Frostbite Frostbite
Add to Discord
← All guides

Crypto casino scam images on Discord: how to stop them

The fake MrBeast casino promo is the most posted scam image on Discord. How the promo code and withdrawal fee trick works, and how to remove every copy automatically.

5 min read

What lands in your server

A member who has never posted a picture before drops one or two images into a busy channel, often with no text at all, or just "bro". The images show a social media post from a famous creator, usually MrBeast, sometimes Elon Musk or a streamer. The post announces a new crypto casino and a promo code worth a few thousand dollars. A second image shows a casino balance with a withdrawal that apparently went through.

Within a minute the same pictures appear in three other channels. Then the member's account goes quiet, because the person behind it is busy doing the same thing in every other server that account belongs to.

How the scam makes money

The casino is real in the sense that the website exists. Everything else is staged.

  1. The promo code works. Sign up, enter the code, and the balance shows the promised amount. That is the hook.
  2. The games pay out. Balances go up. The site shows a live feed of other people withdrawing, all of it fake.
  3. The withdrawal needs a deposit. When the victim tries to cash out, the site asks for a "verification deposit", "activation fee", or "network fee", usually a few hundred dollars in crypto.
  4. The deposit is the theft. Once paid, the site asks for another fee, or the account is frozen. The bonus never existed.

Security researchers have counted more than a thousand sites running this exact model under different names. When one domain is blocked, the same site comes back under a new one, which is why blocking links does little.

Why it beats normal Discord filters

The link and the promo code are written inside the picture. There is nothing in the message text for AutoMod or a word filter to match. The images also change slightly from wave to wave: a new casino name, a different crop, a photo of a monitor instead of a clean screenshot. A filter that blocks one exact file misses the next copy.

The full explanation of why images get through is in why scam screenshots beat most Discord filters.

What to do when a wave hits

  1. Delete the images and time out the account. Not a ban yet. The member is almost always a victim whose account was taken over, usually by malware that stole their login session.
  2. Tell the member what happened in a DM or a mod ticket. The steps that actually get the account back are in member's account posting scam links? What to do.
  3. Warn the server once. One pinned line does more than a long announcement: nobody famous is giving away casino money, and no real casino charges a deposit to withdraw.
  4. Lift the timeout when the member confirms they have changed their password and logged out every other session.

Stopping it automatically

This is the scam Frostbite was originally built for. Across every server it protects, it has removed 20,935 scam images so far.

  • Fingerprints, not exact files. Every known casino image is stored as a perceptual fingerprint. Resized, recompressed, or lightly cropped copies still match. The shared blocklist holds over 24,000 fingerprints.
  • One server blocks it, every server blocks it. When a new casino image is confirmed anywhere, every server running Frostbite stops it from then on.
  • It reads the picture. For a brand-new image, Frostbite reads the text inside it and checks it against known scam phrases, so "promo code" and "withdraw instantly" posts are caught before anyone has reported that exact image.
  • The wave becomes one alert. With cross-channel detection on, the same image hitting several channels within seconds is removed everywhere at once and logged once.
  • The victim gets help, not a ban. The member whose account was used receives a recovery guide by DM. You choose what happens to the account: nothing, a timeout, a kick with a one-time invite back, or a ban.

Setup:

/filter quicksetup log_channel:#mod-log
/filter status

The first command turns on the image and text filters. Then run /filter enable and pick cross-channel detection to catch the wave. /filter status shows what is on and whether Frostbite has the permissions it needs. Every option is on the commands page.