Phantom Node

Modus operandi

Operated fake "liquid staking" and validator pools promising outsized rewards. Real validators never existed; "rewards" were paid from new deposits (a staking-flavored Ponzi) until a withdrawal wave exposed the empty node set.

Evidence collected

• 1Advertised validator addresses had zero on-chain attestations.
• 2Reward payments traced to depositor inflows, not block rewards.
• 3Dashboard "uptime" was a hard-coded 99.9%.
• 4Operator reused infra from a prior shut-down scheme.

Crime timeline

1. 2023StakeForge opens

   "Liquid staking, 21% APR, audited."

2. 2023Inflows peak−$31,000,000

   Deposits cover fake rewards.

3. 2024Withdrawal wave

   Pool insolvent; site goes dark.

4. 2024Cold trail

   Operator suspected to be staging a relaunch.