One phone number links 74 fake crypto helplines on Bluesky

As of 14 November 2026, 74 Bluesky accounts were posing as customer helplines for 18 crypto and trading brands, including Robinhood, Coinbase, MetaMask and Trust Wallet. All gave the same US phone number. In seven of nine signed-out searches we ran for six of the brands, one of them came first. Bluesky had not put a warning label on any of them.

The 18 brands, with the number of accounts posing as each: Robinhood 9; TronLink 6; BlueWallet, Coinbase, Speed Wallet and Trust Wallet 5 each; Fiat Wallet, MetaMask, SafePal, Strike and Tangem 4 each; Bittrex, BTCC, D'CENT, Kraken and Transak 3 each; Crypto.com and Paybis 2 each. Bittrex announced in November 2023 that it would stop trading on 4 December, yet three accounts still offer to help its customers.

Fake support numbers are a familiar start to crypto theft, as the FBI's notice on technical and customer support fraud describes.

Bluesky's people search for "robinhood support", with the same phone number in every result — Every result shown for “robinhood support” gives the same phone number (highlighted). Bluesky people search, signed out, 14 November 2026; the top four results, all among the 74.

We reported all 74 accounts through Bluesky's in-app reporting on 14 November and asked Bluesky's press team for comment the same day. At 11:19 UTC, nearly five hours after our reports, all 74 were still online. We will add Bluesky's response, and any accounts it removes, to this article.

Four things tie the accounts together:

One phone number, written three ways in their bios.
The same profile text, with only the brand name swapped.
Made in short bursts, brand by brand, over four days in October.
Empty accounts: no posts, no more than two followers, and each follows only Bluesky's own account, @bsky.app.

None uses a brand's own web address as its handle.

All 74 give the same number

We noticed an account called supportnumber60 on 13 November. A name with a number on the end suggests accounts made in bulk, so we searched Bluesky for "supportnumber". Among the results were 42 accounts, all giving the same number.

The bios write the number three ways, so we searched for six common spellings of it. That found 32 more accounts the name search had missed, including customerhelp87, robinhoodhelp, and names with a hyphen inserted at different points, such as s-upportnumber, su-pportnumber and z-onevote511-63.

The number is not only on Bluesky. Bing and DuckDuckGo searches for it on 14 November returned four pages on the form-building site JotForm. Going by their search-result titles, they posed as login support for four other crypto-related brands: Upbit, Gate, Onchain and BitStarz. One title, “Onchain Wallet Login - PC, Mobile, App, 2FA & Troubleshoot”, follows the same wording as 11 of the Bluesky display names, such as “Coinbase Login - PC, Mobile, App, 2FA & Troubleshoot”. All four pages had been taken down when we opened them, and the Wayback Machine holds no copy.

67 of the 74 use the same profile text (the bio) with only the brand swapped; the other seven use three close variants. 69 bios end in one of four short codes that match the day and month each account was made: spc19102026 for 19 October 2026, and pcs2010, pcs2110 and pcs2210 for 20, 21 and 22 October. Searching Bluesky for the four codes found no accounts beyond the 74.

The bio ends in “pcs2210” (highlighted), and the account was created on 22 October. It has no followers and no posts. supportnumber60 on Bluesky, 14 November 2026.

They were made brand by brand, in short bursts

Bluesky's public account registry, the PLC directory, records when each account was set up. For 16 of the 18 brands, all the accounts were made in one unbroken run lasting under an hour, with no other brand in between: six TronLink accounts in 18 minutes, five Coinbase in 16, four Strike in 12. The other two came in two runs each: Robinhood, the most impersonated with nine accounts, on 19 and 20 October, and Kraken's three on 19 and 22 October. Typos such as custpmerhelpline suggest the names were typed by hand.

For 16 of the 18 brands, the accounts were made in one unbroken run (highlighted), with no other brand in between; Robinhood and Kraken came in two runs. Each dot is one account. Creation times from the PLC directory, in UTC, 19 to 22 October 2026.

All 74 were created between 05:00 and 14:00 UTC; we drew that window after seeing the data. On 19 and 20 October the work came in one burst each; on 21 October in two bursts three hours apart; on 22 October it ran from 06:02 to 13:10, with pauses of just over an hour at most. Among 3,892 ordinary Bluesky accounts we found by searching for everyday words, only 28% were created in those hours. That fits people working set hours, but it is a weak signal: four days give only a few bursts, and accounts found through search tend to be older and more active.

