Skip to content

Instantly share code, notes, and snippets.

@rubycop
Last active September 24, 2023 21:19
Show Gist options
  • Save rubycop/6b149df55cbfd4702531b8125f19e915 to your computer and use it in GitHub Desktop.
Save rubycop/6b149df55cbfd4702531b8125f19e915 to your computer and use it in GitHub Desktop.
NDC Elections Fraud Activity

NDC Elections Fraud Activity

Last few days I discovered some abnormal activity in lot of accounts and detected votes buying (which is prohibited 🚫 by election rules).

4f257ce2d4f8eba2d4079a78bd3285ccbd8fe6de09780d38b98bc7e9090c218e

2 days ago binance account transfered 232.5572 Ⓝ to our first hero 4f257ce2d4f8eba2d4079a78bd3285ccbd8fe6de09780d38b98bc7e9090c218e and he created keypom drop for 35 accounts (on 3.5 Ⓝ each) fraud1 "ALL HUMANS RIGHT TO VOTE" fraud2

Here is a complete list of accoun's pub-keys

"ed25519:3UGStSw5kWnHKanVtngNypNigwX2uTGKQytVBxYjmziX",
"ed25519:8w9Dn9vn1G2qCsDLLj5miPLNapSXRpups275XJJAAxY",
"ed25519:HTxNAwcxpCwpmCbdLgmiSRPa1M2SbuNr4b6GUTuZx5hj",
"ed25519:EGswwYqfHGhAvnsSfeCyPNkr8GQwd1MJaSuiNatHKWsz",
"ed25519:6C8oNwPDuirAfayprhAZw6gxXCLjwD25Z7HM6DEDddX6",
"ed25519:9EWoi8V3wbAMwpHtM3TQNjR5sdUbjUqaUZeLKgdRZoc4",
"ed25519:8SSuLjWeKZkL84sJSyiYwgMzX9mfQK3Fitb1EQW9Ai59",
"ed25519:DnBwLEZduNPz1LDg99pD9chy7WDDRpsHdfsNMo4zTDTs",
"ed25519:63fpNwrVMhpvb3Dc1n8YtXCTmakGtmP1trEe6c6jzqqd",
"ed25519:G1sJbWe4hmbQEs9LjEkiR1E9YmMK5v28vWUCQkKrvZRu",
"ed25519:5k4DsS2XM1hAT8M8R11EVpceu3vyzhyq9Nwss6am9ZCD",
"ed25519:J7pnBpdYB66J6cnKv3EDS3v5uJ7GrdYWACCGSDYSAsBw",
"ed25519:HVt396fSXLy27GGbBN899kPtWCLiGsEN4G1W5TY5KmXY",
"ed25519:8Rk5qorJ3fqqkYCZfFc3Ck8Sw7gvyMEHgb6Xk7d3PTUR",
"ed25519:AUhPGJmFpmf7xgBeHqdu7SzxCNWEeHzWzVWTZNdWwqfr",
"ed25519:2NikeendM5NSdGgbV7sxqmmLKPbZiA1Mynocxs6qKwQT",
"ed25519:53AiyWvq6PhfNUH3EMMpLLYFprr84ciX7woNGgpxKqZ8",
"ed25519:5em5EqEwBxYzutXGSiCdb7yw6qiR6PHDs5EvBZ7P3ypi",
"ed25519:Gzz99Q4njznFsPPCT8TYopnCdn2w7u1LhkWsmJZPwdC8",
"ed25519:8SJYEjZoQXTi4qUQSnHN2quW3bzmVvEr1WnZ66PWsA1i",
"ed25519:HNrwPz3yzmbU4TMfXRDCXBggvCy288VdNEnxMSTAVzi3",
"ed25519:C98mKuf5JJi6o4X2M3bHBHd4AbTiMP3r8AN3Y5VnSVUw",
"ed25519:GXQ7vBg1QrtngV3bsehULAZjtZj4z4cXsxtkysPFdLfL",
"ed25519:C26oJdD4h6wjbPk9srWgX6Ej8Q5YLDKtRKX86KJykuC6",
"ed25519:9fSbDVxpCVU3KgVsH8b2xCwMDxoE1YbtEGeRDDFsB5J",
"ed25519:FbtDJodF3q5km2GZFAc3ryB7dTxP6Fkd6B4gyCgfU4BV",
"ed25519:Gf3YPoANXn9byD5pYpEmwhqXeQm7qmcwx2ugQPXm1uoy",
"ed25519:J4b3ZU4MGuAxFDPWTHD4j5qvujx6Uf4ViugK2in6yZLS",
"ed25519:6hQej7Wfmsbe2R7g1pLi14Hwy7LHqpAzB33T5VZ3UZjs",
"ed25519:5VZdYixTAYGgNakyHojzVhqFZcc4QF2hh5GCG2Hauyqv",
"ed25519:3aK7tpBWoxMbtd9Qsfy5PHnS6ezT4NzrhWydNHL7AaKL",
"ed25519:gGpeVv2FATcqwjje7PBg1uSts3G71L5asi9bo7uTfeq",
"ed25519:CKgiqgWZCuRgxw7UfurDp2ZYeNNU7fb1oM6aL86P4XyE",
"ed25519:H29FPEY2cBe2U1uhaPTKM7ch1cr1dniQjM4swCGorCBY",
"ed25519:7A2rrdkuSnFWvaLgVjmUGUAAn8UM4vYwLQnPVXVxdFMM"

