Scuba Jake

Summary

A popular YouTuber known for scuba diving content had his channel compromised by attackers who renamed it to impersonate a cryptocurrency-focused company and hosted fraudulent live streams promoting a fake Bitcoin and Ethereum giveaway. The hackers altered the channel's branding and broadcast recycled videos featuring a prominent crypto figure to deceive the victim's 13 million subscribers into sending cryptocurrency payments, resulting in confirmed theft of over 1 Bitcoin valued at approximately $21,000. Following the incident, the channel became inaccessible to viewers despite the creator confirming the breach via social media, disrupting access to his content library and impacting his audience.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The incident involving YouTuber Jake Koehler, known as Scuba Jake, occurred on September 9, 2022, when attackers compromised his YouTube channel "DALLMYD," which had over 13 million subscribers and 1.75 billion cumulative views. The attackers rebranded the channel to "MicroStrategy US," impersonating the legitimate business intelligence firm MicroStrategy, and hosted two live streams featuring recycled footage of the company’s former CEO Michael Saylor. These streams promoted a fraudulent cryptocurrency giveaway scheme, falsely promising enhanced Bitcoin and Ethereum rewards to viewers who sent funds to specified wallets. Scammers displayed QR codes linked to a Bitcoin wallet, which received four transactions totaling 1.0107 BTC (approximately $21,000) during the attack. Blockchain analysis confirmed the wallet’s activity aligned with the scam’s timeframe, though additional undisclosed wallets may have been used. No Ethereum transactions occurred despite its inclusion in the scheme. The channel’s large subscriber base made it an attractive target for maximizing potential victim engagement.

Following the hack, Scuba Jake acknowledged the compromise via his Instagram account, but his YouTube channel became inaccessible to viewers shortly afterward. Searches for the channel at the time of reporting yielded only collaborative videos with other creators, with no direct trace of the original channel. The attackers leveraged the channel’s established credibility to deceive subscribers into believing the fraudulent giveaway was endorsed by Michael Saylor. Financial losses were confined to the confirmed Bitcoin transactions, though the exact number of affected individuals remains unspecified. The incident disrupted access to the channel’s content library, impacting both the creator and his audience. YouTube had not restored the channel by the article’s publication date, and no additional platform responses or recovery actions were detailed.

Sources

Sources available to members: 1 source.