A fake account came first in seven of nine brand searches

At 04:46 UTC on 14 November we ran ten support searches through Bluesky's public search, which shows what a signed-out visitor sees. Nine named one of six brands. In seven of those nine, the first result was one of the 74, and "Robinhood support" returned seven of them in the top ten. A general search, "crypto wallet helpline", returned none. We chose the queries after finding the accounts, signed-in search may rank differently, and we did not check Google or other web search engines.

What we cannot say

Who holds the number. Only the phone company can tie it to a subscriber, which usually takes law enforcement. The area code is South Carolina's, but such numbers can be used from anywhere.
Whether anyone has called. We found no reports of the number from victims or scam-tracking sites.
Where the operators are. The daily window is a clue to test, not a location.
What we missed. Accounts that show the number only in an image, or spell it out in words, would not turn up in a text search. The same support searches surfaced four other accounts, created on 19 October with no posts, that give two other numbers. We have not investigated them or checked those numbers.

For investigators: how to repeat this

Everything here can be repeated with Bluesky's public API, which needs no account, a few lines of code (or our free scripts) and a spreadsheet.

Search the name pattern. app.bsky.actor.searchActors on public.api.bsky.app matches handles, display names and bios. We read up to 300 results, 100 per page; each page returns a cursor value that fetches the next.
Pull contact details out of the bios. Extract phone numbers, emails, websites and Telegram links, then group the accounts that give the same one.
Pivot on the number. Search matches the number only as written, so search each common spelling (803-446-4992, 803 446 4992, (803) 446-4992, 803.446.4992, 8034464992, +1 803-446-4992) and keep accounts whose bios contain it.
Check activity and labels. app.bsky.actor.getProfile gives each account's posts, followers, follows and any moderation labels (none had one). app.bsky.graph.getFollows and app.bsky.graph.getFollowers list who it follows and who follows it.
Date the accounts. Every account has a permanent ID (a DID) registered in the PLC directory. Take createdAt from getProfile and compare it with the first entry at plc.directory/{did}/log/audit. The profile date comes from the account's own software and could be set to anything; the directory stamps its own time when an account is registered. The two agree within a minute for all 74, and on 14 November the directory showed that no account had changed its handle.
Check search ranking. Run searchActors with limit=10 for each support query and mark which results are among the 74.
Compare creation hours. For the comparison sample, we ran people searches for 20 everyday words, such as "coffee" and "football", took up to 200 accounts from each, and counted their creation hours.

We did this in SIERRA, the investigation app Phantom Helix makes, with two scripts that also run on their own: one searches accounts (python3 bluesky_account_search.py --query supportnumber --limit 300), the other maps followers and follows. SIERRA turns each contact detail in a bio into its own item on the map, so steps 2 and 3 happen as the searches run:

The first search in SIERRA: the phone number as one item, linked to the accounts that give it — The number becomes one item (highlighted), linked to the accounts that give it. Part of the first search, mapped in SIERRA on 14 November 2026.

Data and method

Accounts: all 74 as a spreadsheet: handle, account ID (DID), display name, brand, creation time, hosting server, which search found it, followers, follows, posts, moderation labels, bio, bio code, and a Wayback Machine copy of each profile record. Collected through Bluesky's public API on 13 and 14 November 2026.
Searches: the ten queries and their top ten results, with a Wayback Machine copy of each response taken an hour later, and the creation hours of the 3,892-account comparison sample, with the 20 search words.
Web searches: Bing and DuckDuckGo, for the number in quotes, 14 November 2026.
Tools: Bluesky's public API, the PLC directory, the Wayback Machine and SIERRA.
AI assistance: AI tools helped with the analysis and the drafting. Every number here was checked against the published data, and the author is responsible for the text.
Corrections: write to support@phantomhelix.com. We will fix errors and note each change here, with its date.

We name these accounts because they pose as customer support for financial brands.

New case write-ups and guides, SIERRA release notes and occasional Phantom Helix news.

Sent to beehiiv to deliver the emails. Unsubscribe from any message. Privacy policy