{
  "meta": {
    "exportedAt": "2026-09-22T16:46:58.949Z",
    "formatVersion": 2,
    "selection": {
      "q": "communicated-with",
      "system": "",
      "harm": "",
      "context": "",
      "country": "",
      "role": "",
      "relation": "",
      "evidence": "",
      "year": "2026",
      "response": "",
      "severity": "",
      "verification": "",
      "view": "incidents",
      "sort": "added"
    },
    "totalIncidents": 1,
    "coverage": {
      "cases": 1,
      "countries": 1,
      "languages": 1,
      "unknownLocation": 0,
      "locationPending": 0,
      "unknownLanguage": 0,
      "unknownDate": 0,
      "lawsuits": 0,
      "regulatory": 1,
      "minors": 0,
      "coreRelations": 1,
      "contextualRelations": 0,
      "mixedRelations": 0,
      "unknownRelations": 0,
      "relationPending": 0,
      "relationUnknown": 0
    },
    "countingNote": "Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.",
    "affectedCountNote": "Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.",
    "source": "NOPE Incident Tracker",
    "url": "https://nope.net/incidents",
    "license": "CC BY 4.0"
  },
  "incidents": [
    {
      "id": "2026-russia-chatgpt-phishing-crypto-theft",
      "caseFacts": {
        "claims": [
          {
            "id": "c1",
            "status": "corroborated",
            "evidence": [
              {
                "locator": "'ChatGPT... выдала ссылку на страницу, которая оказалась сайтом мошенников'; '1 904 513 FXRP — примерно $2,1 млн'; 'unlimited approval'.",
                "relation": "supports",
                "source_id": "s1"
              },
              {
                "locator": "'12 июня 2026 года... обменять токены sFLR на WFLR. Он посоветовался с ChatGPT'; 'ссылка на sceptre.network — точную копию легитимного сервиса sceptre.fi'; '1 904 513 FXRP — примерно $2,1 млн'.",
                "relation": "supports",
                "source_id": "s2"
              },
              {
                "locator": "'Криптоинвестор потерял около 180 миллионов рублей после перехода по фишинговой ссылке, которую посоветовал ChatGPT'; 'похитили около 2,1 миллиона долларов'.",
                "relation": "supports",
                "source_id": "s3"
              }
            ],
            "assertion": "On 12 June 2026 a Russian-speaking investor asked ChatGPT in Russian where to swap sFLR for WFLR; ChatGPT returned a link to sceptre.network, a phishing clone of sceptre.fi; he connected his wallet, signed an unlimited-approval transaction, and about 1.9 million FXRP (~$2.1 million) were drained.",
            "causal_attribution": "The on-chain analysis (VAL, carried by s1/s2/s4) and the MVD confirmation (s3) are independent chains for the loss and the ChatGPT-link mechanism."
          },
          {
            "id": "c2",
            "status": "reported",
            "evidence": [
              {
                "locator": "'фишинговая ссылка появлялась только в ответах на русском языке. При аналогичных запросах на других языках ChatGPT её не выдавал. Мошенники целенаправленно \"отравляли\" данные для русскоязычных пользователей.'",
                "relation": "supports",
                "source_id": "s2"
              },
              {
                "locator": "'Сейчас фишинговая ссылка больше не появляется в ChatGPT'.",
                "relation": "supports",
                "source_id": "s1"
              }
            ],
            "assertion": "The phishing link appeared only in ChatGPT's Russian-language answers, indicating deliberate data-poisoning targeting Russian-speaking users; the link no longer appears.",
            "causal_attribution": "Reported by the blockchain analyst (VAL) and carried by the Russian tech press; not independently verified by the MVD."
          },
          {
            "id": "c3",
            "status": "documented",
            "evidence": [
              {
                "locator": "'сообщили РАПСИ в пресс-службе Управления по организации борьбы с противоправным использованием информационно-коммуникационных технологий МВД РФ'.",
                "relation": "supports",
                "source_id": "s3"
              }
            ],
            "assertion": "Russia's Interior Ministry (MVD) confirmed the loss of about 180 million rubles ($2.1 million).",
            "causal_attribution": "Attributed to the MVD press service via RAPSI."
