The loyalty bonus trap
A Pastebin comment promised higher swap payouts. The userscript changed the wallet address and showed a fake bonus.
See the Pastebin lure
How a fake bonus steals your crypto.
A real campaign promised 25% extra on a crypto swap. It asked people to install a browser script that quietly changed who got paid.
Inspect the example01 The fake bonus screen
The bait
A Pastebin comment claims to have found a way to get extra crypto on a swap.
The install
It tells you to paste code into Tampermonkey, a browser extension that can run scripts and change web pages.
The wallet swap
The code replaces the exchange’s deposit address with one the attacker controls. Your payment goes wherever that address points.
Script workbench
Paste a script or scan our reconstruction to see which lines can change a payment.
Scans stay on this device
Pasted code stays here.
Follow the payment
Compare an independently verified recipient with the address found in the code.
Solana devnet
Demo baseline
Use a wallet address verified outside the script.
Source evidence
Both previews use 0.01 SOL. Devnet receives unsigned transfer messages, and nothing is broadcast.
The scam files
Four documented attacks. Each file pairs the original evidence with a safe example to scan.
The free Solana sniper
A fake trading tool used inflated social proof to spread a desktop program that replaced wallet addresses on the clipboard.
The AI arbitrage bot
A tutorial sent viewers to a fake Solidity compiler. It deployed different bytecode that forwarded their ETH.
The wallet “security check”
A fake Ledger app prompted users to verify their recovery phrases and sent the entered words to an attacker.