Recently, users have reported scams that promise “XPR arbitrage,” “high returns,” or “automatic conversion.” Scammers exploit identically named accounts on Vaulta and XPR Network to make it appear that a conversion has taken place, then steal the XPR sent by the victim.
Case
Chris came across posts in an online community promoting “XPR arbitrage” and “automatic conversion.” The scammer claimed that if he bought XPR and withdrew it to his Vaulta account, the system would automatically convert it into A tokens on Vaulta, generating a profit. They also claimed that the more XPR he transferred, the more he could earn.
Following the scammer’s instructions, Chris created a Vaulta account and transferred a small amount of XPR as a test. Soon afterward, his Vaulta account received a small amount of A tokens. The scammer then guided him through selling the A tokens and withdrawing the funds. After seeing the small profit arrive, Chris gradually began to believe in the supposed “automatic conversion” and “arbitrage” mechanism.
Chris then put in more money and again withdrew XPR to what he believed was his own account via XPR Network. This time, however, he received no additional A tokens. The scammer began stalling with excuses such as “system delays,” “you need to deposit more,” and “your arbitrage quota is insufficient.”
Chris then checked the transaction on an XPR Network block explorer and discovered that the withdrawn XPR had never been transferred across networks to his Vaulta account. Instead, it had gone to a same-name account created and controlled by the scammers on XPR Network. The XPR had already been transferred out to unfamiliar addresses.
How Does the Scam Work?
This scam exploits the fact that the same account name can exist on different blockchain networks, then uses small initial payouts to create the illusion of genuine profits.
1. Creating the Illusion With Same-Name Accounts
Scammers first instruct users to create a Vaulta (formerly EOS) account. They then create an account on XPR Network with exactly the same account name and control the permissions of that account.
For example:
User’s Vaulta account: abcdefg12345
Scammer-controlled XPR Network account: abcdefg12345
The account names are identical, but the accounts exist on different networks and are controlled separately. If a user sends tokens to that account name via XPR Network / PROTON, the assets will actually go to the XPR Network account controlled by the scammer, not to the user’s Vaulta account.
2. Using Small Amounts of A Tokens to Fake a Successful Conversion
To convince users that the “automatic conversion” is real, scammers separately send a small amount of A tokens to the user’s actual Vaulta account and guide them through selling the tokens and withdrawing the funds.
When users see that they sent XPR, received A tokens afterward, and were able to sell the tokens and withdraw the proceeds, they may mistakenly assume that the conversion process is genuine.
In reality, the XPR transfer and the receipt of A tokens are two separate transactions. There is no automatic conversion between them.
3. Luring Users Into Larger Transfers Before Stealing the Funds
Once users lower their guard after receiving a small profit, scammers encourage them to transfer more XPR with promises such as “higher returns,” “a larger arbitrage quota,” or “higher profits from larger conversions.”
Once the user transfers a large amount, the scammers stop sending payouts and move the assets out of the XPR Network account.
PSA:
- imToken supports the Vaulta network, but does not support XPR Network. Do not enter your Vaulta account name when withdrawing via XPR Network / PROTON.
- Before transferring assets, always verify the token, account, and network. To receive A tokens, select the Vaulta network. If the withdrawal page shows XPR Network or PROTON, do not enter your Vaulta account name.
- Do not trust promises of “high returns,” “consistent arbitrage profits,” or “automatic conversion.” Do not buy, withdraw, or transfer assets based on instructions from strangers or so-called customer support representatives.
- If you encounter a similar situation, stop making any further transfers immediately. Save your chat history, account names, transaction hashes, and withdrawal records, and report the case to your local police as soon as possible.
imToken Is Always Protecting Your Token Security
In July, imToken marked a total of 10,886 risky tokens, banned 611 risky DApp websites and flagged 468 risky addresses.
If you encounter any suspicious tokens or DApps, please report them to us at support@token.im to help protect other users.
Closing Thoughts
As scams continue to evolve, it can be difficult for everyday users to prevent them entirely. imToken will continue to monitor new types of scams and share timely risk information and security alerts with the community, helping users reduce losses and manage their digital assets more securely.
We invite you to read and share the imToken Wallet Security Monthly Report, and work with imToken to keep every token safe.