A YouTube channel is an asset: sometimes an income, sometimes a brand, often years of work. That is exactly why channels with large audiences have become prized targets. The pattern repeats: attackers take over the channel, change its name and image, and run a 'live stream' of a crypto scam, often with a deepfake video of a celebrity promising to double the money of anyone who sends coins.
There were several prominent cases this year. In March, according to one analysis, a hijacked channel with 800,000 subscribers looped a video of Elon Musk for 11 hours, and more than $400,000 flowed to the scammers' wallets. In September the official channel of IOG, the company behind Cardano, was hijacked and showed a suspected AI-faked video of founder Charles Hoskinson promising to 'double your crypto'. The company has not said how the account was accessed.
How does it happen? Mostly through phishing or stolen credentials. A common method targets creators directly: a 'sponsorship' offer from a real-sounding company, with a file to download, such as a 'contract' or a software 'trial'. The file steals login data saved in the browser, sometimes letting the attacker into the account without the password or verification code.
How to defend: first, turn on two-step verification on the Google account that owns the channel, preferably passkeys or a physical security key rather than SMS. Second, do not download files from unfamiliar sponsorship offers, and check every company independently. Third, check in channel settings who has manager access and remove anyone who does not need it. Fourth, use a separate account for the channel rather than the personal account you browse and download files with.
And if it already happened? Immediately stop any live stream you do not recognize, change the password, sign out of all devices in Google's security settings and remove unknown managers. If you have no access, use Google's account recovery process and contact YouTube Creator Support. Be ready to appeal strikes the channel received for content the hacker uploaded, and tell your audience on other platforms that the channel was hacked and they should not send money.
