Connect with us
DAPA Banner

Crypto World

GitHub phishing scam uses OpenClaw branding to lure developers into wallet drain: report

Published

on

GitHub phishing scam uses OpenClaw branding to lure developers into wallet drain: report

Crypto scammers are using OpenClaw’s popularity to target developers via a new GitHub phishing campaign designed to drain their crypto wallets.

Summary

  • Attackers are impersonating OpenClaw on GitHub, creating fake accounts and tagging developers with messages offering $5,000 in $CLAW tokens.
  • Victims are directed to a cloned website where a malicious wallet connection prompt is used to trigger wallet draining.
  • OX Security says the campaign uses obfuscated code and targeted tactics, though no confirmed victims have been reported so far.

A report published by platform OX Security detailed an active phishing campaign targeting OpenClaw via a coordinated effort on GitHub, where attackers create fake accounts, open issue threads in attacker-controlled repositories, and tag dozens of developers.

One such post detailed how developers were approached with messages claiming they had been selected for an OpenClaw allocation, telling them they had won $5,000 worth of $CLAW tokens, and subsequently directing them to a fake website that closely resembles openclaw.ai.

Advertisement

On the website, victims are presented with the option of connecting their wallets through a malicious “Connect your wallet” prompt that eventually leads to wallet draining.

The campaign has surfaced as OpenClaw has become a more visible project, especially after OpenAI CEO Sam Altman announced that OpenClaw creator Peter Steinberger would lead its push into personal AI agents. OpenClaw has since transitioned into a foundation-run open source project.

Researchers at OX Security said attackers may be using GitHub’s star feature to identify users who have starred OpenClaw-related repositories, thereby making it appear more targeted and credible.

Advertisement

Scammers were seen using a file named “eleven.js” to embed wallet-stealing code within obfuscated JavaScript. Once triggered, scammers used a built-in “nuke” function that wipes traces from the browser’s local storage to avoid detection and continue tracking activity.

The malware tracks user actions via commands such as PromptTx, Approved, and Declined, sending encoded data, including wallet addresses and transaction values, to a command and control server.

Researchers have identified at least one wallet address believed to be linked to the attackers that was used to receive stolen funds. So far, there has been no confirmation of victims.

OX Security has urged users to block token-claw[.]xyz and watery-compost[.]today, and avoid connecting crypto wallets to newly surfaced or unverified sites.

Advertisement

In the meantime, OpenClaw creator Peter Steinberger has enforced a strict anti-crypto policy. Any mention of cryptocurrencies across the project’s Discord server can lead to removal.

The decision stems from a scam that surfaced during its rebrand, where attackers promoted a Solana-based token called $CLAWD that surged to approximately $16 million in market capitalization before falling over 90% after Steinberger denied any involvement.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

OP_NET Launches “SlowFi” DeFi Stack Directly on Bitcoin L1

Published

on

OP_NET Launches “SlowFi” DeFi Stack Directly on Bitcoin L1

OP_NET said it is launching a “SlowFi” decentralized finance (DeFi) stack on Bitcoin that uses standard Bitcoin transactions and native BTC fees rather than bridges, wrapped assets or a separate gas token.

According to a Thursday release shared with Cointelegraph, the project is part of a broader push to bring trading and yield-style activity directly onto Bitcoin’s base layer instead of routing it through sidechains, bridges or adjacent networks. OP_NET is betting some users will accept slower and more expensive transactions in exchange for staying fully on Bitcoin.

According to OP_NET co-founder Frederic Fosco, who goes by Danny Plainview, applications run through standard Bitcoin (BTC) transactions using Taproot-based spends, while the platform’s NativeSwap model is designed to support token swaps without wrapped BTC or a separate gas asset. Plainview told Cointelegraph that every transaction on OP_NET is “just a Bitcoin transaction with BTC as the only gas asset.”

The launch lands in the middle of a growing fight inside Bitcoin over whether DeFi-style and data-heavy uses of block space strengthen the network’s fee market or amount to spam that crowds out monetary transactions.

Advertisement

Plainview said a swap would typically cost about $1 to $2 under normal fee conditions and roughly $10 to $20 when blocks are congested, because users pay only standard Bitcoin network fees rather than a separate gas token.

OP_NET cofounder Frederic Fosco, AKA Danny Plainview. Source: OP_NET

OP_NET describes the model as “SlowFi,” arguing that Bitcoin’s roughly 10-minute block times and congestion-driven exit friction can make liquidity stickier and produce longer-lived DeFi cycles than faster chains.

Related: Fireblocks to integrate Stacks for institutional-grade Bitcoin DeFi

Critics say OP_NET brings Ethereum-style DeFi bloat

Plainview framed layer-1 DeFi as a way to support miner revenue as block subsidies decline, arguing that “miners are bleeding” due to Bitcoin’s halving schedule. “The only thing that keeps miners solvent is a fee market,” he said, insisting that OP_NET does not modify Bitcoin consensus.

Related: Animoca, RootstockLabs partner to bring Bitcoin DeFi to Japanese institutions

Advertisement

That view has drawn criticism from Bitcoin users who argue that pushing DeFi-style activity onto layer 1 dilutes Bitcoin’s monetary focus or clogs block space with nonessential transactions. In recent posts on X, some critics described OP_NET as an attempt to bring Ethereum-style crypto infrastructure onto Bitcoin.

Some maximalists argued that any attempt to expand Bitcoin’s use cases beyond money made its proponents “sh*tcoiners” larping as Bitcoiners.

BIP 110 proponents argue against OP_NET. Source: Justin Bechler

Plainview pushed back, saying that any fee-paying Taproot transaction should be treated as a legitimate use of block space.

He warned that drawing moral lines around valid transactions handed de facto control of Bitcoin to whoever defines those categories. He said:

“The whole point is that nobody controls it.”

OP_NET keeps DeFi on Bitcoin base layer

OP_NET enters a field already populated by earlier attempts to bring programmability to Bitcoin, including through RSK and Stacks. 

Advertisement

RSK operates as a separate Ethereum Virtual Machine-compatible sidechain with its own RBTC gas token and a federated BTC peg, meaning users move value off mainnet and trust a federation to manage the bridge. 

Stacks, by contrast, is a Bitcoin-anchored layer-2 with its own STX token and sBTC mechanism, executing smart contracts on a distinct chain that settles periodically to Bitcoin rather than inside L1 transactions.

By keeping execution and fees directly on Bitcoin and avoiding wrapped BTC or new gas assets, Plainview is betting that some users will accept slower, more expensive transactions in exchange for staying entirely on Bitcoin’s base layer.

Magazine: Bitcoin may take 7 years to upgrade to post-quantum — BIP-360 co-author

Advertisement