A new crypto scam is draining wallets across the web. Out of nowhere, users are receiving urgent texts and emails insisting they withdraw their funds from the now-shuttered exchange Bittrex. However, those who follow through may hand their crypto over to cyber thieves. This con exploits the confusion around the Bittrex closure to steal digital assets from unwitting victims. But with awareness of how this scam operates, you can make sure your coins don’t line a fraudster’s pocket.
Scam Overview
The Bittrex scam messages are short, urgent-sounding texts instructing the recipient to withdraw their funds from Bittrex before the exchange closes. They may say something like:
“Bittrex withdrawal required. Significant amount of crypto held. Withdraw before imminent closure.”
The messages contain links to fake Bittrex login pages hosted on malicious domains. If victims enter their account credentials on these sites, the scammers can steal their cryptocurrency.
The scam messages often come from random phone numbers or emails, making them difficult to trace. The messages are sent out en masse to take advantage of the large number of people who may have held crypto on the real Bittrex exchange before it closed.
History of Bittrex Exchange
To understand this scam, it helps to know the real history of Bittrex. Bittrex was a popular crypto exchange based in the United States. It was founded in 2014 and allowed users to trade hundreds of different cryptocurrencies.
In 2022, Bittrex announced it would be shutting down its exchange business globally to focus on other blockchain opportunities. The exchange halted registrations and planned to fully close in 2023.
Bittrex provided account holders with instructions to withdraw their funds prior to closure. However, some users likely left crypto assets on the exchange right up until it shut down.
Why the Scam Works
The Bittrex scam takes advantage of two things:
- Confusion around the Bittrex exchange closure
- Urgency created by the threat of “imminent closure”
Many former Bittrex users may not have fully understood the closure process. Some may think their Bittrex accounts still exist.
The scam messages use urgency and trick victims into thinking they need to act fast before losing their funds. This creates fear and causes people to overlook the suspicious nature of the messages.
This scam has been also investigated by Jordan Liles on his YouTube channel, where he offers a detailed video on the subject. We recommend watching his content for a comprehensive understanding of the scam.
Next, let’s break down exactly how scammers carry out this scam from start to finish.
How the Bittrex Crypto Scam Works
The “Bittrex withdrawal required” scam operates in several stages:
1. Victims Receive a Scam Text or Email
The first step is the initial contact through a text message or email. The message is unsolicited and comes out of the blue.
As mentioned, it contains language intended to create urgency like “withdraw before imminent closure.” There may be a threat that the funds will be lost if the victim does not act quickly.
2. Victim Clicks the Malicious Link
If the victim clicks the link in the message, they are taken to a fake Bittrex login page hosted on a scam domain.
Some examples of fraudulent domains used include:
- omniagentsolutions.com
- exit-bittrex.com
- exit-bittrexglobal.com
These domains are designed to look legitimate, often incorporating the Bittrex name. However, they are not associated with the real Bittrex exchange.
3. Victim Enters Account Credentials
On the fake login page, the victim is prompted to enter their “Bittrex account details to begin withdrawal.” This form asks for the victim’s:
- Email address
- Password
- 2FA code (if enabled)
If the victim enters this information, the scammers capture it and gain full access to the victim’s account.
4. Scammers Drain the Crypto Assets
Finally, the scammers will quickly initiate withdrawals of any cryptocurrency held in the compromised Bittrex account.
The crypto is sent to wallets controlled by the scammers. In most cases, the victim’s funds are rapidly drained before they realize the fraud.
Covering Tracks
To maximize their gains, the scammers will often delete any evidence of the unauthorized withdrawals from the victim’s online account history.
They want to delay the victim noticing something is wrong as long as possible. This allows more time to liquidate the stolen crypto and launder the funds.
The scammers frequently switch between scam domains as well. This makes it hard for authorities to track them.
What to Do if You Are a Victim of the Bittrex Scam
If you entered your information on a scam Bittrex site and had crypto stolen, here are important steps to take:
1. Contact Law Enforcement
Report the scam to local police and federal law enforcement like the FBI. Provide them with details of how you were defrauded, including:
- The scam messages/emails
- Fraudulent domains
- Crypto amounts and wallet addresses used
Law enforcement may be able to trace the scammers and recover some funds.
2. Notify Your Wallet and Exchange Providers
Contact any wallet providers or exchanges you use. Alert them to the scam so they can potentially freeze the scammer’s accounts or flag their wallet addresses.
3. Change Your Passwords
Immediately change your logins and passwords for any crypto or financial accounts. Use strong unique passwords for each. Enable 2FA everywhere possible.
4. Watch for Other Scam Attempts
Scammers who succeed once will likely try again. Be alert for follow-up scam messages claiming you need to verify account details, reset passwords, etc. These are further attempts to steal from you.
