Anatomy of an ICO Scam: Box of Data

By Alissa Fleck

In 2017, 78% of all ICOs were identified as scams, according to a study by the advisory firm Statis Group. Meanwhile, cybersecurity company Carbon Black found that approximately $1.1 billion worth of digital currency was stolen in the first half of 2018.

As capital continues to flow into the digital currency market — and into token sales, particularly — crypto investors must be more vigilant than ever when it comes to sniffing out scams.

At ICO Ranker, we’re journalists working to protect investors. We take pride in publishing reliable reviews and ratings of ICOs, token sales and cryptocurrency crowdfunding campaigns. When we received an email tip warning us that Box of Data was a scam, I had to investigate.

As a result of the tip, we identified an ICO scam that continues to receive favorable reviews on other ICO rating sites. Here’s how we did it.

All the Right Pieces

By all outward appearances, Box of Data looks like any other token sale website, with all the requisite pieces:

  • vaguely technical value proposition (“Blockchain Infrastructure For The Digital Content Industry);
  • live token sale ticker;
  • exchange logos (KuCoin, IDEX, YouBit);
  • whitepaper that’s both generic and overly complicated;
  • links to media coverage; and
  • a very impressive roster of talent

With no obvious red flags, it’s little surprise that Box of Data would be listed favorably on ICO review sites, including CoinPredictor and Base.Info. The competition to review ICOs — and attract their marketing dollars — is tougher than ever.

One Loose Thread

On October 27, ICO Ranker received an urgent email from ICO advisor Eduard Finn. According to Finn, Box of Data did not have permission to include him as an advisor. He wrote:

ICO Box Of Data uses my photo, but I never agreed with it. I have never spoken to any of this project. I have never received any messages from this ICO. I don’t know what the project is and hear about it for the first time. Most likely this is scam. Please check and delete.

(Box of Data has since removed Finn as an advisor.)

Alarmed at the tip, we launched a formal investigation into Box of Data’s company, its website and its project details.

A Clever Fraud

Suspecting that Eduard Finn wasn’t alone, I dug into the company’s purported roster. As far as I could tell, the team members are real people; that is to say, their LinkedIn accounts are legitimate.

More than that, several of the team members appear to be heavy-hitters in the data storage space:

Charles Carolan is a finance director at Box; Daniella Kuntzman is a software developer at Dropbox; Tina Kuan is Castbox’s CMO; and Leonid Vasilyev is an engineer at Dropbox.

There’s just one problem: “Box of Data” is not the same of Box. It’s also not Dropbox. Or Castbox. In fact, nothing suggests that Box of Data has relationships with any of these companies.

Still, I attempted to contact several of the individuals listed on Box of Data’s website. Just one person replied to my request. Will Wilson, who is currently listed as “Product Operations Lead,” flatly denied any involvement with this project.

It’s unfortunate but understandable that no one else replied to my request for comment. In recent years — and especially in the cryptocurrency world — LinkedIn has become the premier platform for sales pitches, at best, and unrelenting spam at worst.

Therein lies the problem. It’s a simple matter for anyone to include your LinkedIn profile on their website. If you don’t have a Google alert for your own name, you may never know it. Attempts to clarify are themselves disregarded by spam-weary LinkedIn members.  

Manufactured Media

As crypto veterans are well aware, marketing is just as important as technology when it comes to launching a successful token sale. And when it comes to impact, being featured in a recognizable media outlet goes a long way to establishing credibility.

The problem is, even the most modest token sales can land press coverage on any one of several dozen crypto websites, where the reporters are hungry to meet deadlines and fill their pages. Worse, as Breaker magazine reported in October, many trade editors and reporters are flatly corrupt.

The scammers at Box of Data took a different approach: They made their own positive media coverage. Take, for example, this ringing endorsement from Renee Wang, CEO of the popular podcasting app Castbox:

On the surface, Wang’s comment is a powerful endorsement. The problem is, the quote is fake.

Well, it’s not entirely fake. TechCrunch did publish a quote from a fireside chat with Renee Wang. In the original coverage, however, she was speaking favorably about Contentbox:

It’s a clever bit of fraud. Rather than creating fake quotes from whole cloth, Box of Data’s founders relied on information overload to conceal their scam. It’s not unreasonable to mistake “Contentbox” for “Box of Data” in the course of casual research.

Seen through this lens, all of the media coverage listed on Box of Data’s website quickly falls apart. Their claim that the $BOD token is approved for listing on IDEX, Kucoin and Yobit? The source is just another self-published article on Medium. Johnny Lyu, VP of KuCoin, confirmed with ICO Ranker that $BOD is neither listed nor approved to be listed with them.

Busted

So who’s actually behind Box of Data, and how do we prevent these scams in the future?

Not surprisingly, WHOIS records reveal nothing, and the nameservers are hosted by Cloudflare. Box of Data’s Twitter account has fewer than 200 followers, and many appear to be bots. The company’s LinkedIn page is no longer active, and they never really bothered with Instagram. The website itself was built using a $59 WordPress plugin called Crypterio.

Here’s one final red flag for would-be investors: The registration process for a legitimate ICO shouldn’t be too easy. Whether we like it or not, regulators are keeping tabs on token sales, especially in the U.S. and Europe. But even in countries with less regulation, token sellers are wisely requiring at least basic customer information. Meanwhile, the Box of Data team is eager to accept anyone’s BTC, ETH, LTC and BCH — KYC and AML be damned.  

I reached out to Box of Data, requesting comment and clarification. My only options were tweets, DMs and an email address from the token purchase page where investors were encouraged — but not required — to send their identifying information.

I didn’t hear back.

We may never know how much money Box of Data scammed from investors. (Their receiving wallets appear to be dynamically generated for each investor.) And it’s just about certain that we’ll never learn who’s behind the con. 

The lesson? DYOR is more than glancing at websites and clicking around LinkedIn. Crypto is a new frontier with untold fortunes and failures ahead of us, and savvy investors are not blinded by the flash of easy money. There’s no substitute for basic common sense, due diligence and a healthy dose of skepticism. 




This website is for information and illustrative purposes only. It is not, and should not be regarded as "investment advice" or as a "recommendation" regarding a course of action, including without limitation as those terms are used in any applicable law or regulation. See Disclaimer.