Deployer address
bBDMV7zzwiW7uQU53FYBNjiK9bsK3McPzkwb6yJ57XE
BL1hs3jw58d1S9xw7cKRUx9wXY94se9Ydt7bCgN1W3pL

Update: Another two X accounts fell victim to the same phishing email by the same scammer as the address which deployed tokens was funded by the other ATOs

Accounts:
BasementRon (UFD) & Kyle Mann (Babylon Bee EIC)

Update: Yat Siu (co-founder of Animoca) likely fell for the same phishing email a few hours ago as the scam token was deployed by the same address as the Kick & Vanar CEO ATOs

Deployer address
BL1hs3jw58d1S9xw7cKRUx9wXY94se9Ydt7bCgN1W3pL

>send fake copyright infringement email
>create a sense of urgency
>trick user into visiting phishing site and resetting 2FA/password

Makes sure to limit email address reuse between services as well as using security keys for 2FA on important accounts whenever possible.

3/3 An example of a phishing email received by X users can be seen below and the emails all follow the same script:

2/3 Each of the 15 ATOs were directly connected by mapping out the deployer address for each scam.

The attacker bridged back and forth between Solana and Ethereum in an attempt to obfuscate the funding source.