The global spread of COVID-19 has been accompanied by a deluge of licit and illicit activity in the world of cryptocurrency. Wild price fluctuations affecting major cryptocurrencies have been paralleled by a growing number of cryptocurrency projects using the pandemic to raise their profile. We look at two cases illustrating the increased licit and illicit types of cryptocurrency activity influenced by COVID-19 as well as trends more generally in the cryptocurrency market.
Coronavirus ERC-20 Memecoins
The trend of ERC-20 tokens using COVID-19 themes came to mainstream attention in late February with reports of CoronaCoin (NCOV), a deflationary ERC-20 token tracking infections and deaths caused by the virus. This token has been advertised on 4chan and is typical of what are known as memecoins, which use references to viral content to increase their publicity and value. The team behind NCOV also claims they will donate the equivalent in ETH of 20% of their token supply to the American Red Cross.
Our analysis of this donation address in Elliptic’s wallet screening application, Lens, shows that the overwhelming majority of funds are from decentralized exchanges, specifically Saturn Network. This is because Saturn is the most prominent platform currently supporting CoronaCoin (NCOV). In fact, one user already created a helpful how-to-guide for purchasing this token.
While this project has gained the most publicity of any using this particular approach, in the weeks since it appeared in the news, we have tracked another eight ERC-20 tokens with COVID-19 themes. ERC-20 tokens are easy to create and are frequently used in trust-trading scams shared on social media platforms, particularly Twitter and YouTube, which explains in part why the people behind these projects have chosen this medium.
CoronaVAXcoin (CoVAX20)
0xa357249f32d8e7fc5350A93804750A6e36a1c3b3
Coronavirus Dollar (CORD)
0x8845f904e466ea84aec36272a972e9ada7fd777f
Anti Corona (AC19)
0xb41bc62cde5bd24757e520a349b2682a56d91caf
Coronavirus Coin (CNV)
0x02cc786304ec4d6758cb16a962139870b4d960ce
Cure Corona (CC19)
0x76540b005587b6146B3F23A6Bc97A6e620A3E639
Corona Crypto (SARS)
0x9abffe87f77605655006d9b2afdaeb35bdc3307c
Anti Coronal Virus Token
0x7971918a549a16ec5b7312712602957c1b6c922d
Corona Virus Coin (CRNA)
0x49017D1cE3359a3b81AE8417731298126Ff751F1
While most of these have not gained traction with users, and do not have the social media presence we typically see with scams, there is one exception. Corona Virus Coin (CRNA) was reported by security researchers in February. Its website coronaviruscoin[.]com advertised an ICO funding research for a vaccine, and the construction of factories to produce protective medical gear. The website had translations of its pitch in Japanese, Korean, and Chinese, but is no longer active. The URL now redirects to its token address page on Etherscan.
Analysis of the contract address on any block explorer shows only a few incoming transactions. CRNA’s lack of success is possibly due to increasing awareness by users of the cybersecurity and financial threats accompanying this pandemic. Our analysis of scams targeting cryptocurrency users and businesses shows that the websites supporting these campaigns are typically short-lived, making it important to rapidly identify and analyze them while they are still functional.
CORONA Crypto and its Quest to Infect Users
While researching the spread of COVID-19 related ERC-20 tokens, we identified another cryptocurrency project capitalizing on the same trend. CORONA Crypto’s website says it is a “free distributed, free to trade token” driving the spread of knowledge about world diseases and fighting fake news by creating a “trusted, verified news source.” The project claims to have started with over two hundred addresses and offers to “infect” users who submit new CORONA addresses. Although not an ERC-20 token, this is typical of the advertising and general hype that we associate with memecoins.
Looking at CORONA Crypto’s block explorer, we can see that each block has a single “recipient” and consists of two transactions. The first transaction with no recipients is simply identified as a “non-standard”, while the second in most cases is from a “PoS” address to a standard CORONA Crypto address, possibly indicating coins being minted.
The block explorer website also has a “network” tab, listing two IP addresses, one located in the US and the other in Russia, presumably representing individual nodes. This low level of activity seems to indicate a lack of traction.
Despite this lack of activity, CORONA Crypto claims that its token is listed on two exchanges, Crex24 and Erex. UK IP addresses are prevented from accessing Crex24, but Erex does list CORONA on its platform.
Returning to the project’s main page, several pages are linked, including a Twitter account, a Discord channel, and a Github repository. This last link is particularly useful to assess the legitimacy of a project, how much support it has, and how active it’s development is. Searching through the source code, it became apparent that the majority of files had been copied directly from the official Bitcoin repository, in most cases not even bothering to change naming conventions.
Finally, there appears to be a single user contributing to the project, biohazard01, rather than a community of developers. There are no pull requests, which would indicate another user submitting work to the project’s repository, and there are no watchers other than biohazard01. Despite this, the CORONA Crypto block explorer, which shows only the last 100 confirmed blocks, continues to update with new transactions.
With the growth in COVID-19’s impact on communities around the globe, we expect COVID-19 to continue being a trendy theme in the crypto-community on which to capitalize. We will continue to monitor scams and other projects exploiting the publicity around COVID-19 to target the crypto community. Please email us about any suspicious crypto activity in connection with COVID-19 or otherwise, to assist in tracking these projects.
