Singapore-Based Crypto Angel Investor Loses Entire Crypto Savings After Downloading Malware-Laden Beta Game Launcher

Singaporean Angel Investor Loses $100,000 After Beta Game Malware Scam

Mark Koh, a 44-year-old Singapore-based angel investor and co-founder of the victim support group RektSurvivor, recently fell victim to an elaborate malware scam that drained his cryptocurrency holdings worth S$100,000 (US$14,189).

The loss came after Koh, an experienced Web3 investor, downloaded a beta game launcher for an online game called MetaToy.

Mark Koh (left) with the man behind the internet meme ‘Hide the Pain Harold’. (Source: Mark Koh’s Linkedin)

Koh encountered the opportunity on Telegram on 5 December, where he was approached by a user named “Shanni,” claiming to be a co-founder of the MetaToy project.

He told a local news media,

“As someone who has evaluated countless Web3 projects, I believed I could identify scams, and this project looked legitimate.”

The professional appearance of the project’s website, Discord server, and the patient responses from the team convinced him to proceed.

Source: Mark Koh’s Linkedin

Malware Infiltrates Despite Precautions

After downloading the game launcher, Koh’s Norton antivirus flagged suspicious activity.

He performed full system scans, deleted flagged files and registries, and even reinstalled Windows 11.

Despite these precautions, within 24 hours, all software wallets connected to his Rabby and Phantom browser extensions were emptied.

Koh, who had accrued these assets over eight years, was shocked:

“I didn’t even log into my wallet app. I had separate seed phrases. Nothing was saved digitally.”

Koh believes the attack exploited multiple vectors, including a combination of stolen authentication tokens and a Google Chrome zero-day vulnerability first discovered in September.

He noted that the malware implanted scheduled processes and attempted DLL hijacks, both of which were partially blocked by his antivirus.

Lessons For Crypto Users From An Experienced Investor

Koh urged other potential targets, particularly angel investors and developers likely to download beta launchers, to take extra safety measures.

“So I would advise even if the usual precautions are taken to actually remove and delete seeds from browser-based hot wallets when not in use. And if possible use the private key, not the seed, because then all the other derivative wallets won’t be at risk.”

Police Report Filed And Ongoing Investigations

The incident has been reported to the Singapore police, who confirmed receipt of the report to the local news media.

Source: Mark Koh’s Linkedin

Another Singapore-based victim of the MetaToy exploit noted that the scammer remained in contact under the impression the victim was still attempting to download the launcher.

Sophistication Of Modern Crypto Scams

Koh’s experience highlights how cybercriminals are increasingly using sophisticated techniques to infiltrate systems.

Despite using multiple wallets, multi-signature setups, two-factor authentication, and air-gapped recovery phrases, he became a victim.

He reflected,

“I already use redundant wallets, cold wallets, (multi-signatures), have 2FA on everything, strong passwords, a password manager, air gapped physical recovery phrases. So believe me, you can be a victim still.”

The case illustrates how even experienced investors can fall prey to cybercriminals leveraging professional-looking online projects.

Koh’s story serves as a warning for cryptocurrency users to remain vigilant and to minimise digital exposure of assets, especially when using browser-based wallets.

Crypto Community Irony Hits Close To Home

Koh, who co-founded RektSurvivor to support victims of cryptocurrency fraud, now finds himself among those he once helped.

He wrote on LinkedIn,

“The irony is not lost on me. I’ve spent years helping others navigate these situations, and now I’m one of them.”

He hopes sharing his story will encourage others to take extra precautions and be mindful of the increasing sophistication of crypto scams.