I just had 10,000 ADA stolen from a Yoroi wallet while I was trying to get support from TosiDrop via their Telegram; I had staked that sum of ADA as part of Ardana’s ISPO and was trying to claim DANA tokens via TosiDrop, but the tokens didn’t appear in my wallet. Apparently, scammers monitor the chats. One such contacted me pretending to be a TosiDrop support rep. He sent me a link to enter my wallet seed phrase. I refused and ended the call. But a minute later the rep called back and persuaded me to continue. Against my better judgement, I did. Ugh. My main holding is in a hardware wallet, so it’s still safe.
I removed the link from your post, since our policy is to never show those links in this forum, because people could be lured there (even with the warnings around) and it could boost them in search engine algorithms.
This is not specific to TosiDrop or to Telegram. It will happen to you in any cryptocurrency channel on any platform (although Telegram is particularly bad in preventing impostors).
That’s why the display names and welcome messages have “Won’t DM!” plastered all over them.
Next time, the scam website linked to will be a totally different one. So, it makes limited sense to warn against one specific example. The general warning is: “Don’t put your seed phrase on any website given to you!” It’s not needed for resolving any issues.
(Exception maybe widely known web wallets like adalite.io, which we do advise to try sometimes to see if it is only a problem with one specific wallet app. But it’s always done in open channels. It’s always an alternative to use any other reputable wallet app of the user’s choice. And it’s always good to be cautious and search if others were given the same advice, if it was called out, …)
Sorry that this happened to you!
Thing is, the Scammer tried to get me to send my hardware wallet seed phrase too, saying it was connected to the issue. I almost did. Good thing there are so many words in the seed phrase. Half way through I came to my senses, told the scammer I didn’t have the phrase, thanked him for making his best effort to resolve my issue, and ended the session.
Now what I’m wondering: this particular scammer knows I have a hardware wallet. Are there any instances of these scumbags doing home invasions? Obviously, that would put them at a level of personal risk they aren’t facing doing thefts remotely, but if they think the payoff is worth it …
Never heard of something like that. And if they just found you randomly in the TosiDrop Telegram, a targeted attack at you personally is even more unlikely.
They might have just guessed? Or you shared a screenshot, where they could read a wallet name like “Ledger” or “Trezor”?
No, I didn’t share a screenshot. I told the scammer most of my ADA wasn’t in the Yoroi wallet staked to the stake pool participating in the Ardana token drop.