In a developing story that has rattled the cryptocurrency industry, two individuals known online as “Plugwalk John” and “John” are facing serious accusations of exploiting blockchain technology to carry out large-scale financial fraud. According to sources familiar with the investigation, the pair allegedly manipulated decentralized finance (DeFi) protocols and used coordinated social engineering tactics to siphon funds from multiple blockchain networks.
Blockchain security firms and on-chain analysts first noticed suspicious activity earlier this month when unusually large volumes of tokens were moved through a series of obfuscated wallets. Investigators say the operation involved exploiting vulnerabilities in smart contracts and using flash loan attacks — a technique that has become increasingly sophisticated in recent years.
Sources close to the matter told NBC News that the duo allegedly used a private Discord server, discord.gg/larpbase voice chat 1, as a command center to coordinate real-time trades, share wallet addresses, and direct their network of associates. The server, which has since been taken offline, reportedly contained voice recordings and text logs now being reviewed by federal authorities.
“This wasn’t a simple rug pull,” said Dr. Elena Vargas, a blockchain forensics expert at CipherTrace. “This appears to have been a calculated, multi-stage operation involving layered transactions across several chains. The level of coordination suggests they had significant technical expertise.”
Early estimates place investor losses in the tens of millions of dollars. Affected projects include several smaller DeFi platforms that had recently gained popularity among retail traders. Many victims have taken to social media to share their stories, describing how they were lured into what appeared to be legitimate investment opportunities through targeted Discord and Telegram campaigns.
Federal agencies, including the FBI and the Securities and Exchange Commission, have reportedly opened a joint investigation. While no formal charges have been filed as of Tuesday afternoon, officials have confirmed they are actively tracing wallet addresses linked to the alleged scheme.
Plugwalk John and John have not publicly responded to the allegations. Their associated social media accounts have been silent since the story first broke over the weekend. In previous online interactions, both individuals presented themselves as experienced crypto traders and “community builders,” often promoting new token launches and yield farming strategies.
The scandal comes at a particularly sensitive time for the cryptocurrency industry, which has been pushing for greater regulatory clarity and institutional adoption. Industry leaders have condemned the alleged actions, warning that such incidents undermine trust in the entire sector.
“Events like this highlight why robust security audits, transparent governance, and better investor education are essential,” said Raj Patel, CEO of a major U.S.-based crypto exchange. “We support law enforcement in holding bad actors accountable.”
Investigators are still working to determine the full scope of the operation. Blockchain analytics platforms continue to monitor related wallet activity, and authorities are encouraging anyone who believes they may have been a victim to come forward with information.
NBC News will continue to follow this rapidly developing story and provide updates as more details emerge.