Learn how the Frosties NFT scammers were caught

Our first article from this multi-part series on Rug Pulls defined a “rug pull” and explored how they work. Our second article described how a community can “fight back” against rug pulls by revitalizing and relaunching the rugged community.

In part 3 of this series, we will dive deep into the fabled Frosties NFT rug pull from earlier this year, in which the project’s founders were caught in the act of running away with over $1 million.

We will examine exactly what happened with Frosties, the steps the community and authorities took to track the founders down, and the 30,000-foot view of how a project can seek justice for a rug pull. 

Contents

How the Frosties NFT rug pull went down

Frosties was an 8,888 NFT collection of colorful, animated ice-cream-inspired characters in the fun, lighthearted vein of Doodles. The collection dropped on January 9th 2022 when ETH was over $3,000, and new users were still flooding into the space with the hope of striking it rich on the next BAYC.

There was massive hype for Frosties, with a metaverse game and staking mechanism promised as part of the future roadmap. Tens of thousands of hopefuls followed the project’s Twitter account and joined their Discord. NFT collectors of varying experience in the space aped into the project to the tune of roughly $1.1 million in sales. 

Then, in a tale as old as time (in which NFTs have existed), the anonymous founders pulled the rug on their community. Using aliases like “Frostie,” “Jakefiftyeight,” “Jobo,” and “Joboethan,” they shut down the project’s Discord and Twitter accounts and transferred the $1.1 million to a string of external wallets-not before tweeting “I’m sorry” to their holders, some of whom had spent tens of thousands of dollars on now worthless NFTs.

What happened next

But not to worry; this story has a happy ending.

Just before the anonymous duo was about to launch a follow-up rug pull project called Embers, which could have brought a $1.5 million haul for the scammers, authorities tracked them down. Friends Ethan Nguyen and Andre Llacuna of Los Angeles were arrested and charged by the DOJ for conspiracy to commit wire fraud and conspiracy to commit money laundering.

Michael Fasnello, currently the Crypto Compliance Officer at AnChain.AI, played a key role in the investigation by using his extensive legal, policy and compliance expertise and experience to put in the early investigative legwork.

Fasanello ran the project’s community wallet into a blockchain analytics software that listed all of the addresses the project founders sent community funds to, including several that were sent using Zero-Knowledge Proofs (like Tornado Cash, recently banned by the US Treasury) and Peel Chains, mechanisms meant to mask illegal and suspicious transaction activity.

Fasnaello proceeded to contact the IRSCI-the IRS’ Criminal Investigations wing-who took an interest in the magnitude of the case and used Fasanello’s initial research to take the next steps.

Fast forward three months later and the arrests were made.

“The arrested thieves allegedly hid behind online identities where they promised investors rewards, giveaways, and exclusive opportunities before implementing their ‘rug pull’ scheme – leaving investors with empty pockets and no legitimate investment,” said HSI Acting Special Agent-in-Charge Ricky J. Patel in the official press release from the DOJ after the arrest. “You can’t solicit funds for a business opportunity, abandon that business and abscond with money investors provided you,” continued Thomas Fattorusso, another agent on the case.

Llacuna and Nguyen now faces up to 20 years in prison.

How justice was served

Fasanello described to DappRadar how two distinct stories become clear when tracking down the orchestrators of a rug pull; that of the on-chain data and the human(s) behind the data.

“As victims and witnesses share their stories, it adds context. The blockchain analytics tells one story, but it’s very black and white – on-chain financial activity such as date, time, transaction value, and contract address. The backside is the PII (personal identifiable information)-who’s actually involved?”

Painting that full picture beyond what the blockchain data outlines is a holistic approach, Fasanello continued, involving many different parties working in tandem to piece together disparate threads of information.

“Everything came together to track the [Frosties] founders down – the blockchain analytics software, investigative skills of law enforcement, cooperation of victims and witnesses, and private analysts and investigators,” said Fasanello.

Lessons learned for future rug pulls

The DOJ press release defines a rug pull as “a scenario where the creator of an NFT and/or gaming project solicits investments and then abruptly abandons a project and fraudulently retains the project investors’ funds.”

This definition, and the legal proceedings of the Frosties case at large, are invaluable case studies in how the NFT community can deal with future Rug Pulls. 

Precedents have been set. Rug pull perpetrators have been brought to justice. Case studies like Frosties show that all is not lost in the wake of a rug pull. 

Steps for taking legal action

Careful, calculated steps can be taken in order to track down the criminals behind a Rug Pull and seek justice for the affected community:

1. Assess the damage:

Unlike in traditional finance channels, the blockchain is public. When a Rug Pull occurs, the stolen funds can be tracked as the perpetrators employ mechanisms to move funds out of the community wallet. This public information allows a community to assess how much money was stolen from the community, where it went, and who was behind the theft. 

2. Gather community and witness anecdotes:

As Fasanello described, public on-chain data is only valuable if examined next to anecdotes that paint a fuller picture of the personal details of the thieves. It’s important to gather and chronicle community and witness experiences in order to provide details that empirical data can’t, including virtual interactions with the Rug Pull organizers and transaction history with the community wallet.

3. Hire private blockchain investigators and intelligence experts:

A number of blockchain investigative and analytics agencies have formed in response to the shady behaviors that have unfortunately plagued Web3 in its incipient years of growth. As Fasenello is a testament of, these private investigations can run in tandem with, and even directly support, official ones.

4. Alert the authorities:

Once all of the possible initial legwork is done, it’s time to go to the authorities. It’s worth putting in calls to several government investigative agencies at the same time to see which ones show an interest and ability to open an investigation. The FBI, IRS, IRSCI, CIA and local law enforcement may all get involved. All of these entities are more likely to respond if the dollar amount of the rug pull is in the upper hundred-thousands or millions, and if the community has already begun gathering data and information themselves.

5. Activate the press:

Garnering press coverage is the simplest grassroots way to spread the word about an ongoing Rug Pull investigation. Information spreads quickly in the modern world, and getting your community’s story in front of as many people as possible is vital in order to attract as many possible witnesses and victims to share their stories.