What happened
iZOOlogic Threat Intelligence published an incident report today on a campaign it calls PasteSwap, run by an actor using the alias 'Protocol Line', that urges users of the crypto swap services Changelly and SimpleSwap to run a supposed 'exploit' promising 1.25x to 1.55x returns on each swap. iZOOlogic says there is no weakness in either platform: victims are persuaded to run attacker-supplied code in their own logged-in browser session, which inflates the figures on screen so the swap looks profitable while silently replacing the deposit address and its QR code with one the operator controls, so the victim sends real funds and receives nothing. Lures were spread through a dark web forum post, underground forum private messages, Pastebin pastes and comment spam, clearnet crypto forums and two Telegram channels, t.me/byprotocol ('THE PROTOCOL ONE') and t.me/theprotocolone2 ('PROTOCOL ONE'), plus a backup channel t.me/theprotocolonebackup, leading to Google Docs lures and Google Sheets that serve the payload. iZOOlogic recovered four Changelly builds and two SimpleSwap variants; 13 of 93 decoded wallet addresses received funds, about $6,864 in victim proceeds between Oct 24 and Nov 5, 2026, which it calls a floor. It attributes the activity to the alias and its infrastructure, not to a named individual. Its advice: never paste code into the address bar or developer console, treat any 'exploit' that pays you as a scam, verify deposit addresses through the exchange's official app, and remove unknown userscripts.
How the scam works
Crypto phishing and draining sites ask you to connect a wallet, sign a transaction, 'claim' a token, or paste a recovery phrase. Once you approve the request, the operator can empty the wallet. Address-poisoning works differently: the operator sends dust or zero-value transfers from a look-alike address so that, later, a hurried copy-paste from the transaction history goes to them instead of to the address you meant. Always check every character of an address, and never connect a wallet or enter a seed phrase on a site you reached from a message, a pop-up or a look-alike URL. Official wallet and exchange brands named in a lure are not involved.
Source
Source: https://izoologic.com/threat-advisory/incident-report-pasteswap-fake-exploit-campaign-targeting-changelly-and-simpleswap-users/