fraud5 fraud fraud5

Drop was already used by these accounts (just from my observation, I guess all of 35 accounts already use a drop): Complete txn history is here https://pikespeak.ai/wallet-explorer/v2.keypom.near/history

richardregorio.near
ramonfarfan.near
tibyparedes2.near
jose1406.near
gerardosantana.near
jloc.near
njrams.near
esnelson1.near
c39e9e0b57b66b3ed2f68fac01ce54e9acaa796377b45c359219e2120abeaca3
jorgealonso.near
manzanilla.near
ginamm.near
gfwn.near
skarlygarcia.near
thaliadelarosa.near (not voting yet)
keky.near (not voting yet)
482cd58f7b4bf752115582bdd41895cc639f0174cd3c1033d41e1444367ff296 (not voting yet)

Keypom -> A -> B -> C

Very similar voting pattern and voted almost for the same candidates. Schemes:

  • thaliadelarosa.near received 2 Keypoms (2x3.5) 7 Ⓝ txn1, txn2. haliadelarosa.near sent 6.8 Ⓝ to claudiap55.near. claudiap55.near sent 3.12 Ⓝ to franyerblas22.near
  • keky.near received 2 Keypoms (2x3.5) 7 Ⓝ txn1, txn2 then sent 7.2 Ⓝ to maickool.near. maickool.near sent 3.42 Ⓝ to angyc.near

ulisesmarin.near

  • Here is the same situation with creating a drop but with 1 Ⓝ amount - but people claimed it 3 times Accounts that uses a drop:
7acd4ed7c6befdaddec4f97133155fd7e7b71ef31529b63b9679425e222f14f8
rusellvallina.near
alciviades1234.near
johanv8.near
edi0x.near
robert-po4p.near

fritzwagner.near

  • Here is the same situation with creating a drop 12 days ago which is with the 3.1 Ⓝ amount and used for votes (all claimers used it for voting)

Here is a complete list of accoun's pub-keys

"ed25519:GByjYLXSxmZbjG7aS5WmZEuwTKVGDsQLDqx4es897EG6",
"ed25519:5SUVfdzyzT26PSxxX3tKpvCtyw6c688mpcekpwqcUBiq",
"ed25519:3igiwrtYgV7gUpXQGotR4zJEAcNJvV6kjczviLtXY7q2",
"ed25519:4Wc3AbzoRHL5XFG3t3xJRaQb61WEd7Rub8wyFSU6HP7Q",
"ed25519:4AaHMYfn4TRoQGhQyobUCVC3GitW2p9gwe9KyBccce8C",
"ed25519:GG5vqrCcMf8GqHgPd6rbJLTm6zMuKCxYSuYqXTovhtbR",
"ed25519:479F5KcXDPbrcLdEQv6A9P8YR3tRp9aXUacKsK3PKyHi",
"ed25519:6duCrkur4NZn4VuzWgCjV3ta7NZD2YiQnJ5zWfMFHbjg",
"ed25519:27Rw47bcXVJikDtMUJwCtZ4USzkPaDNP3AQmRxvcgF3Q",
"ed25519:F4hZNENrwP4xj42qidTJHpc1nBrsqk8E8xb4TqTpxbf3",
"ed25519:BtuioCzUzAiXkEQ6LKFqfq7ga6EeFzvpX6gP2dfU4G1F"

Drop was used by these accounts:

jorgealonso.near
mvtrading.near
sebastianrosa.near
hrpalencia.near
52cc46a235a5a291ff13cd82862f5328b690651f14812419a8a2c96cffc6da21
  • Account sent 20 Ⓝ to jloc.near - then it voted for Fritz. fraud3

Moving from Grey to Whitelist Scheme (some of examples)

It's about moving accounts w/o any reasons from grey to white

All of them were created as childs from xabilosada.near. Identical Voting pattern. All sub accounts created 30d ago (greylisted).

P.S.

It's just my observation and is not a final list of accounts and cases. Hope EIC will discover all cases and provides detailed report

@Fritzmwagner
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment