter's material held privately.

Verification

Last verified by the Fraudpol team on Sep 29, 2026. Entries not re-verified within 180 days are removed automatically.

Domains in this campaign

• dexorbit[.]appOfflineThreat page