Cardano’s IOG warns users after YouTube channel hijack

IOG Issues Urgent Warning After YouTube Channel Takeover

Input Output Global (IOG), the development firm behind the Cardano blockchain, issued an urgent security advisory on Sept. 18 directing users to avoid its official YouTube channel following an apparent account compromise. The organization posted through its verified X account that users should avoid interacting with the channel “until further notice,” explicitly warning people not to click links, transfer funds, or provide personal information through any material appearing on the platform.

The warning came while the compromised channel was broadcasting a livestream presented as a Project Catalyst town hall. The suspicious broadcast utilized footage resembling Cardano founder Charles Hoskinson and promoted an offer claiming viewers could “double your wealth” by following instructions linked through a QR code. No evidence reviewed indicates that Hoskinson or Project Catalyst authorized the promotion. At the time of IOG’s public warning, the fraudulent livestream had remained online for close to two hours, according to reporting on the incident.

Details of the Compromise and Official Response

IOG’s security message focused exclusively on preventing further user interaction with the compromised channel. The organization did not state publicly how access to its YouTube account had been obtained, nor did it identify the party behind the apparent takeover. Its official instruction told users not to follow links, send cryptocurrency, or submit personal details until IOG confirmed that its YouTube presence was safe again.

As of the latest review, no subsequent official post has confirmed that the channel has been fully recovered. Current search results still surface IOG’s ordinary historical videos, but their availability does not by itself establish that administrative control has been restored. IOG has not published a wallet address associated with the fraudulent broadcast, nor has it disclosed whether anyone sent ADA or another asset after viewing the stream, leaving any claimed losses unverified. No credible blockchain-forensics firm or security researcher reviewed for this report had published a verified attribution, scam-wallet balance, or transaction trail tied specifically to the Sept. 18 incident.

Fraudulent Stream Follows Established Cardano Scam Pattern

The format of the Sept. 18 broadcast closely resembles a type of fraud that the Cardano ecosystem has warned users about for years. Cardano’s official scam-awareness guide specifically describes ADA giveaway schemes in which scammers promise to double a user’s holdings after receiving an initial transfer. The guidance states that fraudulent streams frequently use fake videos of Charles Hoskinson or other well-known figures to make the offer appear authentic.

Cardano’s guidance emphasizes that legitimate giveaways never require users to send cryptocurrency first. Once ADA is transferred to a scam address, blockchain transactions cannot simply be reversed by Cardano’s developers or ecosystem organizations. The Cardano Foundation documented the same technique as early as 2020. In a community notice, it reported that scammers had been hijacking YouTube accounts with established audiences, impersonating Cardano organizations, and promoting offers claiming users would receive more crypto after making a deposit. The Foundation stated explicitly that neither it, EMURGO, nor Input Output would promote giveaways requiring users to send ADA or another asset.

Community reports have since documented multiple fake Hoskinson streams. A 2024 report described an impersonation channel using what the user characterized as AI-generated Hoskinson footage to promote a giveaway, though that report did not establish who created the video. The recurring pattern involves taking control of established YouTube channels, replacing their content with crypto giveaway livestreams, and directing viewers toward payment addresses or external sites.

Project Catalyst Branding Provided False Legitimacy

The Sept. 18 broadcast was presented as a Project Catalyst event, leveraging branding associated with Cardano’s community-funding program to create a veneer of authenticity. Project Catalyst is a genuine Cardano initiative. Its official site describes the program as a community funding system through which Cardano users submit, review, and vote on proposals, with 2,221 proposals having received funding across completed rounds.

Input Output has historically played a direct role in Catalyst. A February 2026 Catalyst update identified IOG as the program’s operator at that time while responsibilities were being reorganized with the Cardano Foundation and Intersect. By June, Intersect said administration had transferred from IOG to the Cardano Foundation, with remaining milestones from one IOG Catalyst project canceled and 2.06 million ADA returned to the treasury. Using Catalyst branding therefore gave the fraudulent livestream a recognizable Cardano context even though no official Catalyst source reviewed for this report announced a legitimate town hall matching the giveaway broadcast. The combination of a familiar project name with apparent Hoskinson footage follows the social-engineering pattern described in Cardano’s scam guidance: genuine-looking ecosystem material is combined with a malicious payment request.

Previous Compromises of Cardano-Linked Accounts

This incident is not the first time a prominent Cardano-linked social account has been compromised. In December 2024, the Cardano Foundation’s X account was compromised and used to publish a false claim that the U.S. Securities and Exchange Commission had sued the organization, with attackers falsely telling users that support for ADA would cease. Hoskinson responded at the time by identifying the posts as unauthorized. That fake announcement was unrelated to the current YouTube incident, but both cases involved trusted Cardano-branded communication channels carrying content that did not originate from the organization controlling the account.

Scam reports involving YouTube stretch back even further. Cardano’s community forum contains reports from users who said they lost ADA after encountering fake livestreams offering to return twice the amount sent. One 2022 user reported transferring 10,000 ADA after seeing a fraudulent Hoskinson-themed broadcast, though that loss was self-reported and not independently verified.

AI Manipulation Suspected But Not Independently Verified

The latest video has been described as AI-manipulated, but no technical forensic report reviewed for this update has confirmed how the Hoskinson footage was produced. The distinction remains relevant because scam operators can use several methods, including edited historical footage, altered audio, synthetic voice generation, or fully generated video. Cardano’s current security guidance explicitly warns that improvements in artificial intelligence are making impersonation scams more sophisticated, and its giveaway section names fake livestreams featuring Hoskinson as a recurring risk.

Notably, IOG itself has been experimenting publicly with AI-generated content. In June, Hoskinson defended an AI-generated influencer post published through an Input Output account, saying it formed part of experiments around AI agents and Midnight City. Earlier coverage of IOG’s AI content tests reported that some community members objected to the synthetic content. That legitimate experimentation is unrelated to the Sept. 18 suspicious livestream. IOG’s warning expressly told users not to interact with the compromised YouTube channel, while the giveaway itself has not been endorsed by the company.

Why This Matters

The compromise of IOG’s official YouTube channel represents a significant escalation in the sophistication and reach of cryptocurrency impersonation scams. By hijacking a verified organizational channel with an established subscriber base, attackers gained immediate credibility that standalone impersonation channels cannot achieve. The use of Project Catalyst branding—a legitimate Cardano governance initiative—demonstrates attackers’ deep familiarity with the ecosystem’s structure and terminology.

The incident also highlights the growing challenge of AI-generated deepfakes in social engineering attacks. While forensic verification is pending, the mere plausibility of AI-manipulated footage of a recognizable industry figure like Hoskinson lowers the barrier for convincing fraud. For Cardano users and the broader crypto community, the event reinforces the critical security principle that no legitimate organization will ever request funds upfront in exchange for promised returns. As IOG investigates the breach vector—including whether multi-factor authentication was bypassed or other corporate accounts were affected—the ecosystem awaits a full post-incident report that could inform stronger platform-level protections for verified organizational channels.