Cryptocurrency Is In a New Wild West Phase. Things Are Really, Really Weird

Rick Asstley, as he’s known on Twitter, first learned about a new cryptocurrency called ASS  in mid-April. The 19-year-old college student in Puerto Rico had seen a post featuring the coin’s creator, known online as “Liv,” and liked that she’d spoken directly to the ASS community in a video call—the “transparency” of her showing her face, a rarity among the newest crop of digital tokens, appealed to him. He tuned into the whole GameStop/AMC stock fiasco back in January, which had gotten him interested in crypto. Plus, he said, the coin’s name “sparked joy.” He decided to buy some ASS.

Asstley, who requested to remain pseudonymous due to his holdings, is not a “big money guy,” he said. He bought just $100 worth of ASS (AKA Australian Safe Shepherd), which got him ten billion ASS coins. At that time, the ASS Telegram group had just about 2,000 members. Today, it has nearly 48,000. And as of June 1, Asstley's ASS holdings were worth $10,000, he said. 

“It’s life changing,” Asstley said, but “I haven’t sold a bit. That’s how much I believe in the project.”

While Asstley’s gains are huge for him, they’re modest compared to what some others have made in the DeFi, or decentralized finance, space. Most people have probably heard of Bitcoin and Ethereum, which have chugged along for years now, but 2021 has been the year of DeFi. DeFi can be described as a philosophy, or a movement, but in practice today it means  new tokens like ASS created on the Binance Smart Chain, a blockchain spun up by cryptocurrency exchange Binance that is similar to Ethereum but less mature and with much lower fees. Sending and receiving BSC-based tokens is cheap, and so is creating them. 

John Jefferies, CMO and Chief Financial Analyst at blockchain forensics company CipherTrace, said a transaction that costs the company $30 to execute on Ethereum costs them $3 to do on BSC. This low cost has led to an explosion of new tokens that can best be described as financial shitposts all vying for a critical mass of investors online. There are hundreds of thousands of BSC tokens in the wild right now, many of them with weird, funny, crude, anatomical, or even scatological names.  Founders are often anonymous. There are billions of dollars on the line, and everyone—from token creators, to investors, to hackers, to social media promoters—is trying to cash in. 

When ASS is only the tip of the iceberg, things have gotten truly weird.

A common trait among many DeFi tokens is that they shamelessly promise investors a huge return. They often rely on complex schemes and programmatic tricks in an effort to pump their value; for example, SafeMoon, a DeFi token promoted by popular influencers, levies a tax on sellers and distributes a portion to holders. In the past year, people have become millionaires (at least on paper), or lost it all, as DeFi projects are born, go viral, and crash, in a frothy market spectacular. 

BSC tokens are also relatively easy to make. You don’t need to be an expert blockchain engineer to create the next ASS—take the creator of the SCAM token, who was transparent about having no idea what he was doing when he paid about $400 and clicked a few buttons to mint the coin. In fact, his candor and humor is what attracted people to the coin. SCAM reached a $70 million market cap (the total snapshot value of all tokens in circulation) after launch and sat at $2.5 million in May, finally sinking to $353,428. “No one told you to buy this shit,” the creator, aTikToker who goes by Dre, previously told Motherboard. “It's called SCAM, you stupid motherfucker.”

Many of the people behind DeFi projects simply “clone” established coins, said John Wu, president of Ava Labs, a company supporting the Avalanche blockchain. “Those people cloning are not true [developers] who can make improvements and cut out things…that would devalue a project,” he said, meaning they often create vulnerable contracts that scammers can use to steal funds.

The available statistics on cybercrime in the world of DeFi illustrate how BSC tokens largely exist in a Wild West full of potential dangers. According to CipherTrace’s May 2021 crypto crime report, $156 million was stolen viaDeFi-related hacks so far in 2021. Since the report came out, Jefferies saids, they’ve seen “another $152 million in DeFi hacks,” about 70 percent of which took place on BSC. DeFi attacks and scams have accounted for more than 60 percent of the total “major hack and theft volume” in crypto in 2021, according to CipherTrace, up from 25 percent in 2020. DeFi tokens made up 47 percent of the fraud and misappropriation volume, per the report. Meanwhile, The Block found that “at least $370 million” had been stolen through DeFi attacks over a year and a half due to poorly coded contracts and a lack of auditing.

“It’s been crazy,” said Jefferies. “With all that market capitalization moving towards decentralized finance, that's exactly where the bad guys go.”

“All that market capitalization” is quite a lot. If you look at BSCScan, you’ll find a total of more than 555,500 BSC token contracts. The total value of loans on DeFi platforms on both Ethereum and BSC ("loans," because some tokens ask users to "lock up" funds for a period of time in a bid to increase their value) was around $86 billion in May, according to Reuters—a 650 percent increase from October 2020. 

The market caps of individual tokens can fluctuate significantly. Asstley said that shortly after he bought into ASS, he observed its market cap go from about $1 million to close to $90 million before dropping back down. And it's not slowing down; as of this now, total ASS trading volume in the last 24 hours was higher than $2.5 million.

