Protocol social channel has scam-coordinator flag
A threat intelligence & recon factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This episodic signal fires when the curator's scam-coordinator watchlist identifies a member of the protocol's official Telegram or Discord community channels as a known scam coordinator — an account previously associated with coordinated social-engineering attacks, fake-airdrop scams, or phishing campaigns targeting DeFi users. Detection is manual curator monitoring of protocol social channels combined with cross-referencing against a maintained scam-coordinator database. Category 11 context: scam coordinators embedded in community channels are both a direct attack vector (phishing links in community posts) and a reconnaissance channel for gathering intelligence about team behavior and user wallet sizes.
Why it matters
Community channel infiltration is documented in several dataset incidents as a concurrent attack vector. Badger DAO ($120M) saw coordinated social media amplification of the malicious approval-harvesting campaign. Infini ($49.5M) involved a rogue insider with both on-chain access and social channel presence. In the broader DeFi landscape, fake-airdrop scams launched from compromised community channels have drained tens of millions in aggregate. A scam coordinator embedded in the protocol's official channels has access to user sentiment, deployment timing discussions, and team communication patterns that can inform timing and targeting of a concurrent on-chain attack.
Green / Yellow / Red
Green is the baseline when no known scam-coordinator accounts from the watchlist are identified as members of the protocol's official community channels. Yellow fires when an account with medium-confidence scam-coordinator attribution (curator-flagged but not cross-confirmed by multiple sources) is identified in the community. Red fires when a high-confidence scam coordinator (confirmed by multiple independent sources or with documented prior phishing campaigns) is identified as an active member of the protocol's primary community channel.
Common gray cases
Gray applies when the protocol's community channels are fully private or invite-only and the curator cannot access them to perform the monitoring sweep, or when the channel is very large (100,000+ members) and comprehensive monitoring is impractical.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Determine whether a protocol-adjacent social channel admin is flagged on the curator scam-coordinator watchlist.