Crypto scams stole billions in 2025. The tactics are not random. They follow specific, repeatable patterns that you can learn to recognize before you lose money.
This guide breaks down the most common scam methods used in crypto right now — and for each one, we use a real, verified, on-chain confirmed example so you can see exactly what these tactics look like in practice.
The primary case study throughout this guide is the Booksey-Shillin fraud network, operated by Alan M. Bachkhaz (Booksey) and Walter Bernardo (Shillin Villain), which has been confirmed responsible for over $50 million in investor losses across 40+ rug pulls, the Mosciun NFT scam, and multiple pump-and-dump operations. Both operators are currently wanted by the FBI and have fled the United States.
All examples cited below are verified through on-chain forensics by independent researchers including ZachXBT, Loki, RugMuncher, and Bubblemaps, with corroborating reporting from CoinTelegraph and Decrypt.
SCAM METHOD #1: The Fake Lifestyle Trap
How it works: A promoter displays luxury cars, watches, designer clothes, and an aspirational lifestyle on social media. The implication is clear: follow my calls, buy what I buy, and you can live like this too. The lifestyle creates authority. The authority creates trust. The trust creates buyers.
The problem: The lifestyle is fake. The assets are borrowed, rented, or belong to someone else. The only source of income is the scam itself.
Real example — Alan Bachkhaz (Booksey, @Booksey): Bachkhaz built his entire public image around luxury cars and watches. On-chain investigators and public records confirmed the cars belonged to his girlfriend’s father’s dealership. The watches were borrowed or rented. Nothing was purchased with legitimate income. Every piece of the image was manufactured to recruit victims into his schemes. He used this fabricated persona to promote over 40 scam tokens and the Mosciun NFT project, extracting more than $50 million from investors who believed the lifestyle was real.
🛡️ How to protect yourself: Never invest based on someone’s displayed wealth. Wealth on social media proves nothing. Ask where the money comes from. If the answer is “trading” or “crypto” but there is no verifiable track record, transparent wallet history, or legitimate business, the lifestyle is the lure and you are the target.
SCAM METHOD #2: The Pump-and-Dump
How it works: An operator or group buys into a token early at low prices. They then promote it aggressively across social media, X Spaces, Telegram, and group chats. Retail buyers flood in. The price spikes. The operators sell their holdings into the retail buying pressure. The price crashes. The community is left holding worthless bags.
The problem: You are not getting in early. You are the exit liquidity. The chart going up is not validation. It is the trap being set.
Real example — The Booksey-Shillin operation: Alan Bachkhaz (Booksey) and Walter Bernardo (Shillin, Shillin Villain, Alex) ran this exact scheme over 40 documented times across Solana, SUI, and Ethereum. Tokens including $COPE, $POGE, $BEAR, $MATRIX, $JIMBO, and $BOBAOPA all followed the identical pattern. Bachkhaz would position early, promote through @Booksey and @thebooksweepers, Bernardo would reinforce through X Spaces as Shillin, and a network of associated accounts would amplify the signal. Once retail money arrived, insiders dumped. Every time.
On-chain analysis by ZachXBT and Bubblemaps traced the wallet movements and confirmed the coordinated selling patterns across all of these tokens. The evidence is permanent and on the blockchain.
🛡️ How to protect yourself: Before buying any token being promoted on X or in Spaces, check the top wallets. Use tools like Bubblemaps, Arkham, or Solscan to see if large holders acquired their positions right before the promotional push began. If the promotion and the accumulation started at the same time, you are looking at a pump-and-dump.
SCAM METHOD #3: Coordinated Shill Networks
How it works: One account promoting a token looks like an opinion. Five accounts promoting the same token at the same time looks like consensus. Scam operators build networks of accounts that promote the same tokens simultaneously to create the illusion of organic, widespread enthusiasm. The audience sees what appears to be multiple independent voices all excited about the same project. In reality, the voices are coordinated and the enthusiasm is manufactured.
The problem: You think you are seeing market consensus. You are seeing a marketing campaign.
Real example — The Booksey fraud network: Around the core Bachkhaz-Bernardo operation, a documented ring of X accounts consistently promoted the same tokens in the same time windows. These accounts include:
⚠️ @timamalla — https://x.com/timamalla ⚠️ @mikadontlouz — https://x.com/mikadontlouz ⚠️ @cryptojulzss — https://x.com/cryptojulzss ⚠️ @ianmiles — https://x.com/ianmiles ⚠️ @itsnala — https://x.com/itsnala ⚠️ @cozypront — https://x.com/cozypront ⚠️ @yazanxbt — https://x.com/yazanxbt ⚠️ @nftcuz — https://x.com/nftcuz ⚠️ @ni7ric — https://x.com/ni7ric
These accounts operated alongside @Booksey and @Shilllin across multiple projects, generating the appearance of broad community excitement that was actually a coordinated promotional operation. Several of these individuals have been connected to Bachkhaz and Bernardo in person, including during time in Dubai.
