Toma de Twitter de El Universal para fraude con NFT

What this source supports

• The verified @ElUniversal account was taken over on 4 June 2022 and its display name, biography and profile images were changed
• the account promoted Goblin Town NFT content
• a preserved image of El Universal Instagram post says @ElUniversal was not official and its messages were not the newspaper responsibility
• IPYS quotes information chief Alan Lugo saying the technical team determined it was a hack and was awaiting Twitter response after verification/authentication
• as of 21 June the account had not been recovered while the website and Instagram remained operational

Evidence limits

IPYS is an independent Venezuelan press-freedom organization, not the victim. The victim post is preserved as an on-page image but its current Instagram permalink is unavailable; exact recovery time and access method remain unknown.

Relevance to this case

Strongest direct reporting because the live page contains a named El Universal source, a preserved victim statement and contemporaneous IPYS alert.

What this source supports

• The article reports that @ElUniversal was taken over on 4 June and had about 5.1 million followers
• the display name became goblintown.wtf while the fraudulent linked domain was goblintowm.wtf
• the account promoted a false 10,000-Goblin offer
• a user alleged loss of two MAYC and eight Cool Cats
• NFTherder alleged an ApprovalForAll mechanism and wallet linkage to an earlier Azuki Beanz scam

Evidence limits

Secondary specialist report. The NFT losses and wallet linkage are attributed allegations, not a complete or independently validated loss total; the article does not establish initial access or actor identity.

Relevance to this case

Retained as contemporaneous corroboration and as provenance for the exact account-state, analyst and user-claim X posts.

What this source supports

• The article reports the takeover of the El Universal Twitter account with more than five million followers
• it identifies goblintowm.wtf as a fake imitation of GoblinTown.WTF
• it reports that MetaMask classified the linked page as phishing
• the article attributes wallet-draining mechanics to Web3 is Going Just Great

Evidence limits

Secondary specialist article. Its displayed 9 June phrasing does not override stronger 4 June chronology, and its broader Venezuela-phishing comparison does not establish a common actor.

Relevance to this case

Retained as Spanish-language corroboration of the fake-domain spelling and phishing purpose.

What this source supports

• The archived @ElUniversal profile visibly displays goblintown.wtf as the account name
• the profile biography and link contain the fake goblintowm.wtf domain
• the account shows approximately 5.1 million followers

Evidence limits

The archive proves the public profile state at capture time, not the initial access method, actor identity or total phishing losses.

Relevance to this case

Added as the strongest direct visual artifact of the compromised account state.

What this source supports

• IPYS reported that the @ElUniversal account had been hacked the prior day
• the post says attackers changed the name, biography and profile images and retweeted unrelated content

Evidence limits

Institutional contemporaneous alert, not a victim-authored technical report.

Relevance to this case

Added as exact primary provenance for the contemporaneous IPYS alert.

What this source supports

• The post says @ElUniversal had been hacked on 4 June and was promoting Goblintown scam NFT posts
• the attached image visibly shows the altered profile and approximately five million followers

Evidence limits

Independent analyst observation; it does not prove initial access or actor identity.

Relevance to this case

Added as exact contemporaneous visual corroboration of the altered account.

What this source supports

• The analyst alleges the Goblintowm contract used ApprovalForAll
• the analyst alleges that the responsible wallet had previously conducted an Azuki Beanz scam

Evidence limits

Analyst allegation without a complete on-chain methodology in the post; not attribution of the El Universal account-access actor.

Relevance to this case

Added only as claim-scoped context for the phishing mechanics and wallet linkage reported by CryptoSlate.

What this source supports

• The user self-reports that two MAYC and eight Cool Cats were taken after interaction with the phishing site

Evidence limits

A first-person allegation; no independent ownership, transaction or causation validation was performed. It is not a total-loss estimate.

Relevance to this case

Added to preserve the exact provenance and limitations of the 10-NFT allegation.

What this source supports

• The report records the 4 June @ElUniversal takeover
• it says the victim communiqué disclaimed messages from the account
• it cites IPYS for the changed profile and Goblin Town content and preserves the victim Instagram/IPYS provenance

Evidence limits

Retrospective civil-society report that relies on victim/IPYS material; corroborates chronology and provenance but is not technical evidence.

Relevance to this case

Added as durable report-level corroboration and citation trail for the victim statement.

What this source supports

• The entry reports the verified El Universal account takeover and fake goblintowm site
• it reports that one associated wallet held 64 NFTs and 16.5 ETH while explicitly warning that this likely was not the total
• it links the archived compromised profile and exact NFTherder post

Evidence limits

Secondary synthesis; the observed wallet balance is not a complete loss total and does not establish who took the account.

Relevance to this case

Added as independent, claim-aware corroboration and provenance for the archive.