Full Report
A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded "Don't Get Played," was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names "Apex Accelerator" and "Stone Venture." According to a police report filed by one attendee with the Singapore Police Force, the organizers allegedly pressured guests to install software that would have handed the organizers remote control of their computers. The allegation first gained traction on X, where several other users claimed they had also been approached by the same group. What the "Don't Get Played" Police Report States The document circulating online is page two of a six-page Singapore Police Force report (form NP299), bearing reference number E/20261011/7004. In it, the complainant lists the group's website as token.apexaccs.org and notes that the event's Telegram group had no public URL; prospective attendees could only join through the website. Report filed to the Singapore Police (Source: SolanaFloor on X) The report is titled "Suspected cyber scam targeting TOKEN2049 attendees ('Don't Get Played' event)." Its summary reads: "A group using the names 'Apex Accelerator', 'Stone Venture' and 'Don't Get Played' promoted a crypto security event for TOKEN2049 week (Sun 11 Oct 2026, 6pm to 10pm, The Singapore EDITION). They pressured attendees to install software that would give them remote control of their computers. I did not install their software and have no financial loss." Two details in that statement matter. First, the person who filed the report says they did not install anything. Second, they report no financial loss. The filing therefore documents an alleged attempt rather than a confirmed compromise. How the TOKEN2049 Side Event Was Pitched On paper, "Don't Get Played" looked like exactly the kind of session a careful attendee would seek out. It was marketed as a security-focused gathering designed to help people protect themselves from token scams. "Don't Get Played" registration page (Source: Defraud on X) The event was scheduled for The Singapore EDITION hotel in early October 2026. Entry was free, though guests had to register beforehand, and attendance was capped at 200 people, as detailed by Crypto Briefing. The agenda featured a live "wallet clinic" where attendees could have their holdings checked with "Apex Audit" tools. These were promoted as scanners for token risk and honeypots, a term for tokens engineered so that holders can buy them but are never able to sell. The promotional material also advertised a panel on how crypto scams have evolved, listing representatives from Spartan Group, Bybit's security team, and the Singapore Police Force Cyber Command among the speakers. The final hook was a giveaway. Every confirmed guest was promised a free year of Sophos MDR endpoint protection, bundled with up to $1 million in breach coverage. Research into the event suggests this offer was a major driver of interest. There is nothing in the available material indicating that Spartan Group, Bybit, Sophos, or the Singapore Police Force Cyber Command played any part in the alleged conduct. Their names appeared in the event promotion, and that is the full extent of what the sources establish. The Allegation and the Gaps in the Record The central claim is simple: organizers of "Don't Get Played" allegedly pushed attendees to install software that would give a third-party remote access to their machines. At a crypto event, where many guests carry laptops connected to wallets and exchange accounts, that level of access could be enough to empty funds. Several important facts remain unclear. The source material does not name the software attendees were allegedly asked to install. It does not state whether anyone lost money, and it does not say how many people may have been targeted. As of October 12, 2026, no mainstream coverage of a police report involving the organizers, or of complaints from victims, could be located. The Singapore Police Force has not publicly confirmed the filing. Apex Accelerator and Stone Venture have not been charged with any offense based on the information available, and their account of events has not yet entered the public record. How the Crypto Community Reacted to "Don't Get Played"? After SolanaFloor shared the police report on X, the replies split between people claiming firsthand contact, skeptics, and users offering security advice. The account 0xKYM Registry (@KYMRegistrySG) said it filed the report and shared what it described as a scan of the installation's contents. Several others, including FamCrypt (@Famous0x3), NomadFury (@NomadFury_), and Sabya | YeNo (@SabyaYeNo), said the group had approached or pressured them to install software or buy a subscription. Alex (@alwye) claimed Apex Accelerator had used similar tactics in Twitter DMs. Reactions on Don't Get Played (Source: X) Not everyone was convinced. Sprunky (@sprunky_eth) argued that "page 2 of a report is not a finding," noting the complainant lost nothing, SPF had not confirmed the filing, and no charges exist. Others questioned how anyone could be pressured in Singapore or who vetted the project for the TOKEN2049 lineup. Security-minded users focused on the risk. StakeCraft (@stakecraft) called remote laptop access at a crypto event "a wallet drain waiting to happen," and Jey (@TheWarKettle) advised anyone who installed the software to treat the device as compromised, move funds from a clean device, and rotate every password and key. Others pointed to fake Luma after-party links and similar incidents at other conferences, and one user floated an unsupported DPRK link. Many replies also mocked the irony of a security event called "Don't Get Played" allegedly becoming the play. Conclusion The "Don't Get Played" allegations rest on a single attendee's police report and a growing set of claims on X, none of which have been confirmed by authorities. Several questions remain open. Will Singapore authorities confirm that a report was filed? Will Apex Accelerator or Stone Venture respond publicly? And will Spartan Group or the Singapore Police Force Cyber Command clarify whether they had any connection to the event? Until those answers arrive, the safest assumption for attendees is the one the event's own name suggested: any request to install software deserves suspicion. References: https://x.com/SolanaFloor/status/2109654244655812768 https://cryptobriefing.com/apex-accelerator-stone-venture-token2049-scam/ https://x.com/DefraudTG/status/2109869264718971363 Disclaimer: This blog is based on publicly available information, including a police report and posts shared on X, as of October 13, 2026. Cyble has not independently verified these claims. The allegations remain unproven, and naming any organization does not imply its involvement. This content is for informational purposes only and is not legal or financial advice. The post “Don’t Get Played”: TOKEN2049 Security Event Faces Remote-Access Scam Allegations appeared first on Cyble.