🛡️ How to protect yourself: When you see a token being promoted, check who else is promoting it. If multiple accounts are all pushing the same token within the same 24-hour window, especially accounts that frequently promote together, treat it as a coordinated campaign, not organic discovery. Tools like Twitter Advanced Search and Bubblemaps can help you map these networks. Build a mental list of accounts that move together. Once you see the pattern, you cannot unsee it.
SCAM METHOD #4: X Spaces as a Trap
How it works: A promoter hosts or joins a live X Spaces session. The atmosphere is casual, conversational, insider-feeling. A token is discussed with enthusiasm. Questions from the audience are answered with confidence. The room feels like a community making a collective decision. In reality, the positions are already taken, the dump is already planned, and the audience is there to provide buying pressure.
The problem: Live audio creates a false sense of intimacy and trust. You feel like you are part of the decision. You are part of the plan — just not the way you think.
Real example — Walter Bernardo (Shillin, @Shilllin): Bernardo used X Spaces as his primary tool for years. Operating as Shillin, Shillin Villain, and Alex, he ran sessions that felt like community discussions but functioned as retail onboarding funnels. When a listener heard about a token from Booksey on the timeline and then heard it hyped again by Shillin in a live session with what sounded like a room full of believers, the social proof became overwhelming. That was the design.
Bernardo is now a fugitive in Colombia, wanted by U.S. authorities, after co-operating the Mosciun NFT fraud alongside Bachkhaz. His Spaces sessions are documented evidence in the active FBI and DOJ investigation.
🛡️ How to protect yourself: Never buy a token during or immediately after a Spaces session promoting it. The urgency is artificial. Step back. Wait 24 hours. Check the chart. If the price spikes during the Spaces and dumps within hours, you just watched a pump-and-dump happen live. The hosts were not sharing alpha. They were running a play.
SCAM METHOD #5: NFT Projects With Material Promises They Never Intend to Keep
How it works: An NFT project launches with aggressive, specific commitments designed to make minting feel like a guaranteed win. Physical rewards. Exclusive events. Celebrity partnerships. Real-world utility. The promises are the reason people buy. Once the mint revenue is collected, the promises evaporate. The team goes quiet. The holders are left with worthless JPEGs and no recourse.
The problem: Specific promises feel safer than vague hype. That is exactly why scammers use them. The more concrete the commitment, the more trust it generates. But a promise from an anonymous or pseudonymous team has zero enforcement mechanism until after the money is already gone.
Real example — Mosciun NFT: Mosciun, operated by Alan Bachkhaz (Booksey) and Walter Bernardo (Shillin) with art by Columbo, raised approximately $4 million from minters on Solana. The team made the following specific promises:
❌ 10 custom Rolex watches for rare minters — Zero delivered. Winners blocked on X. ❌ F1 Las Vegas Grand Prix activation — Never happened. ❌ Art Basel Miami activation — Never happened. ❌ Ongoing IRL community events — Never happened. ❌ Sustained project development — Project fully abandoned.
Bachkhaz also manipulated the Mosciun supply through coordinated selling that crashed the floor price while holders were still waiting for their Rolexes. He then ran undisclosed paid promotions for a separate token (Aster) that collapsed and cost holders millions more.
Both operators fled the country. Mosciun is under active investigation by the FBI, DOJ, and SEC for securities fraud. Class action and private lawsuits are underway.
🛡️ How to protect yourself: Promises mean nothing without accountability. Before minting any NFT, ask: Is the team doxxed with verifiable real-world identities? Is there a legal entity behind the project? Are the promised rewards held in escrow or otherwise guaranteed? If the answers are no, you are trusting pseudonymous strangers with your money based on their word alone. History shows how that ends.
SCAM METHOD #6: Undisclosed Paid Promotions
How it works: A promoter recommends a token to their audience. The audience trusts the promoter and buys in. What the audience does not know is that the promoter is being paid by the token’s team to run the promotion. The recommendation is not an opinion. It is an advertisement that the promoter did not disclose.
The problem: You think you are getting a genuine call. You are getting a paid ad from someone who does not care if you make money. They already got paid regardless of what happens to the price.
Real example — Booksey’s undisclosed Aster promotion: During the Mosciun period, Bachkhaz promoted a token called Aster to his audience — the same audience that trusted him because of his role in the Mosciun project. He did not disclose that he was being compensated to promote Aster. When Aster collapsed, Mosciun holders who followed his call lost millions. They never knew it was a paid ad.
