Hiring developers on Discord for Metin2 server setups is risky. I just got scammed by a developer nicknamed sykes. I caught him because I investigated the VPS myself. Sharing the full breakdown so nobody else falls for the same trick.
WHAT HAPPENED (SHORT VERSION)
I hired sykes on Discord for a Metin2 private server setup. On April 16, 2026, I sent him 59 USDT (ERC20) as payment. One minute after receiving the payment, he told me the VPS crashed and the entire home folder was "deleted." He asked me to restart the VPS, then disappeared for dinner.
I got suspicious and connected to the server myself. The files were never deleted. He had run a single ZFS command that makes the folder appear empty while leaving every file untouched inside the dataset. One command restored everything in seconds. His plan was either to extort more money for a fake "recovery" or to walk away with the payment and blame the restart.
THE PAYMENT
Amount: 59.00 USDT (ERC20, Ethereum network)
Received after fees: 58.50 USDT
Date and time: 2026-04-16, 20:54 GMT+3
His wallet address: 0x0428906cB2440971251518f6Cade102Ce9FE514FC
You can look this wallet up on etherscan.io and see every transaction it has received. If you paid to the same wallet, you were scammed by the same person.
THE TECHNICAL TRICK (HOW HE DID IT)
The server runs FreeBSD with ZFS. The /home directory is a ZFS dataset. He ran this single command as root:
zfs umount zroot/home
That command unmounts the dataset. Side effects:
- The /home directory appears empty to anyone who runs ls
- All the files are still on disk, untouched, inside the dataset
- zpool history does NOT log umount operations, so the pool looks clean
- A reboot does not automatically restore the mount in some configurations
To recover it, you run:
zfs mount zroot/home
Everything comes back instantly. This is why the trick is attractive to scammers — it looks like total data loss to the customer, but recovery takes 10 seconds.
PROOF THE FILES WERE NEVER DELETED
When I logged in and checked:
zpool history zroot
- Result: Zero destroy operations since pool creation in March 2025. Not a single delete at any level.
zfs get used zroot/home
- Result: 1.71 GB of data still in the dataset
zfs get mounted zroot/home
- Result: mounted = no
zfs mount zroot/home
- Result: Everything reappeared: server source code, server files, jails, and his own tgz and zip backups. Nothing missing.
PROOF IT WAS HIM
1. His own IP screenshot
When he was defending himself, he voluntarily sent me a screenshot from omeuip.pt showing his IP address: 104.28.166.6. This is a Cloudflare WARP VPN IP.
2. That same IP appears in the VPS auth log
These entries are from /var/log/auth.log on the server:
Apr 16 20:54:45 sshd Connection closed by user root 104.28.166.6
Apr 16 20:55:36 sshd Accepted for root from 104.28.166.6 port 16618
Apr 16 20:59:15 sshd Accepted for root from 104.28.166.6 port 15707
Apr 16 20:59:34 sshd Accepted for root from 104.28.166.6 port 14647
Four logins from his own confirmed IP during the exact window when the folder went "missing." I did not log in until 21:05.
3. His own admissions
In Discord he told me:
"I was connected way before we spoke about payment."
"When i told you the home folder was gone i was backing up the project again."
"I dont think i have to explain why do I use warp on my computer."
These place him on the server at the exact moment of the incident, by his own words.
4. Backdoor SSH key
He placed a public SSH key into /root/.ssh/authorized_keys at 16:58:35 on the same day — about 4 hours before the incident. Comment field was "Admin@PC". Key fingerprint: SHA256:nxvzGhNwHa0hfrcP3j0F9HUYWMLZIuq0kbpG3s86PJo
This means even if I changed the root password, he could still log in with the key. This was preparation, placed before the scam. I removed it.
HIS STORY CONTRADICTS ITSELF
At 21:01 he said: "No automatic backup on panel?" — as if he had nothing and was asking me to check.
At 21:43 he said: "I have everything backed up and I can put it again on the vps."
At 00:07 (next day) he said: "I was backing up the project with tar zcvf like I always do."
