There's a saying that evil never sleeps. That seems to be the case with the migration of Wombat and Atomichub to Spielworks.

What's the Actual Problem?

While the actual Atomichub NFT trading platform and Wombat app front pages are not compromised, deep within their details sit links to their social media, Discord being one of them. 

When Spielworks officially took over, part of the migration involved the establishment of new Discord servers, changing names, refacing and so on. In the midst of that technical fog, the old links associated with driving traffic to Wombat and Atomichub Discord servers were missed. As a result of this oversight, the vanity links that are provided by Discord were hijacked and taken over by other players, presumably to capture traffic and drive them possibly to scam activities. I can't say for sure myself since I didn't dig that deep and take the risk to find out. But the link definitely goes to a fake Atomichub site for the AH webpage. As for the Wombat side, it seems to link correctly to the actual, valid Spielworks server as of the writing of this article 24 hours later. 

The biggest giveaway of the fake AH server, as our PixelJourney team lead noticed right away, was the membership in the dupe server was extremely low for what AH should have been. That was a red flag to a veteran something was not right. However, to the regular eye, the dupe server looks fairly normal, and it raises the question how many people have already been compromised as a result.

Official Warning Sent Out

Spielworks posted a warning in their correct server within a few hours after unofficial noticing starting working the wire across impacted servers and players, confirming the hack. However, as of this morning the AH link to the wrong server is still active and the AH website has not been updated.

The ease with which the scam group took over the Discord vanity link and set up shop only emphasizes the need for redundant controls, especially during platform and website migrations. It only takes a few moments to redirect traffic online, and the damage can be immense with compromised accounts and clicking related traps. 

As for consumers, always think twice and be wary of joining up anything after a big platform change. It's usually a smart idea to wait, let the aggressive types jump in first, and let the traps get triggered if any. While that may mean not being first to trough on some crypto stuff, it can also mean avoiding your digital wallet getting sapped for everything in it too.

I'm purposefully not including to links to the compromised sites to avoid driving any other traffic to the same risk.