Fortune Collective founder loses $1M worth of crypto in video phishing

Alex Choi, a co-founder of Fortune Collective, took to X to raise the alarm after he became a cautionary tale in a crypto exploit that wiped out $1 million from his portfolio.

In his post, Choi revealed the hackers got away with a considerable amount of money and emphasized the importance of thorough research and protecting one’s assets, admitting that the exploit was ultimately a side effect of his complacency.

I just got drained for $996,000 🧵

I’m honestly still processing that this happened and even writing it out feels completely unreal.

I just spent the last 24 hours looking into it, wiping out all my devices, and moving my files.

Part of me was considering whether I should even… pic.twitter.com/CWGddGG1vn

— Alexander Choi (@notalexchoi) September 6, 2025

What happened to Fortune Collective’s Alex Choi?

Choi posted a thread explaining the video phishing exploit, clarifying that he was not seeking sympathy, but to highlight the importance of vigilance regardless of his experience in the crypto space.

In terms of experience, Choi may be considered a veteran.

“It started with this account x.com/SparkTokenSOL (DO NOT INTERACT WITH ANY LINKS ON THIS PAGE) hitting me up,” he wrote.

Every coin has a community page and this particular one even had engagement from the founder, some mutuals with Choi, including his friends who are $SPARK whales.

Then, the account reached out to schedule meetings. After the first meeting, Choi relaxed even more, even though he checked his wallets to confirm nothing goofy had happened. All was well, and he claimed he did not accept any permissions during the meeting.

Two days after the first meeting, Choi hopped on another call with the account, and again, all went smoothly. He even said he met several people, learned their back stories and was buttered up with compliments and talks of how they would like to work with him.

The call ended with Choi trusting them even more. But two days later, while chatting about travel destinations with friends, Choi received an alert that told him his money was being moved.

By the time he got on his PC and looked through his wallets, he found the bad actors had moved nearly a million dollars.

After the initial shock wore off, Choi did more of the research he says he should have done before getting involved with the account. It was then that he realized the account had bot followers and a suspicious handle history—all red flags that would have scared him off had he done more than surface-level research when the account first reached out to him.

“The lesson learned is that you can never just skim the surface in crypto. Regardless of whatever mutuals you have, do your own research first,” Choi wrote.

He also advised against joining any sort of third-party call on apps like Microsoft Teams, Zoom, or Google Meet. One red flag the founder noted was that the bad actors insist on hosting the meeting by all means.

Hackers are now heavily into social engineering

In recent months, cybercriminals have been devising ways to exploit people’s trust in productivity tools like Calendly and Google Meet.

Their process typically involves sending invites that lead to a malicious Zoom extension download, compromising user systems. Victims of such schemes may notice unusual Zoom behavior, new browser extensions they did not install, and unauthorized access to their accounts as signs of infection.

One form of the attack begins with a Telegram message containing a Calendly link, which redirects to a fake Google Meet event. There, victims are prompted to download a Trojan horse Zoom extension, which is supposed to fix audio issues.

While the troubleshooting goes on, the extension gives the hacker control and access to the victim’s system allowing them to extract information or funds.

It is crucial to note that these schemes almost always depend on social engineering to draw you in. In Choi’s case, it was a DM on X from a project he had some links to.

Source