4. The Great Migration

Then cryptocurrency arrived.

For two decades the economics of open communities had a comfortable ceiling. The worst a spammer could do to you in the room was waste your attention. A flood of pill ads, a bot dumping links into a Linux support room, a forum thread choked with affiliate garbage — all of it annoying, none of it expensive. Real theft existed across these same decades — banking trojans and phishing were draining accounts the whole time — but it operated through email and the browser, against a banking system that could reverse a fraudulent transfer, and it was never the open community's problem to solve; the room was a lure, not a till. The defenders we met in the last chapter built their entire toolset against that ceiling. CAPTCHAs, rate limits, keyword filters, shared banlists: instruments tuned to suppress noise. They worked, more or less, because the people on the other side were playing for fractions of a cent per impression. When the reward for getting through is that small, even a clumsy gate keeps most of the attackers out. The math protected us, and we mistook the math for the defense.

Crypto broke the math. Not because the technology was new — message boards had hosted scams since the first stock-pumping spam hit Usenet — but because for the first time the thing being discussed in the room was crypto itself, sitting in wallets that the people in the room controlled directly, transferable in seconds, irreversible, and pseudonymous on both ends. The conversation and the asset collapsed into the same space. You did not read about an investment in a community and then go log into a brokerage with a username, a password, two-factor, fraud monitoring, and a phone number a human could call. You read about it, clicked a link in the same chat window, signed a transaction, and the crypto was gone or made before you finished your coffee. The distance between persuasion and loss went to zero.

Here is what that collapse looks like at human scale. The scene is a composite, but only barely — it has happened, in some variation, in every large crypto community I have watched, and on bad nights in several of them at once. A member posts a question in a project's public group at eleven at night. His staking transaction has been pending for an hour and he is frightened, because the crypto in that transaction is not something he can afford to lose. Forty seconds later his phone buzzes with a direct message. The name on it is the name of the admin he has watched answer questions all week. The photo is the admin's photo. Saw your message in the group — happy to help. Known issue with the bridge tonight. The relief is physical. The "admin" is patient, fluent in the project's jargon, mildly apologetic on the project's behalf. He walks the member through a "resync" on a support portal whose URL looks almost right, which asks him to connect his wallet, and then — purely as a formality, the admin assures him, the portal never stores it — to validate his recovery phrase. At every hesitation there is a calm, reasonable sentence waiting. Eleven minutes after asking for help, his wallet is empty. The real admin is asleep. The account that drained him was registered that afternoon and will not exist by morning. Now run the same night in the pre-crypto world. The same impostor, the same fake authority, the same credulous trust — and the worst outcome is far smaller and, crucially, reversible. The most that impostor could reach for was a password or a bank login ringed by fraud monitoring and chargebacks, with nothing transferable sitting in the room itself; even a successful theft could often be clawed back by morning. Same room, same lie, same victim. The only thing that changed is what the room was worth — and whether the loss was final.

That is the whole story of this part of the book, and it is worth stating plainly before we get into how it played out: when value moves into the room, spam stops being a nuisance and becomes a business. The same channel that used to carry penny-fraction ad impressions now carries five-, six-, and seven-figure thefts. Everything downstream — the AI, the synthetic communities, the deepfake Zoom calls, the drainer-as-a-service marketplaces we will spend the rest of the book dissecting — is a rational response to that one change in the payoff. Raise the prize and you summon professionals. We raised the prize by several orders of magnitude, and the professionals came.

Why here

It is fair to ask why this concentrated where it did. Crypto communities could have lived anywhere. They could have stayed on the forums and the subreddits and the Discord servers where plenty of them started. Some did. But the center of gravity moved, and by the time the bull markets of the early 2020s were in full swing the default venue for a token launch, a trading group, an alpha channel, or a project's official announcements was a Telegram channel and its attached group. To understand the threat model that follows, you have to understand why the crowd ended up here, because the same properties that drew the crowd are the properties the attackers exploit.

Start with broadcast at scale. A channel can hold an unbounded audience and push a message to all of it instantly, with no algorithmic gatekeeper deciding who sees what. For a project that wants to reach a hundred thousand holders the moment it has something to say, that is close to ideal. There is no feed ranking to fight, no shadow-ban to fear, no engagement penalty for posting a contract address. The platform's indifference to content is a feature when you are the one broadcasting. It is also, of course, indifferent to whether the thing being broadcast is a real announcement or a fake one.

