Singaporean entrepreneur loses over $14,000 USD in crypto due to fake game testing malware

A businessman in Singapore lost over $14,000 USD in crypto assets after downloading malware disguised as a game testing program. The victim is Mark Koh, founder of the organization supporting scam victims, RektSurvivor.

According to his account, on December 5th, Koh discovered a beta test opportunity for an online game called MetaToy on Telegram. Due to the website, Discord, and the project team appearing professional, he believed it was a legitimate project and downloaded the launcher.

Mark Koh (left) stated in an interview that he fell into a sophisticated scam and warned everyone to stay vigilant; malicious actors had asked him to download a game launcher containing malware. However, this launcher installed malware. Despite Norton antivirus warnings and Koh scanning his entire system, deleting suspicious files, and even reinstalling Windows 11, within 24 hours, all his software wallets linked to Rabby and Phantom were drained.

The total loss amounted to $14,189 USD in crypto, the assets Koh accumulated over 8 years. He said he did not log into his wallet, the seed phrase was stored separately, and he did not keep it in digital form.

Koh assessed that the attack could involve stealing authentication tokens and exploiting zero-day vulnerabilities in Google Chrome, with multiple attack vectors occurring simultaneously. He advised investors and developers to delete seed phrases from browser wallets when not in use and to prioritize using private keys to limit cascading risks.

The incident has been reported to the Singapore police. Besides Koh, at least one other victim in Singapore has also been affected by the MetaToy scam.