As of Mid-July, HALO’s HUMINT team identified a “Michael Sonnenshein” impersonator on Telegram using the handle, @Michael_Sonnenshein. The profile bio described him as a “God fearing man, 7 years experience with Grayscale.” The impersonator offered the opportunity to invest with “Grayscale”, claiming a return of 10x the initial investment. The impersonator claimed that his website was currently under construction, but after funds were sent, he would send a private registration link. The threat actor also provided two certificates as part of his bona fides.
A Certificate of Incorporation for “Bitcoin trading/forex signal” incorporated on 21 Sep 2018 in New York.
A certificate from the Commerce Department for “24primeoption Ltd.”

The impersonator also provided a bitcoin wallet address. Initial blockchain analysis indicated this wallet address was linked to a potential aggregator wallet address which could possibly be an exchange based on volume of transactions.