Add the bot platform. The programmable bot API turned a chat room into an application runtime. You could bolt a price tracker, a wallet, a trading interface, a raffle, a token gate, or an entire decentralized exchange front-end directly into the conversation. The line between "place where people talk about the asset" and "place where people transact the asset" dissolved. By the time of the TON-era Mini Apps, the room itself had become a browser. A community was no longer a discussion forum sitting next to the financial infrastructure; it was the financial infrastructure, with a chat overlay. This is the single most important structural fact in this chapter: the venue where you are persuaded is the venue where you transact.

Add pseudonymity that maps cleanly onto crypto's own values. The culture that grew up around these assets prized handles over names, wallets over bank accounts, exit over recourse. A platform where your identity was a username and a phone number you could acquire cheaply and discard freely fit that culture perfectly. Nobody in a degen trading channel wanted to upload a passport to chat. The frictionlessness was the point. So the communities sorted themselves toward the venue with the least identity friction — which is to say, toward the venue with the weakest possible answer to the question this book keeps asking: who is this person, really?

And add reach into the parts of the world where crypto adoption was highest and traditional finance thinnest — large, active user bases across Eastern Europe, the Middle East, South and Southeast Asia, Latin America. The platform was where the users already were. Networks concentrate; communities go where the people are, and the people were here.

There is a self-reinforcing loop hiding in that last point. Communities accreted here because other communities were already here: every project a founder admired had a channel, the tooling assumed one, the audience would have had to be dragged elsewhere. More communities justified more tooling, which drew more communities, until the concentration became a fact of nature in the space — if you were in crypto, you were here. And so, inevitably, were the people who hunted crypto users, because predators go where the prey is densest, and the same gravity that gathered the communities gathered their hunters into the same room. Concentration of value is concentration of target.

None of these properties is unique in isolation. Discord has bots and communities. WhatsApp has reach and broadcast. X has pseudonymity and scale. What made this particular venue the epicenter was the combination — unbounded broadcast, a transaction-grade bot runtime, near-zero identity friction, and a user base already saturated with the exact population crypto wanted to reach — arriving all at once, at the moment the crypto got real. That is the setting, not the subject. The subject is what happens to an open community when the value in the room exceeds the cost of faking your way into it. The answer is universal. It just happened here first and worst.

It is worth lingering on the runtime point, because it is the one that most often gets waved away as a convenience when it is actually the foundation. On a traditional forum, even one full of scams, there was always a seam between talk and action. You read a recommendation in a thread; you went somewhere else to act on it; you logged into an exchange or a wallet that lived behind its own front door. That seam was a defensive feature nobody designed on purpose. It introduced a pause, a context switch, a moment in which the spell of the persuasive message could break. The programmable in-chat application erased the seam. When the wallet, the exchange interface, the token gate, and the "support portal" all live inside the same conversation as the pitch, the victim never leaves the persuasive context to take the consequential action. The hand that is being shaken is the hand that picks the pocket, and it never lets go long enough for you to notice. Every fraud in the coming chapters is built on that erased seam.

The threat model inverts

Let me be precise about what changed, because "the stakes went up" is too vague to be useful. The shift was not merely quantitative. The entire shape of the attack inverted.

In the pre-crypto era, the spammer's relationship to the room was parasitic but external. The spammer wanted nothing from any specific person in the room. The room was a billboard. Blast the message to ten thousand people, convert a handful at a fraction of a cent each, move on. The attacker did not care who you were. You were an impression. The defense, accordingly, was about volume: detect the blast, throttle the blast, ban the blaster. Identity barely entered into it, because the attacker was not impersonating anyone — he was just shouting, and you could measure shouting.

In the crypto era, the attacker wants something from a specific person: the contents of a specific wallet. The room is no longer a billboard; it is a hunting ground, and the prey is individuated. This changes everything about the attacker's behavior. Volume is still useful — you still want to be in front of as many marks as possible — but the conversion event is now worth thousands of dollars instead of a fraction of a cent, which means it is suddenly worth enormous effort to engineer that single conversion. It becomes economically rational to study a target, to build rapport over days, to impersonate someone the target trusts, to construct an entire fake context around the moment of theft. The attacker can afford patience because the payoff justifies it. And patience defeats volume-based defenses completely, because nothing about a slow, personalized, one-to-one approach looks like a flood.

