MoonPay execs allegedly duped in $250K crypto fraud

Two top executives of MoonPay, a major cryptocurrency payments company, reportedly became victims of an elaborate online fraud that led to them losing $250,300, a recent filing with the US Department of Justice (DOJ) reads.

The filing, filed to recover 40,350 USDT (a stablecoin pegged to the value of the US dollar) that crypto company Tether is currently holding in frozen accounts, refers to the victims only as “Ivan” and “Mouna.” But coverage from crypto outlet NOTUS suggests they are Ivan Soto-Wright, co-founder and chief executive of MoonPay, and Mouna Ammari Siala, the company’s chief financial officer.

The DOJ says that the two executives were scammed into moving funds to an account controlled by an individual they believed was Steve Witkoff, a high-profile US real estate developer and co-chair of President Donald Trump’s 2017 inaugural committee.

Blockchain data analysis indicates that the USDT was transferred to a wallet associated with Binance. The wallet is associated with Ehiremen Aigbokhan, a Nigerian citizen residing in Lagos.

The episode represents an unusual public case in which senior industry players, who had access to advanced crypto tools and security protocols, proved to be as susceptible to what investigators call a fairly simple form of social engineering as the average rank-and-file email user.

Scammer employed ‘insulting typo’ to imitate a public figure

Unlike other crypto-crimes that rely on hacking or exploiting blockchain vulnerabilities (and perhaps for that reason alone), this scam was executed through deception through discreet email manipulation.

The scammers employed bogus email addresses nearly identical to correct ones — substituting a capital “I” for a lowercase “l” in domain names — to deceive their targets. In this situation, emails were sent from steve_witkoff@t47lnaugural.com and financersvp@t47lnaugural.com — addresses spoofing the names of well-known people and events.

This practice, called typosquatting, is used frequently in phishing scams and has proven effective at scamming even professionals who are security aware.

“IP geolocation data consistently showed emails from these accounts originating from Nigeria, and not the United States,” the DOJ filing says. According to the authorities, Aigbokhan likely obtained the USDT due to a scam involving an international money transfer in the US.

The con artists didn’t have to hack into or exploit the blockchain in any way; they only needed a ruse and a convincing pitch to steal the funds.

Wallet activity raises further doubts about MoonPay

The filing noted that one of the wallets involved in the scam is a marked MoonPay wallet on Etherscan, suggesting that the individuals affected are likely Ivan Soto-Wright and Mouna Ammari Siala.

As of press time, MoonPay has not yet publicly replied to requests for comment from multiple outlets, including The Block and NOTUS.

The timing of the case is particularly delicate. And in the latest expansion, MoonPay, a popular payment infrastructure for cryptocurrency purchases, made its services available in only a few US states. Still, last month, the NYDFS granted it a BitLicense, which has the consequence of allowing the company to operate in all 50 United States. It is one of the most difficult-to-obtain crypto regulatory licenses in the US and vital for doing business in the financial capital.

The incident may raise additional questions about MoonPay’s internal security controls, vetting processes, and executive oversight, particularly if the victims in this case had indeed used the official company wallets to conduct what seem to be personal or poorly vetted transactions.

Amid the boom in crypto adoption, the case is a sobering reminder that no one is immune to digital fraud, not even the executives of companies that help build the infrastructure of the crypto economy.