          }
        ],
        "effects": [
          {
            "label": "crypto investor lost about $2.1 million after acting on a phishing link ChatGPT returned to a Russian-language query",
            "claim_id": "c1",
            "direction": "negative"
          }
        ],
        "sources": [
          {
            "id": "s1",
            "url": "https://bits.media/kriptopoinvestor-lishilsya-2-1-mln-iz-za-ssylki-v-otvete-chatgpt/",
            "kind": "news_report",
            "access": "read",
            "language": "ru",
            "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-04). Relays blockchain analyst VAL's on-chain investigation: sFLR/WFLR query, sceptre.network phishing clone, 1.9M FXRP (~$2.1M) drained via unlimited approval, Tornado Cash routing. Model reading; no human bilingual review.",
            "independence_group": "val-report"
          },
          {
            "id": "s2",
            "url": "https://vc.ru/ai/3122620-kak-ii-obmanul-kriptovinvestora-na-milliony-dollarov",
            "kind": "news_report",
            "access": "read",
            "language": "ru",
            "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-05). Names the 12 June 2026 date, alias Alex, the unlimited-approval signing, and that the phishing link appeared only in Russian-language answers. Derives from VAL's report. Model reading.",
            "independence_group": "val-report"
          },
          {
            "id": "s3",
            "url": "https://rapsinews.ru/digital_law_news/20260911/312188548.html",
            "kind": "news_report",
            "access": "read",
            "language": "ru",
            "translation_note": "Read in Russian on 2026-09-17 (RAPSI, 11 Sep 2026). Attributes the confirmation to the press service of the MVD's unit for combating unlawful use of ICT: ~180 million rubles / ~$2.1M lost after a ChatGPT-provided phishing link. Independent official confirmation. Model reading.",
            "independence_group": "mvd"
          },
          {
            "id": "s4",
            "url": "https://hi-tech.mail.ru/news/154924-chatgpt-podsunul-fishingovuyu-ssylku-kriptoinvestor/",
            "kind": "news_report",
            "access": "read",
            "language": "ru",
            "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-07). Russian tech-press account derived from VAL's report. Model reading.",
            "independence_group": "val-report"
          }
        ],
        "version": 1,
        "ai_roles": [
          "own_use"
        ],
        "contexts": [
          "finance"
        ],
        "unknowns": [
          "The investor's full identity and exact location within Russia are not established; only the alias Alex/@vesnuhin is public.",
          "No arrests or defendants are identified.",
          "Whether OpenAI has acknowledged or acted on the reported Russian-language data-poisoning is not established in the inspected sources."
        ],
        "geography": {
          "basis": "The investor is Russian-speaking and the case was confirmed by Russia's Interior Ministry (RAPSI). Event and affected-person country recorded as Russia on that basis. No court proceeding established.",
          "court_countries": [],
          "event_countries": [
            "RU"
          ],
          "affected_person_countries": [
            "RU"
          ]
        },
        "publication": {
          "basis": "Published under the 2026-09-15 charter, which includes fraud and security consequences in scope. A crypto investor acted on a phishing link ChatGPT returned to his Russian-language query and lost about $2.1 million; the loss is confirmed independently by Russia's Interior Ministry and traced on-chain by a blockchain analyst. Causation of the AI's role (surfacing the phishing link) is supported; the theft was executed by scam operators.",
          "reviewed_on": "2026-09-17"
        },
        "ai_involvement": {
          "basis": "Multiple technology outlets and a blockchain analyst report that the phishing link appeared in ChatGPT's answer to the investor's Russian-language question, and Russia's Interior Ministry confirmed to RAPSI that the loss followed a phishing link ChatGPT provided. The theft itself was executed by the scam operators; ChatGPT's role was surfacing the phishing link, reportedly only in Russian-language responses.",
          "status": "supported"
        },
        "person_relations": [
          "communicated_with"
        ]
      },
      "name": "Russia: a crypto investor lost about $2.1 million after ChatGPT returned a phishing link in answer to a token-swap question",
      "summary": "On 12 June 2026 a Russian-speaking crypto investor, known by the alias Alex (@vesnuhin), asked ChatGPT in Russian where to swap sFLR for WFLR tokens. ChatGPT's reply included a link to sceptre.network, a phishing clone of the legitimate sceptre.fi. He connected his wallet and signed an unlimited-approval transaction; within seconds about 1.9 million FXRP, worth roughly $2.1 million (about 180 million rubles), were drained. A blockchain analyst traced the theft, and reported that the phishing link appeared only in Russian-language answers. Russia's Interior Ministry (MVD) later confirmed the loss.",
      "incidentDate": "2026-06-12",
      "incidentKind": "single_event",
      "incidentDatePrecision": "day",
      "exposurePattern": "single_interaction",
      "reportedDate": "2026-09-04",
      "aiSystem": "ChatGPT (OpenAI)",
      "aiCompany": "OpenAI",
      "severity": "high",
      "verificationStatus": "credible",
      "harmCategories": [],
      "harmOutcomes": [
        "financial_loss"
      ],
      "harmOutcomeSummary": "A crypto investor lost about $2.1 million (some 180 million rubles) after connecting his wallet to a phishing site whose link ChatGPT had returned in answer to a Russian-language token-swap question; Russia's Interior Ministry confirmed the loss.",
      "frameworkFacets": [],
      "causationStatus": "supported",
      "participantUsersAffectedMin": 1,
      "otherPeopleHarmedMin": 0,
      "affectedCountStatus": "exact",
      "affectedCountEvidence": "One affected person: the investor who acted on the ChatGPT-provided link and lost about $2.1 million. VAL's report that a related scheme netted more than $2.2 million from other users is not used as a person count.",
      "victimAgeRange": "adult",
      "jurisdiction": "RU",
      "platformType": "assistant",
      "outcomeType": "investigation_opened",
      "outcomeStatus": "ongoing",
      "primarySourceUrl": "https://bits.media/kriptopoinvestor-lishilsya-2-1-mln-iz-za-ssylki-v-otvete-chatgpt/",
      "primarySourceLabel": "bits.media, 4 September 2026: crypto investor lost ~$2.1M after a phishing link in a ChatGPT answer (blockchain analyst VAL on-chain analysis)",
      "firstPublishedAt": "2026-09-17T03:27:42.903846+00:00",
      "scopeVersion": "facts-v3",
      "tags": [
        "chatgpt",
        "openai",
        "phishing",
        "crypto",
        "financial-loss",
        "data-poisoning",
        "russia",
        "communicated-with"
      ]
    }
  ]
}