  As COVID-19 has been spreading across the world since early 2020, a growing
number of malicious campaigns are capitalizing the topic of COVID-19. COVID-19
themed cryptocurrency scams are increasingly popular during the pandemic.
However, these newly emerging scams are poorly understood by our community. In
this paper, we present the first measurement study of COVID-19 themed
cryptocurrency scams. We first create a comprehensive taxonomy of COVID-19
scams by manually analyzing the existing scams reported by users from online
resources. Then, we propose a hybrid approach to perform the investigation by:
1) collecting reported scams in the wild; and 2) detecting undisclosed ones
based on information collected from suspicious entities (e.g., domains, tweets,
etc). We have collected 195 confirmed COVID-19 cryptocurrency scams in total,
including 91 token scams, 19 giveaway scams, 9 blackmail scams, 14 crypto
malware scams, 9 Ponzi scheme scams, and 53 donation scams. We then identified
over 200 blockchain addresses associated with these scams, which lead to at
least 330K US dollars in losses from 6,329 victims. For each type of scams, we
further investigated the tricks and social engineering techniques they used. To
facilitate future research, we have released all the well-labelled scams to the
research community.