Analysis Summary
# Incident Report: Alleged Remote Access Scam at "Don't Get Played" Event
## Executive Summary
During the TOKEN2049 week in Singapore, a side event titled "Don't Get Played" allegedly attempted to compromise attendees' devices by pressuring them to install remote-access software under the guise of security audits. While a police report has been filed, it currently documents an attempted exploit with no confirmed financial losses or successful compromises reported by the complainant.
## Incident Details
- **Discovery Date:** October 11, 2026
- **Incident Date:** October 11, 2026 (6:00 PM – 10:00 PM)
- **Affected Organization:** Attendees of TOKEN2049 / "Don't Get Played" event
- **Sector:** Cryptocurrency / Cybersecurity Conference
- **Geography:** Singapore (The Singapore EDITION hotel)
## Timeline of Events
### Initial Access
- **Date/Time:** Early October 2026 (Registration phase)
- **Vector:** Social Engineering / Impersonation
- **Details:** The organizers (Apex Accelerator and Stone Venture) used a legitimate-looking registration website (token[.]apexaccs[.]org) and a private Telegram group to lure security-conscious crypto investors.
### Lateral Movement
- **Details:** Not applicable in a traditional network sense; however, the attackers attempted to bridge the gap from a physical event presence to digital device control via "Wallet Clinics."
### Data Exfiltration/Impact
- **Details:** No confirmed data exfiltration or financial loss reported. The intent appeared to be gaining full remote control of attendee laptops to access crypto wallets and exchange accounts.
### Detection & Response
- **Discovery:** An attendee grew suspicious of the software installation requirement and observed the pressure tactics used by organizers.
- **Response Actions:** A formal police report (Ref: E/20261011/7004) was filed with the Singapore Police Force. The incident was subsequently socialized on X (formerly Twitter) to warn other attendees.
## Attack Methodology
- **Initial Access:** Social Engineering via a "Security Workshop" theme and promises of free "Sophos MDR" protection.
- **Persistence:** Alleged installation of Remote Access Trojans (RATs) or remote desktop software.
- **Defense Evasion:** Use of "trusted" brand names (Bybit, Spartan Group, Sophos, Singapore Police) in marketing materials without authorization to build false credibility.
- **Discovery:** "Wallet Clinics" designed to identify high-value targets by scanning holdings using "Apex Audit" tools.
- **Impact:** Intent to perform unauthorized fund transfers (Wallet Draining).
## Impact Assessment
- **Financial:** $0 (Reported as an attempted scam; no losses confirmed).
- **Data Breach:** Potential exposure of private keys and session cookies for those who complied with software installation.
- **Operational:** Minimal; localized to the specific side-event.
- **Reputational:** High impact on the organizers (Apex Accelerator/Stone Venture) and potential brand friction for the impersonated entities.
## Indicators of Compromise
- **Network Indicators:**
- token[.]apexaccs[.]org (Phishing/Registration)
- Private Telegram channels with no public URL.
- **File Indicators:** Unnamed "audit" software/scanners promoted at the event.
- **Behavioral Indicators:** High-pressure tactics to install third-party software on personal devices; offer of high-value rewards ($1M breach coverage) for free.
## Response Actions
- **Containment:** Community warnings issued via social media (X) by SolanaFloor and 0xKYM Registry.
- **Eradication:** Advice given to attendees who installed the software to treat devices as compromised, move funds from clean devices, and rotate all credentials.
- **Recovery:** Filing of Singapore Police Force report NP299.
## Lessons Learned
- **Key Takeaways:** Attackers are increasingly using "Security" and "Compliance" as lures to target sophisticated users.
- **Verification:** The presence of large brand logos on event flyers does not equate to an official partnership or endorsement.
- **Physical Security:** Physical events are high-risk environments for "Evil Maid" style attacks or social-engineered software installations.
## Recommendations
- **Zero Trust for Personal Devices:** Never install software or connect hardware (USB/chargers) provided at conferences to devices containing sensitive financial data.
- **Credential Hygiene:** Use hardware wallets that require physical confirmation for transactions, mitigating the impact of remote access software.
- **Due Diligence:** Verify side-event speakers via their official corporate social media channels before attending "clinics" or "audits."