Will Never DM You First
Inside the Scam Economy of Open Communities
Every crypto channel pins the same frantic warning: the admins will never DM you first. This is the field guide to the scam economy behind that line — impersonated admins, deepfaked founders, pig-butchering, and entire synthetic communities — traced across three eras, from spam to crypto to AI, and the one question that ends it: who is in the room?
Parts I and II are free to read here: the first seven chapters.
That warning is really a confession. A community that has to pin "the admins will never DM you first" is admitting it can no longer tell its own founders from the impostors wearing their faces — so it gives up and tells you to trust no one. This book is about how it came to that, and why the same thing happens everywhere open communities form.
The argument runs through three eras, in the order the damage actually arrived. First, cryptocurrency dropped instant, irreversible, anonymous value into rooms full of strangers, and nuisance spam turned into predation. Then large language models removed the last reliable tell — language itself — and let a single operator run thousands of fluent, around-the-clock personas. Every defense the industry has shipped keeps breaking on the same wall, and the book shows, in technical detail, exactly where and why.
Then it takes the machine apart. You'll come to understand the supply chain behind a modern scam the way you understand the supply chain behind any product on a shelf — the tooling, the labor, the pricing, the margins — and why the people running it behave like the businesses they are. And you'll see the family of approaches the field is finally converging on to answer the question all of it turns on, and to make the whole economy unprofitable.
It's written by an engineer who spent years building inside exactly these rooms: opinionated, concrete, and citation-rich, closer to a tired security engineer's notebook than a textbook. If you run an open community, build in crypto or Web3, work in trust and safety, or just want to understand the machinery behind the messages in your inbox, it will change how you see every open room you walk into again.
What's inside
The book follows the damage in the order it arrived: spam, then crypto fraud, then fraud scaled by AI. Then it takes the scam machine apart, looks at what defenders have tried, and ends with the question every scam exploits: who is in the room?
Part I · Before the Crypto
Part II · When the Crypto Arrived
Part III · The Machines Pass for Human
Part IV · The Battlegrounds & the Anatomy
Part V · The Response, and Why It's Losing
The vocabulary of the scam economy
Terms from the attacker's, the defender's and the identity researcher's worlds. Each links to the chapter that explains it.
One actor wearing many faces. Named and formalized by John Douceur in 2002, who proved that without a central authority an entity can forge a number of identities scaling with its resources, and that no amount of inspecting the identities can collapse the many back down to the one. It is the structural problem at the center of this book.
A long-con investment-romance fraud in which the victim is cultivated over weeks before being drained. The FBI's IC3 reported roughly $7.2 billion in crypto-investment-fraud losses in 2025 — the category pig-butchering dominates. The grotesque name (from the Mandarin shā zhū pán) describes "fattening" the victim before slaughter.
A rented toolkit that empties a victim's crypto wallet once the victim is tricked into signing a malicious approval. Operators take a commission — roughly 20 percent in the Inferno-to-Angel-to-Lucifer lineage tracked by Flare — and handle the laundering. DaaS is the clearest proof that this is an industry: the attacker no longer needs to build anything, only to drive traffic.
The third family of Sybil-resistance: a mechanism that tries to establish that an account is backed by one distinct living human — the one-to-many uniqueness question ("one human, one enrollment"), which is harder than the one-to-one authentication a passkey performs. The term was introduced by Bryan Ford and colleagues at a EuroS&P workshop in 2017. Approaches include biometrics (World ID's iris scan), social vouching (BrightID), and aggregation (Human Passport). Crucially, proof-of-personhood is not Sybil-immune: as the DeSoc paper concedes, an attacker can recruit or rent real humans, each of whom passes the test once but on the attacker's behalf. And in the agentic era it is increasingly the wrong question — see Accountability.
Smuggling instructions into the text an AI model reads so that the model obeys the attacker instead of its operator. OWASP ranks it the top large-language-model risk (LLM01:2025); in this book it appears both as a way attackers jailbreak models and as a way they hijack defenders' AI moderators.
A tamper-evident, cryptographically signed claim that a holder can present and a verifier can check without contacting the issuer. The W3C data model standardizes the format; VCs are the connective tissue of the four families described in Part VI.
Get Chapter 8 free
Subscribe and Chapter 8, The Inflection, opens for you on this site. Invite friends and the rest of Part III opens too.
One email to confirm, then an occasional note about the book. Unsubscribe any time.
I'm a blockchain engineer, and I've spent the last several years working on Polkadot — at the layer where cryptographic identity and on-chain reputation stop being whiteboard abstractions and become code that real users have to trust. I began on the developer-support team at Parity Technologies, where I helped create the Polkadot StackExchange and became one of its top-five all-time contributors — a vantage point that meant fielding the same questions thousands of builders were actually stuck on, day after day — and wrote official SDK tutorials, reference guides, and documentation.
The author also builds Targa, a security product for Telegram communities, and this site is hosted on its domain. The book is an independent work about the whole field. It does not mention Targa or recommend any product. →