These high numbers have made for some big individual gains. Asstley said he has a friend in the ASS community who made $100,000 by buying ASS—and promptly lost $20,000 by playing with other “meme coins.” Suley, 32, from The Netherlands (who requested using their first name to protect their financial privacy), told Motherboard via Twitter DM that they initially invested around $500 USD in ASS shortly after its creation. Now, after buying up more ASS, their investment is up to “seven digits.”

“I didn’t sell because I want to see everyone profiting from ASS,” said Suley. “I’m waiting for a billion dollar market cap.”

It’s not only coin creators and buyers who stand to profit in DeFi. Projects thrive or die based on how many investors they can rope in, and so coin promoters have been making bank, too, for posting incessantly about various projects on social platforms like Twitter, TikTok, and Twitch. The projects’ creators pay them to do so. As TikTok coin promoter Pablo Heman told Bloomberg, creators pay him between $5,000 and $10,000 to shill their coins. 

A promoter with the Twitter handle @OfficialTravlad told Motherboard via DM that they charge between 1.8 Binance Coin (currently $732 USD) for three social posts and 14 Binance Coin (now $5,698) for a month of daily posts.

“I can do token descriptions, highlight milestones such as holder count, exchange listings, developments and so on,” they wrote to Motherboard. 

Investors also participate in significant promotional efforts. In May, a massive Times Square billboard featured SafeMoon. A SafeMoon buyer had started a GoFundMe campaign to pay for it and together, SafeMoon investors raised more than $16,000.

Shared investment in these brand new coins tends to foster community among those who buy in. One SafeMoon holder, Lina Moon on Twitter, told Motherboard, “I decided to do my part and spread positivity, debunk fud [fear, uncertainty, doubt], hype up the community, and post daily updates so that the holders hodl and others can also understand the project.” Asstley said he’s made “a lot of friends” through the ASS Telegram group.

For all the gains—in both currency and friendship—there are many perils in the DeFi space, particularly in the newer world of BSC tokens. 

Scammers can take advantage of vulnerabilities built into poorly coded smart contracts, said Ava Labs’ Wu. Or, if they’re more skilled, said Jefferies, create their own smart contracts with malicious “backdoors” that facilitate future scamming. This is compounded by the fact that many DeFi projects have complex mechanisms including lockups and loans. 

Flash loan attacks, in which hackers exploit contracts where holders lend out funds without collateral because they expect their returns to happen instantly, are a recurring problem. A flash loan attack caused BSC project Pancake Bunny’s token price to drop by 95 percent in May. The hackers walked away with about $45 million. Soon after, another BSC project, BugerSwap, succumbed to a flash loan attack in which hackers stole around $7 million.

Because BSC is relatively new to the DeFi space, it’s even less self-regulated than Ethereum, where community members have placed restrictions on which projects can move forward. In BSC, said Wu, restrictions have been “more lax.” 

There are only a few companies that perform DeFi audits. They include Quantstamp and OpenZeppelin, and they can get overwhelmed by the sheer flood of activity. “[They] simply can't keep up,” said Jefferies. Even when these companies perform audits, they don’t always catch every vulnerability. “Some of these hacks that we've seen have actually been audited,” he added.

This lack of serious oversight has also fostered a playground for "whales"—those with mass amounts of crypto (or fiat money) who can buy, essentially, a controlling amount of a new token after it launches, giving them what Wu calls “disproportionate control over the system" if they choose to sell, for example.

Then there is the ubiquitous threat of “rug pull” scams, where developers of a coin promote it until a bunch of people buy in, and then, when the price is high, take out a vast majority of the asset’s backing, or its liquidity pool. Though they’re not stealing directly from holders, they’re removing what makes their assets liquid, leaving holders with basically useless coins.

Other scams focus on impersonation. Several years ago, when Ethereum dominated the budding DeFi space, token creators would get up on stage to evangelize on behalf of their new coins (usually to promote their ICOs—initial coin offerings—of which many have since become rightly skeptical). Now, it’s common for those involved in DeFi projects to remain anonymous, or go purely by their online personas. This can lead to potentially dangerous pitfalls. When I messaged with “Chef Hops,” a member of decentralized exchange PancakeSwap’s anonymous team, on Telegram, I came across two other very similar handles that could have easily been mistaken for theirs (one just included an extra “s”).

“Unfortunately Telegram is ripe with scammers mimicking peoples’ accounts in order to try and rip-off slightly more naïve (or new) people,” Chef Hops wrote to Motherboard. They say scammers will directly message people looking for “help or guidance” and “pose as power figures” (such as Telegram group admins, like Hops). From there, they’ll ask for the person’s private keys or pass phrases, which give the impersonator access to that person’s crypto.

Asstley got scammed when someone impersonated him to claim a 250 billion ASS coin giveaway. The scammer “literally had the exact Twitter handle as mine,” said Asstley, “but he changed the ‘L’ I have in my name to an uppercase letter ‘I.’” (Lucky for Asstley, the person in charge of the giveaway still gave him his winnings.)

In spite of all the scams, inept coders, and lack of audits, those involved in DeFi are holding out hope for a more stable future. 

“DeFi is a great petri dish of genius, experimentation, and scams all rolled up in one,” said Wu. “Ultimately, in five to 10 years, it will replace a lot of traditional finance and will make financial services and products…more accessible.”

In the meantime, ASS holders like Asstley and Suley are waiting for that $1 billion market cap before pulling their ASS out of the market.