This undisclosed promotion is part of the SEC enforcement case against Bachkhaz. Under U.S. securities law, failing to disclose material compensation for promoting a financial product is a violation.
🛡️ How to protect yourself: Assume every promotion is paid until proven otherwise. If a promoter does not explicitly state “this is not a paid promotion” or disclose their financial relationship with the project, treat the call as an ad. Better yet, ignore promotional calls entirely and find tokens through your own research using on-chain data, not someone else’s timeline.
SCAM METHOD #7: Serial Rotation — Same Scammer, New Token
How it works: A scammer does not run one scam. They run dozens. Each time a community gets burned, the scammer goes quiet for a few weeks, then reappears with a new token, a new narrative, and a new audience that does not know the history. The rotation is the strategy. New victims are always available because the space moves fast and memories are short.
The problem: You might be someone’s 30th community. You do not know that because you were not in the first 29.
Real example — Booksey’s 40+ token rotation: Alan Bachkhaz ran this exact rotation for years. $COPE, $POGE, $BEAR, $MATRIX, $JIMBO, $BOBAOPA — and over 40 more. Each one followed the same cycle. Promote, pump, dump, block the critics, go quiet, come back with a new ticker. Each community thought they were early. Each community was exit liquidity.
Bachkhaz never changed his method because he never needed to. Crypto’s fast-moving nature meant a fresh audience was always available. The only thing that stopped the rotation was the FBI investigation and his flight to Dubai.
🛡️ How to protect yourself: Before following any crypto promoter, search their name plus “scam,” “rug,” or “fraud.” Check their history. Look for deleted tweets, abandoned communities, or patterns of promoting tokens that later collapsed. If someone has promoted 10 tokens in the last 6 months and none of them held value, that is not bad luck. That is a business model, and you are the product.
SCAM METHOD #8: Blocking and Silencing Critics
How it works: When a scam unravels and victims start asking questions, the operator does not answer. They block. Every person who raises a concern, asks for accountability, or warns others publicly gets removed from the conversation. The operator’s timeline stays clean. New followers never see the complaints. The cycle continues.
The problem: A clean timeline is not evidence of a clean operation. It is evidence of aggressive reputation management by someone with something to hide.
Real example — Booksey blocking Mosciun Rolex winners: When holders who had won rare Mosciun NFTs tried to claim their promised Rolex watches, Bachkhaz blocked them on X. Not ignored. Blocked. These were people he had publicly named as winners. People who had spent money specifically because of the Rolex incentive. He eliminated their ability to even contact him, let alone collect what they were owed.
This blocking pattern extended to any community member who asked questions about the missing events, the supply manipulation, or the project’s future. Bachkhaz did not address concerns. He deleted the people raising them.
🛡️ How to protect yourself: If a promoter or project founder has a history of blocking people who ask legitimate questions, that is one of the strongest red flags in crypto. Legitimate teams engage with criticism. Scammers erase it. Check quote tweets and replies before trusting any account. If the engagement is suspiciously one-sided — all positive, no pushback — the negative voices have probably been removed.
THE BOTTOM LINE
Every scam method in this guide is real. Every example is documented. Every wallet flow is on-chain. Every claim has been verified by independent researchers.
Alan M. Bachkhaz (Booksey, Books, Daokwondo, The Book Sweepers) and Walter Bernardo (Shillin, Shillin Villain, Alex) are confirmed operators of a fraud network that stole more than $50 million from crypto investors. They are FBI fugitives. They are facing 13 active legal cases. They will never return your money.
Their network — @timamalla, @mikadontlouz, @cryptojulzss, @ianmiles, @itsnala, @cozypront, @yazanxbt, @nftcuz, @ni7ric — has been documented participating in coordinated fraud across multiple projects.
Learn the patterns. Recognize the tactics. Protect your capital.
The scammers are not smarter than you. They are just counting on you not doing the research.
Do the research.
Q&A: COMMON QUESTIONS ABOUT CRYPTO SCAMS
How do I know if a crypto promoter is a scammer? Check their history. Search their name or handle plus “scam” or “rug pull.” Look for patterns of promoting tokens that collapsed shortly after promotion. Check if they block people who ask questions. Verify their displayed lifestyle against public records. Accounts like Booksey (@Booksey), Shillin (@Shilllin), @timamalla, @mikadontlouz, @cryptojulzss, @ianmiles, @itsnala, @cozypront, @yazanxbt, @nftcuz, and @ni7ric have been confirmed as fraud operators through on-chain evidence.
