Nano Labs Founder Kong: Phishing and AI Misjudgment Led to Theft of X Account
Jack Kong, founder of Nano Labs, stated that the X account has been reclaimed. The attacker sent a phishing email to his publicly used email, and the AI assistant misidentified the fake link as the official X verification page. He entered the verification code sent to his linked email into the counterfeit page, resulting in the account being transferred.
During the time the account was compromised, it briefly posted false projects and scam content. He warned that even if AI determines a link is trustworthy, one should not click on unofficial addresses, and he has set the linked email for X to a non-public address. Nano Labs is a BNB crypto treasury company listed on the US stock market, where he serves as chairman.
The method did not rely on cracking passwords but on the public email and assistant summaries. The verification code itself was sent by X to the real linked inbox, which the holder handed over to the counterfeit domain. The assistant wrote the phishing page as an official third-party verification, shortening the manual verification of the domain.
Similar incidents have repeatedly occurred in the crypto executive circle: public contact information, assistants reading emails, and verification codes being re-entered. This time, "AI helping to read emails" was noted as one of the conditions for the theft.
After the account was restored, the previous false project posts became invalid, but screenshots and forwards are still circulating. The company has not publicly disclosed the on-chain financial loss figures, and the public narrative remains focused on social media control.
In market mechanisms, what is sold is the trust endorsement of the founder's account, and what is bought is the verification code on the counterfeit page. Attention has shifted from treasury narratives to account theft warnings; the beneficiaries are the phishing parties that can intercept the verification codes, while the pressured parties are those who made their commonly used emails public and allowed assistants to open links. The incident was driven by email and model misjudgment, rather than exchange hot wallets.
Source: Public Information
ABAB AI Insight
The verification code is supposed to prove "I control this email," but after the assistant reads the link, it becomes "I handed over control to the page it opened." The public email provides a delivery surface, the model provides trust endorsement, and the real person provides the final paste. With all three in place, there is no need for a trojan.
The capital path is for the listed treasury company to treat the founder's account as a channel for information disclosure and project endorsement. When the channel is occupied, fake project posts appear, and the market first reacts to the text, then waits for official denial. Separating the linked inbox from the commonly used inbox tears the verification channel away from the searchable identity.
Comparable objects are SMS verification codes after SIM swapping and wallet links clicked by customer service. The new variable is that the assistant has been trained to "recognize official pages," so as long as the counterfeit page looks similar, it can complete social engineering through the model's classification error. The industry stage is that email assistants are becoming popular faster than domain verification habits.
Structural judgment belongs to the authentication vacuum in technical substitution. The mechanism is that whoever can make the model mark the counterfeit domain as official can reprice the verification code; the public email is the ticket to entry, and the assistant's misjudgment is the passage.
ABAB News · Cognitive Law
Links clicked by the assistant do not equal official domains.
Verification codes prove the email, but do not prove which page you opened.
Making a commonly used inbox public is reserving a delivery surface for phishing.