5. Educate Yourself on Crypto Scams
Learn the red flags of common crypto and financial scams. Be wary of unsolicited messages asking you to click links or input sensitive information. Don’t fall for high-pressure tactics insisting you act urgently.
How to Avoid the Bittrex Crypto Scam
Here are some tips to avoid becoming a victim of the “Bittrex withdrawal required” scam:
- Be skeptical of unsolicited messages claiming to be from Bittrex or telling you to withdraw funds urgently.
- Do not click links or call phone numbers in suspicious messages. Type known website URLs directly into your browser.
- Check message sender addresses for spoofing. Scam emails can mimic real addresses.
- Never enter your login credentials on a website you were led to from a message. Only visit known legitimate sites.
- Use 2FA and strong unique passwords to secure your accounts. This limits the damage if your credentials are compromised.
- Keep software up-to-date. Enable auto updates when possible. Outdated software is vulnerable.
- Use a password manager so you don’t reuse passwords between accounts. Reused passwords give scammers more to target.
- Don’t disclose personal or financial information via message or unsolicited communications.
- Be cautious when searching for help online. Scammers post offers of assistance which lead to more fraud.
Frequently Asked Questions About the Bittrex “Withdrawal Required” Scam
1. What is the Bittrex “withdrawal required” scam?
The “Bittrex withdrawal required” scam is a phishing con targeting former users of the now defunct Bittrex cryptocurrency exchange. Victims receive fake urgent emails or text messages telling them to withdraw their crypto funds from Bittrex before an imminent closure. The messages contain links to phishing sites designed to steal Bittrex account credentials and drain victims’ wallets.
2. Who is behind the Bittrex withdrawal scam?
The identities of the specific scammers behind this fraud are unknown. They are cybercriminals operating globally through the anonymity of the internet. The scam networks likely involve multiple players responsible for different roles like programming the phishing sites, crafting the messages, laundering stolen funds, etc.
3. How do the scammers get victims’ contact information?
The scammers likely obtained many victims’ emails, phone numbers, and other personal data from previous Bittrex user account breaches or brute force hacking attempts. User account information may have also been purchased on dark web marketplaces.
4. What makes the scam messages look legitimate?
The scam text messages and emails are carefully crafted to appear like authentic communications from Bittrex. They use logos, urgent language about account closure, and official-looking domain names and email addresses. This tricks victims into thinking the messages are real.
5. What are some examples of scam domains used?
Some of the fraudulent domains scammers use include:
- omniagentsolutions.com
- exit-bittrex.com
- exit-bittrexglobal.com
6. What information do victims provide to the scammers?
On the phishing sites, victims enter sensitive login credentials like their Bittrex email and password. In some cases, they also provide cryptocurrency wallet recovery phrases, API keys, 2FA codes, and other account access details the scammers use to drain funds.
7. How quickly do the scammers steal victims’ cryptocurrency?
In most cases, the scammers immediately initiate withdrawals of any crypto assets in compromised Bittrex accounts. Thefts happen quickly, within minutes of obtaining a victim’s account credentials and security information.
8. How can I tell if a Bittrex communication is legitimate or a scam?
Be wary of unsolicited texts/emails about Bittrex, as the exchange is closed. Legitimate messages will never ask you to click links or provide sensitive login or wallet details. Confirm web URLs begin with “bittrex.com” before entering info.
9. What should I do if I entered my information on a scam site?
If you provided your Bittrex account credentials or wallet information to a scam phishing site, immediately move any remaining funds to new secure wallets. Reset all account passwords and enable additional security protections like 2FA. Monitor closely for additional scam attempts.
10. How can I avoid the Bittrex withdrawal scam?
Avoid clicking links or providing any sensitive information in response to unsolicited urgent communications. Instead, navigate directly to any websites using known safe URLs. Use unique secure passwords and 2FA to limit damage if credentials are compromised.
The Bottom Line
The “Bittrex withdrawal required” scam shows that fraudsters continue finding new ways to steal crypto assets using social engineering tactics. By sending fake urgent messages and directing victims to malicious sites, they can rapidly monetize people’s account credentials.
The best way to avoid this scam is being skeptical of any unsolicited messages, no matter how convincing. Do not click links, call numbers, or provide information to strangers who contact you out of the blue. Instead, navigate directly to known legitimate websites and be vigilant for spoofing.
For those unfortunate enough to fall victim to this scam, act swiftly to contact law enforcement, secure your remaining accounts, and warn others about the fraud. But the ideal approach is preventing the attack in the first place through education, security precautions, and refusing to engage with suspicious messages. Stay safe out there!
