Webaverse Hack

On November 26, 2022, Webaverse, a Web3 metaverse game engine, lost 4 million USDC (about $4 million) to scammers posing as investors, during a meeting in a Rome hotel lobby. Webaverse did not disclose the theft until February 2023.

The scammers approached co-founder Ahad Shams while Webaverse was raising its Series A. They claimed to represent an investor, "Mr. Safra", and worked on Shams for weeks through emails, video calls and fake KYC documents. They then asked to meet in Rome for a "proof of funds" check. Shams created a new Trust Wallet account on a device the company rarely used and moved 4M USDC into it. At the meeting, the fake investor asked to see the balance and photographed the screen with his phone. No private key or seed phrase was shown, and Shams said he was not on public WiFi.

Minutes after the fake investor left, the USDC was taken out of the wallet in six transactions to six fresh addresses. Most of it was swapped through 1inch into ETH, wBTC and USDT, moved through 14 addresses, and about 83% ended up in one address. How the attackers got control of the wallet is still unknown. Trust Wallet's CEO said the wallet itself was not at fault and called it likely organized crime. Shams reported the theft to police in Rome and filed an IC3 complaint with the FBI. Investigators found that the same group had targeted others using matching document signatures. Webaverse said it still had enough capital for 12-16 months of operations.