How the $500 Kit Turns a $TSLA Presale into a Scam

• The fake presale requests 12-word recovery phrases under a supposed 15% bonus.
• The fraudulent site accepts payments in bitcoin, ethereum, USDT, and dogecoin.

A scam kit sold for about $500 allows the creation of a fake presale for the $TSLA token and provides tools to steal cryptocurrencies and wallet recovery phrases. The investigation by cybersecurity firm Malwarebytes, published on August 10, 2026, reveals how this package combines a fraudulent website, phishing mechanisms, and a panel to control victims in a single operation.

The product is offered by an actor identified as "xrep," active in cybercrime forums since March 2026. According to Malwarebytes, the seller specializes in ready-to-use tools related to X, with products that require minimal technical knowledge to implement.

The analyzed scam was discovered on May 16 in a cybercrime forum. The kit consists of a website designed to appear as a legitimate presale of a supposed $TSLA token aimed exclusively at X users. The page uses Tesla's image and logo, supports multiple languages, and is adapted for computers and mobile devices.

The deception begins with a supposed eligibility verification. The visitor must enter their X username, and the site retrieves their profile picture to display a fictitious token allocation. In this way, the platform seeks to make the victim believe they were specifically selected to participate in the presale.

The page also incorporates mechanisms to generate urgency. A timer simulates the remaining time of the offer, while a fundraising figure increases and warnings about a possible price increase of the token are displayed. The goal is to induce the victim to act quickly without verifying the legitimacy of the supposed investment.

Once the user enters the process, the kit offers two main mechanisms to obtain their funds. The first consists of requesting the 12-word recovery phrase of the wallet under the argument that it is necessary to receive a 15% bonus. This information allows access to the funds, so providing it can leave the assets under the attacker's control.

The second mechanism requests the direct sending of cryptocurrencies. Among the assets mentioned by Malwarebytes are bitcoin (BTC), ETH, USDT, and dogecoin. The victim may believe they are purchasing $TSLA tokens, but the cryptocurrencies are sent to an address controlled by the scammer, and there is no actual purchase.

The fraud can continue after the first payment. The site shows a fictitious balance of tokens that the operator can modify from an administration panel to make the victim believe their investment is growing and motivate them to send more funds.

This panel also allows tracking the activity of victims, recording their X usernames and locations, and checking if a compromised wallet contains valuable cryptocurrencies. Operators can manage fake purchase orders and send personalized messages to request new payments.

For example, the scammer may inform a victim that their transaction is delayed and demand an additional fee to supposedly complete it. In this way, the same person can become the target of multiple collection attempts within the same operation.

These types of scams are becoming increasingly common. As reported by CriptoNoticias, a similar case occurred in April when the cybersecurity team Dark Web Informer reported the sale of a phishing kit that mimics the interfaces of the Ledger company. The package includes keylogging functions and real-time notifications via Telegram. Additionally, around the same time, a user reported losing 5.9 BTC after downloading a fake Ledger app from the App Store.

The case shows how cryptocurrency scams can integrate financial deception, credential theft, and victim tracking into a single tool. The price of $500 also reveals that access to this infrastructure can be within reach of criminals who lack the ability to develop such an operation themselves.

For users, the most important signal is that a presale linked to a known company must be verified through its official channels before sending funds. Moreover, a request for a wallet recovery phrase is, by itself, sufficient to dismiss the operation.

The emergence of products like this anticipates a scenario where scams may become more numerous and specialized, as the knowledge required to launch them decreases. This makes the ability to verify the origin of an offer more important than its appearance: a professional, customized site with real-time data can also be part of an operation designed from the outset to steal funds.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.