The “Grayson” Scam Cartel

A string of fraudulent projects on the Cardano blockchain netted the scammers multi-million USD funds, and is still active.

5 min readJan 25, 2022

The scam cartel consists of (at least) the following websites/projects:
VerluxNFT, IDOwall, Rocketpad, Coollaunch, and CanonX. Related scams, like PanaSwap, are not detailed here, for Ravendex see this article.

EDIT Jan 26:
The same group was responsible for last year’s infamous plutuswap scam.

All known scams of the Grayson cartel are using the same modus operandi:

Selling tokens for non-existing projects without real development
Use of paid releases on news sites, PR channels and feeds to promote the respective fakes, with nearly identical wording and identical release schedule
Project websites with copied and misleading content, all registered and hosted at NameCheap, mostly related to IDOs, fundraising and “DeFi tools”, mock-ups of apps without code
All tokens minted over the same web service (CANON, VLX, COOL, WALL, ROCKET)*
Fake teams with generated or stolen pictures and (poorly) made up bios
Twitter accounts and Telegram channels to recruit and motivate new victims to buy as much as possible in all sales phases.

The name of the cartel is derived from Ravendex’ community manager, a Nigerian national who uses the name Alexander Gray C, Odey Alexander or “Alex O. GraySon”. Variants of this fake name pop up in many of the scams listed here. “Grayson” claims to be a web designer and community manager. No other skill or occupation has ever come up with any of these scam sites, therefore it is even possible he is running the cartel alone.

“GraySon” has a hosting account at namecheap.com, and it seems there are others interested in his activities already.

Thanks to a logical flaw at the namecheap website, it has be shown with high certainty, that at least 3 of the scam projects named here are registered to the same account*. It is fair to assume, that this is exactly that same person.

All these scam sites have roughly the same look&feel, and content copied from each other. All have more or less english typos of the same kind. The common structure has a sale.[scamsite].io or [scamsite]/pre-sale.html as the central element where victims are led to be stripped off their money.

*these details are available to relevant authorities.
In more detail:

CanonX

CanonX.finance created Oct 12, 2021. With the CANON token, it was the first known and shortest-lived incarnation. Exit scam performed in December 2021, when the scammers disappeared with all funds taken in at apparently 2 sale rounds.

Twitter handle and website deleted (simultaneously with maintenance of the coollaunch.io website, see below), telegram channel handed over to professional criminals — don’t visit, as every click leads to malignant sites.

Had a fake team of 2 persons with fantasy bio, later partially reused at Coollaunch. Images generated probably at generated.photos, like the IDOwall “team”.

VerluxNFT

Verlux.io, created Oct 18, 2021. Token named VLX. Stylish and most advanced, maybe bit overdone but popular. This particular fake was described here before: [VerluxNFT].

“GraySon” runs the Telegram channel, although he first denied this and claimed someone would impersonate him. His telegram handle is nonetheless unique and now openly used in both groups. The whole Verlux team is proven to be fake, for details see my other article. Grayson also named the fictional founder & CEO accordingly.

IDOwall

IDOwall.com created Oct 10, 2021. Alleged IDO and DeFi project with WALL token. First twitter handle deleted (@idowallproject) for terms violations.

Hired a Swedish PR agent for representation, claims now to be located in Sweden, but the address is not existing in that country.

The “team” at IDOwall has some hilarious details, with generated photos that are directly derived one from another and got edited after the fake was identified. This can be visualized by such an overlay:

IDOwall now promises a wallet app, where victims can use diverse DeFi tools and invest into IDOs on Cardano. Sending any funds directly to a wallet run by a scam team which is demonstratedly using fake identities, if it is existing at all, is strongly discouraged. Any attempts to make such an app available in app stores will lead to criminal investigations.

Rocketpad and Coollaunch

Rocketpad.community and coollaunch.io created on Oct 28 and Nov 16, respectively. Tokens ROCKET and COOL.

This is a twin scam site, where many contents including the project logo and the description are re-used with little or no changes. Even the font is the same (it is/was also used at IDOwall, Ravendex, and PlutuSwap).

Some sections are direct copies, sometimes also including the same typos. The original source for this part is kick.io, where the text was stolen.

Rocketpad has also hired a social media rep (from Slovakia), and is now talking about launching a wallet/defi app.

For its token sales, Rocketpad presents a “MVP” which is in fact a static website, thus misleading victims to believe into real development. The same is happening at Verlux, IDOwall, and Ravendex.

All status bars and links are fake, only the typos are real

Coollaunch is the newest money grab of this cartel, but one of the team has a name to remember: This is the “Grayson” no.4. His bio is derived from a fake team member’s bio on the now deleted CanonX site.

tl;dr

Rocketpad, Coollaunch, IDOwall, Verlux, and perhaps other such projects, are fake. Their only purpose is to steal from investors. Don’t send any ADA to these, it will be lost — as happened already with CanonX. That particular exit scam was performed by the very same criminals.