Here is the same point in the language we have been using since Chapter 1. In the pre-crypto era, the attack was an action: posting. You could see the action and you could rate-limit the action. In the crypto era, the attack is a relationship: a false one, built on a false claim about identity. The admin of this channel. A support agent for this wallet. The project's founder, DMing you with an opportunity. A fellow holder who happens to have inside information. Your friend, whose account got taken over an hour ago. The payload is no longer a link in a public channel that a filter can catch. The payload is a claim about who someone is, delivered in a private message or a convincingly staged group, and there is no filter for trust.

This is where identity-cheapness stops being a UX convenience and becomes a weapon. We spent the last two chapters establishing that on an open platform, identities are effectively free: a username costs nothing, a display name can be set to anything, a profile photo can be lifted from the real person in seconds, accounts can be aged or purchased in bulk. In the pre-crypto era, that cheapness was almost irrelevant to the attack, because the attacker was not pretending to be anyone in particular. In the crypto era, identity-cheapness is the attack surface. Every con in the catalog we are about to build rests on the same primitive: one actor wearing a face that does not belong to them, at a cost so close to zero that they can wear a thousand faces and discard each one the instant it burns.

The simplest version is the one this chapter opened with, and every crypto user has now seen it a hundred times: the question asked in public, the instant helpful DM from a copied name and a copied photo, the support portal, the recovery phrase. The room you trusted vouched for the context. The copied identity supplied the authority. You provided the loss.

Nothing in that sequence is technically sophisticated. There is no exploit, no malware, no zero-day. It is pure identity forgery, and it works precisely because the cost of forging the identity is zero and the value behind the deception is now thousands of dollars. The attacker did not break the platform. The attacker used the platform exactly as designed, in a context where the design — open access, free identity, value in the room — had become a loaded gun. The defenders' instruments could see a public spam flood. They were nearly blind to a private message from a name that looked right.

And the impersonation menu is longer than the fake-admin DM, because once identity is free every trusted role in the room is available to be worn. There is the fake support agent, springing on you the instant you post the word "help," because the operation is listening for distress and distress is the moment people stop checking credentials. There is the impersonated founder, congratulating you on early support and steering you to a presale that does not exist. There is the synthetic fellow-traveler — an account that is just another member, posting screenshots of its gains, sharing the link that "worked for me," manufacturing the social proof that does the persuading so the operator never has to make the pitch directly. There is the account-takeover pivot, the most corrosive of all, because it does not impersonate a trusted person — it becomes one. An attacker who compromises your friend's real account inherits your friend's real trust, the entire history of real conversation, the photo you recognize, the name in your contacts. The message that asks you for a favor, or warns you of an emergency, or shares an opportunity, arrives from an identity that is not forged at all. It is borrowed. We will see later that this is the one variant cheap-identity defenses cannot touch, because the identity is genuine; only the hand on the keyboard has changed. For now, note only that it lives on the same continuum as the rest: the value in the room makes a trusted face worth wearing, and the platform makes the face cheap or free to put on.

Three things crypto brought with it

Crypto did not arrive alone. It brought three companions that together explain why the next several chapters get progressively darker.

The first is professionalization. When a single successful con returns more than a month of an ordinary wage in many of the regions where these operations are based, scamming stops being the work of bored amateurs and becomes an industry with a labor market, a supply chain, and a profit-and-loss statement. We will spend an entire chapter later on the attack economy, but the seed is planted here: the moment the prize crossed a threshold, the people attacking these communities started behaving like businesses, because they were businesses. They hired. They specialized. They bought tools. They reinvested. A nuisance does not professionalize. A profit center does.

You can see the professionalization in the division of labor alone. The person typing the social-engineering messages is rarely the person who wrote the orchestration script that fired the DM, who is rarely the person who supplied the aged accounts, who is rarely the person who built the fake support portal, who is rarely the person who launders the proceeds afterward. Each of these is a separate competency, often a separate vendor, frequently advertised and sold as a service to other operators on the very same platform where the attacks are run. There is a market for the components of a con the way there is a market for the components of any manufactured product, and the existence of that market is the surest sign that the activity has crossed from hobby into industry. Hobbyists improvise with what they have. Industries buy specialized inputs from specialized suppliers and assemble them into a repeatable process. The single most important consequence is this: the individual victim is no longer facing an individual attacker. They are facing the assembled output of an entire production line, optimized over thousands of prior attempts, and they are facing it alone.

The second is irreversibility. Traditional financial fraud lives inside a system built to claw money back — chargebacks, reversals, account freezes, an institution with a fraud department and a legal obligation to make some victims whole. Crypto, by design, has none of that. A confirmed on-chain transaction is final. There is no one to call. This is not a flaw the attackers exploit so much as a property they depend on: it converts a successful deception into a permanent transfer of wealth, instantly, with no recourse window during which a victim might notice and reverse course. Irreversibility is what makes the patient, high-effort, single-target con worth running. You only have to succeed once, for one second, and the crypto is yours forever.

The third is pseudonymous settlement on the attacker's side. The same property that lets the victim hold crypto without a bank lets the attacker receive it without a name. Funds move to a fresh address, get split, mixed, bridged across chains, and surface somewhere unrecognizable, all without any identity ever attaching to the recipient. The cost of being the person who took the crypto is, like the cost of the forged identity, close to zero. Cheap identity protects the attacker coming and going: cheap to fake on the way in, cheap to disappear on the way out.

Put those three together — professional operators, irreversible transfers, anonymous settlement — and you have described an environment that selects, ruthlessly, for the most effective deception. There is no friction anywhere in the system to slow a working attack down. The honest participant carries all the risk; the attacker carries almost none. Over time, an environment like that does not just permit fraud. It cultivates it. It breeds the specific, refined, industrial forms of fraud we are going to catalog, because every operator who finds a method that works can run it at volume, keep the proceeds, and never be identified. The platform was the venue. The crypto was the prize. Cheap identity was the open door. Irreversibility and anonymous settlement were the getaway car.

It is worth saying clearly that none of these three companions is a property of the platform. They are properties of crypto, and they disabuse anyone of the comforting idea that the problem is one venue's lax policies. The irreversibility lives on the blockchain, not in the chat client. The anonymous settlement lives in the design of the assets, not in the messaging app. The professionalization is a response to the prize, and the prize would be the same prize in any room where it sat. The identical dynamics light up wherever crypto value and open community overlap: token-gated Discord servers became prime hunting grounds the moment they held assets worth gating; X's crypto subculture runs on impersonation, from the reply-guy posing as a founder to the hacked blue-check pushing a drainer to a real follower base; WhatsApp groups carry the long-con investment frauds into regions and demographics the crypto-native venues never reached. The pattern belongs to the intersection of open access, weak identity, and value in the room, and it appears, faithfully, at every point where those three conditions meet. The lesson is not about a platform. It is about a structure, and the structure travels.

The numbers behind the shift

You can watch this transition in the data, though the data lags the reality by a year or two and almost certainly undercounts, because the most successful frauds are the ones nobody reports. Still, the orders of magnitude tell the story.

The headline figure is roughly $7.2 billion in reported crypto-investment-fraud losses in 2025 — the category dominated by pig-butchering, the long-con investment-and-romance fraud that builds trust over weeks before draining a victim (FBI IC3). Pig-butchering is the purest expression of everything in this chapter: it is not a spam flood, it is a relationship, built on a fabricated identity, monetized through irreversible crypto transfers, run by professional operations. The scale of it — billions, in a single year, from one category of con — would have been unimaginable in the pre-crypto era, because the pre-crypto era had no mechanism to convert attention into losses of that size. The crypto era does. It is called a wallet, and it is in the room.

On the platform side, the enforcement tallies paint the supply side of the same picture — Telegram alone banned tens of millions of groups and channels in 2025, a story Chapter 18 takes up in full. That is not a measure of how much fraud succeeded; it is a measure of how much infrastructure the attackers were willing to stand up and burn, which is its own signal. You do not generate disposable channels at that volume to run a low-value nuisance. You generate them because each one is a cheap, expendable front for an operation whose expected return justifies the churn. The churn is the professionalization made visible.

