On Sunday mid-morning, someone reached out to me on Telegram introducing himself as James Roger from ZK Prime Capital. The name rang a bell. I have been posting about my product across a few places recently, and ZK is shorthand for zero-knowledge proofs. I'm building CELLO, a security and trust layer for agent-to-agent communication and collaboration. It is not a blockchain project, but it makes heavy use of cryptographic techniques refined by blockchain engineers. Having a crypto-AI fund reach out made complete logical sense. He asked me to tell him about what I was building. I gave him a short summary. Then he started asking sharp, specific questions about the cryptography, why the approach was innovative, and even how we handle FROST ceremonies. He asked if it was just theory or if we were working on something real. I told him it was a ready-made product, that we had opened it up a few days ago, and that I was currently reaching out to my network to get the first 50 to 100 testers so I could find the 10 people who really love it. He replied: "Smart. Do things that don't scale. Mine your network." I felt like I was killing it. I knew my product inside out, I knew how I was going to grow it, and he was asking the exact questions a VC partner would ask. Then he said we should get on a call with the other partners and sent a legitimate Google Calendar booking link. I picked a slot two hours later and sent him a screenshot. He replied that there had probably been a mistake and Sunday slots shouldn't be open, and asked if I could cancel and move it to Monday. At the time, that seemed like a reasonable request. In retrospect, it is odd that a VC firm booking calls all the time would make that mistake. I rebooked for Monday and got a standard Google Calendar invite. Right after booking, I went and told my wife I had a little bit of good news. Nothing fantastic, just that I had a bite and someone recognized the value of my work. Mentally, I was skipping around happy. A little while later, a reminder came through on Telegram to make sure I signed the NDA included in the calendar invite before Monday's call. I found that odd. Normally VCs don't want to sign an NDA and they don't make you sign one. When I asked him about it, he said the NDA was simply an agreement not to record the conversation or share the discussion contents outside my organization. I could see his point, though it still felt unusual. He also sent a link to a legitimate Google Sheet, supposedly a list of the companies they had invested in. All the tabs were locked. Off to the side was a Google warning claiming my app was out of date, that it couldn't complete OAuth to unlock the sheet, and that I needed to download an updater. Being a technical founder, my brain started registering anomalies. This is a web app. OAuth is handled by the browser and has nothing to do with downloading a local updater. I took a screenshot, threw it into my AI agent, and discussed it. As I suspected, it was malware phishing. After talking it through with my agent, I downloaded the file into a safe sandbox and had my AI analyze it. It was a compiled AppleScript dropper designed to deploy a macOS Keychain and wallet stealer. Had I run it on my machine, it would have tried to extract every password, access key, and crypto key it could find. We reverse-engineered the dropper, extracted their hardcoded infrastructure and fallback mechanisms, and filed formal abuse and takedown reports across all five layers of their operation: The Google Sheets lure document Their primary payload and exfiltration domain via the Alibaba Cloud registrar Their hardcoded fallback command-and-control server via its hosting ISP Their Dropbox fallback binary payload The hardcoded Telegram bot used for credential exfiltration Honestly, burning their accounts probably only inconvenienced them slightly. My guess is they have plenty of these set up. The harder part came afterward. I am not some naive vibe-coder. I am a seasoned professional, and my product is literally designed to be a security and trust layer to defend against attacks. Yet I went as far as I did despite red flags all along the way. Why? Because I let them prey on my hope. When you are a solo founder trying to move quickly and show that you take immediate action, you are in a vulnerable state. I was angry at these guys who waste their lives doing this to people, and angry at myself. I had to tell my wife that I was actually just being scammed, which felt pretty embarrassing. I thought burning their infrastructure would make me feel better. It didn't. It took me down lower than my starting point and left me in a foul mood for most of Sunday. Not much else to say. It was a shitty experience, though it could have been much worse. Back on the job today. -Anders
CryptoAlerta — análise de criptomoedas e mercado em tempo real