Input Output Group, the engineering company closely tied to Cardano, told users on Sept. 18 not to interact with its YouTube channel after an apparent compromise led to a suspicious livestream featuring what appeared to be Charles Hoskinson promoting a crypto giveaway.

The company said users should not click links, send cryptocurrency or share personal information until it confirms the channel is secure again. At the time reviewed in the source report, IOG had not explained how the channel was accessed, identified who was behind the incident, or confirmed that control had been fully restored.

Warning followed hours of suspicious activity

The fraudulent-looking broadcast reportedly remained live for nearly two hours before or during IOG’s public warning. The stream was presented as if it were connected to Project Catalyst, a real Cardano community-funding program, which gave the event a more convincing appearance.

Even so, no official Catalyst source cited in the report had announced a legitimate town hall matching the giveaway stream. IOG also had not published any wallet address tied to the scam, and there was no verified public accounting of whether viewers sent ADA or other assets after seeing the broadcast.

The report further noted that no credible blockchain-forensics firm or security researcher had publicly provided verified attribution, wallet balances or transaction trails specifically linked to the Sept. 18 incident.

A familiar Cardano giveaway scam format

The setup closely matched a long-running type of fraud already documented in Cardano’s own scam-awareness materials. Those guides describe schemes in which victims are promised that their ADA will be doubled or otherwise increased if they first send funds to a specified address.

Cardano’s published guidance says legitimate giveaways do not require users to transfer crypto in advance. It also stresses that once assets are sent on-chain, developers or ecosystem groups cannot simply reverse the transaction.

The Cardano Foundation had warned about similar tactics as far back as 2020, saying scammers were taking over established YouTube accounts, impersonating Cardano-related entities and using trusted branding to push fake offers. It has previously said that neither the Foundation, EMURGO nor Input Output would run promotions that require users to send ADA or another token first.

Project Catalyst branding added credibility

The use of Project Catalyst imagery and framing was significant because Catalyst is a genuine Cardano initiative. Its official website describes it as a community funding system where participants submit, review and vote on proposals, with 2,221 proposals funded across completed rounds.

Input Output had historically been involved in running the program. A Catalyst update from February 2026 identified IOG as operator while responsibilities were being reorganized alongside the Cardano Foundation and Intersect. By June, Intersect said administration had moved from IOG to the Cardano Foundation, with the remaining milestones from one IOG Catalyst project canceled and 2.06 million ADA returned to the treasury.

That history meant the branding choice placed the fake stream in a believable Cardano setting, despite the lack of any confirmed official event corresponding to the broadcast.

Questions remain over the video and the breach

The suspicious stream has been described as AI-manipulated, but the report said no technical forensic review had confirmed how the apparent Hoskinson footage was made. Possible methods could include edited archival clips, altered audio, synthetic voice tools or fully generated video.

That distinction remains unresolved, and the article noted that IOG’s own previous experiments with AI-generated content were unrelated to the Sept. 18 event. In this case, the company’s position was clear: the YouTube channel should be treated as unsafe until further notice.

IOG had not, at the time of review, disclosed whether multi-factor authentication had been bypassed, whether any other corporate accounts were affected, or whether the intrusion went beyond YouTube administrative access.

Not the first compromise involving Cardano-branded accounts

The incident follows earlier security problems involving trusted Cardano-linked communication channels. In December 2024, the Cardano Foundation’s X account was compromised and used to spread a false claim that the U.S. Securities and Exchange Commission had sued the organization and that ADA support would end.

That episode was separate from the latest YouTube case, but both involved official-looking channels carrying unauthorized messages. Community reports and forum posts also show that fake Hoskinson-themed livestreams have circulated for years, including self-reported losses tied to giveaway scams on YouTube.

For now, the only confirmed next step is IOG’s own guidance: users should avoid interacting with the channel until the company issues a follow-up notice stating that normal control has been restored.

Source: crypto.news