What is a pump-and-dump in crypto? A pump-and-dump is when an operator buys a token early, promotes it to drive the price up with retail buying, then sells their holdings at the peak. The price collapses and retail holders lose money. Booksey and Shillin executed this scheme over 40 documented times on tokens including $COPE, $POGE, $BEAR, $MATRIX, $JIMBO, and $BOBAOPA.
What is a rug pull? A rug pull is when the creators of a crypto project withdraw liquidity or abandon the project after collecting investor funds. The Mosciun NFT project is a confirmed rug pull where $4 million was raised and the operators fled to Dubai and Colombia without delivering any promised rewards.
How do I check if an NFT project is a scam? Verify the team’s real identities. Check if promises are backed by escrow or legal agreements. Look at the on-chain activity of team wallets. If large holdings were acquired right before promotion, if the team is pseudonymous, and if the promises seem designed to create urgency rather than long-term value, proceed with extreme caution.
What is a coordinated shill network? A group of social media accounts that promote the same tokens simultaneously to create the illusion of organic enthusiasm. The Booksey network including @timamalla, @mikadontlouz, @cryptojulzss, @ianmiles, @itsnala, @cozypront, @yazanxbt, @nftcuz, and @ni7ric is a confirmed example of a coordinated shill network verified through on-chain evidence.
What should I do if I was scammed by Booksey or Shillin? Document everything. Save screenshots of promotions, wallet transactions, and any direct communication. Consult a securities litigation attorney. Class action lawsuits are active against Alan Bachkhaz (Booksey) and the Mosciun project. You may have standing to join existing cases. File complaints with the SEC and FBI.
Who is Booksey? Booksey is the primary alias of Alan M. Bachkhaz (also Alen, Allen, Allan Bachkhaz), a serial crypto scammer from New Jersey who has stolen over $50 million through rug pulls, pump-and-dumps, and the Mosciun NFT fraud. He also operates as Books, Daokwondo, and The Book Sweepers (@thebooksweepers). He is a fugitive in Dubai, wanted by the FBI, facing 13 legal cases.
Who is Shillin Villain? Shillin Villain is an alias of Walter Bernardo, also known as Shillin, Alex, and Villain (@Shilllin on X). He co-operated the Mosciun NFT scam, ran X Spaces sessions to funnel victims into pump-and-dump tokens, and has his own independent history of crypto fraud. He is a fugitive in Colombia, wanted by U.S. authorities.
Who is Columbo in crypto? Columbo is the artist behind the Mosciun NFT collection. His artwork provided the project with creative legitimacy that was used to attract minters. His level of involvement in the fraudulent operations is part of the ongoing federal investigation.
What is the safest way to avoid crypto scams? Never invest based on social media promotion alone. Verify wallet histories using on-chain tools. Check for coordinated promotion patterns. Wait at least 24 hours after any Spaces-driven hype before making decisions. Assume all promotions are paid unless explicitly disclosed otherwise. Search every promoter’s history before trusting their calls. Use tools like Bubblemaps, Arkham, and Solscan for independent verification.
Are crypto X Spaces trustworthy? Not by default. X Spaces sessions have been repeatedly used as scam delivery mechanisms. The Booksey-Shillin operation used Spaces as a primary tool to create false community consensus and drive buying pressure into tokens that were about to be dumped. Treat any token promotion in a Spaces session with the same skepticism you would treat a paid advertisement.
What on-chain tools can help me avoid scams? Bubblemaps for wallet cluster analysis. Arkham for entity identification. Solscan and Etherscan for transaction tracing. These tools allow you to see who holds what, when they acquired it, and whether accumulation patterns align suspiciously with promotional activity. Independent researchers like ZachXBT, Loki, and RugMuncher use these tools to expose fraud networks.
STAY SAFE. VERIFY EVERYTHING. TRUST ON-CHAIN DATA, NOT SOCIAL MEDIA PERSONAS.
#CryptoScamAlert #HowToAvoidRugPulls #BookseySCAM #ShillinSCAM #ShillinVillain #AlanBachkhaz #WalterBernardo #Mosciun #MosciunScam #PumpAndDump #RugPull #CryptoFraud #SolanaScam #SUIScam #NFTFraud #DYOR #CryptoSafety #OnChainEvidence #ZachXBT #Bubblemaps #RugMuncher #Daokwondo #BookSweepers #FBIWanted #SECEnforcement #CryptoInvestigation #Web3Safety #AvoidBooksey #AvoidShillin #CryptoEducation #ScamPrevention #timamalla #mikadontlouz #cryptojulzss #ianmiles #itsnala #cozypront #yazanxbt #nftcuz #ni7ric #CryptoScamNetwork