I want to be careful with these figures, and you should be too. They come from different methodologies, they count different things, and several are reported by parties — security vendors, the platform itself — with reasons to round in a particular direction. Treat them as the shape of a trend, not as audited accounting. But the shape is unambiguous, and it is corroborated across every independent source we will draw on in this book: at some point in the early 2020s, the dominant threat in open crypto communities stopped being people wasting your time and became people taking your crypto, professionally, at industrial scale, behind faces that cost nothing to forge.

There is one more thing the numbers quietly establish, and it matters for the chapters ahead. Notice that none of these figures measure spam in the old sense. We have stopped counting unwanted messages and started counting dollars stolen, victims drained, infrastructure burned. That is not an accident of which statistics happened to be available. It is the transition itself, made legible in the choice of metric. In the pre-crypto era you measured spam in volume because volume was the harm. In the crypto era you measure it in losses, because loss is the harm — and loss is the unit a business reports. The reporting language followed the attackers across the same threshold the attackers crossed: from nuisance you tally in messages-per-minute to a crime you tally in billions-per-year. When the metric changes from impressions to dollars, the phenomenon has already changed underneath it.

The defenses were built for the last war

The cruelest part of this transition is that the defenders did not get worse. The toolset built in the previous era was genuinely good at what it was built to do. The problem is that what it was built to do became almost irrelevant.

Walk through the classical defensive kit against the new threat model. The CAPTCHA at the door verifies that a new joiner can solve a puzzle. It does nothing to establish who they are, and a patient human-run operation — or, soon, an AI-run one — solves the puzzle and walks right in, now wearing a verified-by-CAPTCHA badge of legitimacy it does not deserve. The anti-flood limiter throttles anyone posting too fast. The impersonation DM is a single message, sent slowly, to a single target; it never trips a flood threshold because it is not a flood. The keyword filter scans public messages for known-bad strings. The con happens in a private message the filter cannot see, in language the filter was never trained on, because the language of a personalized social-engineering attack is just ordinary, friendly conversation. The shared banlist — the most forward-looking tool of the lot, and the one we will spend the rest of the book vindicating — bans known-bad accounts. The attacker generates a fresh account for each operation, at zero cost, and the banlist is always one identity behind.

Every one of these tools shares a single assumption, and the crypto era violated all of it at once: the assumption that the attack is a visible action taken in public by an identity worth banning. The new attack is an invisible relationship, conducted in private, by a disposable identity that will be discarded before any banlist hears about it. You cannot rate-limit a relationship. You cannot keyword-filter trust. You cannot ban your way out of a problem where the supply of attacker identities is infinite and free. The defenders were not outsmarted in some clever way. They were structurally bypassed, because the ground had shifted beneath the entire premise of their toolset.

This is the thread that runs through everything that follows, so hold onto it: every defense in the classical canon inspects behavior, and the crypto era moved the attack to a place where the behavior is indistinguishable from a legitimate participant's. A real admin sends helpful DMs. A real holder shares an opportunity with a friend. A real support agent asks you to verify your account. The fraud is not a different kind of behavior; it is the same behavior performed by someone lying about who they are. And the one thing the classical toolset never measured — because in the pre-crypto era it never needed to — was identity.

You can see, from here, the shape of the entire argument this book is going to make. The defenses failed not because they were poorly built but because they answered the wrong question. They asked: is this message spam? In the crypto era, the question that matters is: who is this person, and have they earned the right to be trusted in this room? The classical toolset has no way to ask that question, because identity was free and unverified and nobody had ever needed to price it. We will spend the middle of this book watching defenders try, brilliantly and repeatedly, to answer the spam question better and better, and hit the same wall each time. The question is wrong. For now, it is enough to see what the crypto did.

Crypto did not just raise the stakes. It changed what kind of thing an attack is. It took a parasite that lived outside the community, feeding on attention, and replaced it with a predator that lives inside the community, wearing the community's own faces, hunting the people in it one at a time for everything in their wallets. The room is no longer a billboard the spammer abuses. The room is the trap, and the bait is identity, and identity is free.

Crypto turns noise into predation. From here, spam means fraud.