Protocol social channel has scam-coordinator flag
A threat intelligence & recon factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This episodic signal fires when the curator's scam-coordinator watchlist identifies a member of the protocol's official Telegram or Discord community channels as a known scam coordinator — an account previously associated with coordinated social-engineering attacks, fake-airdrop scams, or phishing campaigns targeting DeFi users. Detection is manual curator monitoring of protocol social channels combined with cross-referencing against a maintained scam-coordinator database. Category 11 context: scam coordinators embedded in community channels are both a direct attack vector (phishing links in community posts) and a reconnaissance channel for gathering intelligence about team behavior and user wallet sizes.
**Why it matters** Community channel infiltration is documented in several dataset incidents as a concurrent attack vector. Badger DAO ($120M) saw coordinated social media amplification of the malicious approval-harvesting campaign. Infini ($49.5M) involved a rogue insider with both on-chain access and social channel presence. In the broader DeFi landscape, fake-airdrop scams launched from compromised community channels have drained tens of millions in aggregate. A scam coordinator embedded in the protocol's official channels has access to user sentiment, deployment timing discussions, and team communication patterns that can inform timing and targeting of a concurrent on-chain attack.
**Green / Yellow / Red** Green is the baseline when no known scam-coordinator accounts from the watchlist are identified as members of the protocol's official community channels. Yellow fires when an account with medium-confidence scam-coordinator attribution (curator-flagged but not cross-confirmed by multiple sources) is identified in the community. Red fires when a high-confidence scam coordinator (confirmed by multiple independent sources or with documented prior phishing campaigns) is identified as an active member of the protocol's primary community channel.
**Common gray cases** Gray applies when the protocol's community channels are fully private or invite-only and the curator cannot access them to perform the monitoring sweep, or when the channel is very large (100,000+ members) and comprehensive monitoring is impractical.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether a protocol-adjacent social channel admin is flagged on the curator scam-coordinator watchlist.