Input Output Group (IOG), the company behind Cardano's development, warned users to avoid its official YouTube channel on Friday, September 18, after an apparent account takeover was used to broadcast a fraudulent cryptocurrency giveaway built around a suspected AI-manipulated video of Cardano founder Charles Hoskinson.
IOG said through its official X account that users should avoid interacting with the channel "until further notice," and warned people not to click links, transfer funds or provide personal information through material appearing there.
The Broadcast
The suspicious livestream ran for close to two hours, presented as a Project Catalyst town hall and using branding associated with Cardano's community-funding program, crypto.news reports. Footage resembling Hoskinson promoted an offer claiming viewers could "double your wealth" by following instructions linked through a QR code, per CoinCentral and Blockonomi. No evidence reviewed shows Hoskinson or Project Catalyst authorized the promotion.
The verification picture is deliberately narrow, and worth stating plainly. IOG has not said how access was obtained or who was behind the takeover. No official post reviewed confirms the channel has been fully recovered. The video is described as AI-manipulated on the basis of its appearance — no forensic report has confirmed how the footage was produced, and scam operators can also use edited historical material or synthetic audio. No wallet address associated with the broadcast has been published, no losses have been disclosed, and no blockchain-forensics attribution has been issued. Everything about the attacker, the method and the take remains unverified.
An Old Format on a Legitimate Channel
The format itself is one Cardano has warned about for years. The project's official scam guidance specifically describes ADA giveaway schemes in which scammers promise to double a user's holdings after an initial transfer, and names fake Hoskinson livestreams as a recurring vehicle. The Cardano Foundation documented the same technique as early as 2020, and its X account was itself compromised in December 2024 and used to publish a false SEC lawsuit claim.
What changed here is the delivery surface. Giveaway scams normally run through impersonator accounts that users must be tricked into finding; this one ran through the ecosystem's own official channel, with its established subscriber base and legitimacy already in place. The attacker did not need to defeat a phishing filter — only to take over an account whose authority was borrowed from the organization itself.
The practical lesson generalizes beyond Cardano: a verified badge authenticates the channel, not the content currently streaming on it. Anyone can be momentarily sovereign over a hijacked official account. For projects, the checklist is about speed and channel redundancy — a warning posted on X within the first minutes, as IOG did, only helps users who see it before they see the stream.
Cardano's guidance remains the correct one: legitimate giveaways never require sending cryptocurrency first, and transfers to a scam address cannot be reversed by developers.
TrustGrade tracks the security posture of platforms and projects across digital assets. Verified trust data: trustgrade.ai.