But when I checked the server, there are zero manual tar archives from the 21:00 to 21:10 window. The only today's backups are the automated cron jobs that run every 6 hours (06:00, 12:00, 18:00) and the ones I made myself at 21:43 and 21:44 after mounting the dataset.
His reaction when I mounted the dataset and files reappeared was telling. He wrote: "wait its there / wtf / its there now." An honest developer would say "thank god, they came back." Writing "WTF" is the reaction of someone surprised that something he knew wasn't deleted suddenly became visible again.
WHAT SAVED ME
- The server had automated cron backups running every 6 hours into a root-only folder. The developer account had no access to them.
- I didn't panic. Instead of paying extra for "recovery" I SSH'd in, ran zpool history, zfs get, and checked the auth log.
- The umount trick was visible within 30 minutes of investigation.
WARNING TO OTHER SERVER OWNERS
If you hire any developer and they tell you "everything got deleted" on the VPS, before paying for recovery or accepting the loss, check these three things:
zpool history yourpoolname
If there is no destroy operation, nothing was deleted at the ZFS level.
zfs get mounted,used yourdataset
If mounted is no but used shows data, someone unmounted. Run zfs mount to recover instantly.
cat /var/log/auth.log
Look for Accepted lines during the time of the incident. Every SSH login is recorded with IP and time.
If mounted is no and used has data, you are not looking at deletion. You are looking at a scam.
EVIDENCE I HAVE SAVED
- Full Discord chat log with timestamps
- His "O meu IP: 104.28.166.6" screenshot
- His Cloudflare WARP "Connected" screenshot
- Server auth.log with all the 104.28.166.6 entries
- zpool history output
- zfs get output showing the unmounted dataset with data still in it
- File listing after mounting, showing nothing was missing
- The backdoor SSH public key with its timestamp
- Payment transaction details on Ethereum
I can share this archive privately with forum moderators or other verified victims.
HIS WALLET ADDRESS FOR TRACKING
0x0428906cB2440971251518f6Cade102Ce9FE514FC
If you paid this wallet, contact me. If you know someone else who worked with sykes on Metin2 projects, please share this post with them.
CURRENT STATUS:
I politely requested a refund for the 59 USDT, but he flatly refused and started acting aggressively towards me. It is clear now that he has no intention of paying. I am keeping this post up as a permanent public record so other members of the community can see this pattern and protect themselves. Not here for drama, just here to prevent others from being victimized.
His discord name:sykes
His discord login name:siiigues
His discord ID: 796863940495015988
Hiring developers on Discord for Metin2 server setups is risky. I just got scammed by a developer nicknamed sykes. I caught him because I investigated the VPS myself. Sharing the full breakdown so nobody else falls for the same trick. WHAT HAPPENED (SHORT VERSION) I hired sykes on Discord for a Metin2 private server setup. On April 16, 2026, I sent him 59 USDT (ERC20) as payment. One minute after receiving the payment, he told me the VPS crashed and the entire home folder was "deleted." He asked me to restart the VPS, then disappeared for dinner. I got suspicious and connected to the server myself. The files were never deleted. He had run a single ZFS command that makes the folder appear empty while leaving every file untouched inside the dataset. One command restored everything in seconds. His plan was either to extort more money for a fake "recovery" or to walk away with the payment and blame the restart. THE PAYMENT Amount: 59.00 USDT (ERC20, Ethereum network) Received after fees: 58.50 USDT Date and time: 2026-04-16, 20:54 GMT+3 His wallet address: 0x0428906cB2440971251518f6Cade102Ce9FE514FC You can look this wallet up on etherscan.io and see every transaction it has received. If you paid to the same wallet, you were scammed by the same person. THE TECHNICAL TRICK (HOW HE DID IT) The server runs FreeBSD with ZFS. The /home directory is a ZFS dataset. He ran this single command as root: zfs umount zroot/home That command unmounts the dataset. Side effects: - The /home directory appears empty to anyone who runs ls - All the files are still on disk, untouched, inside the dataset - zpool history does NOT log umount operations, so the pool looks clean - A reboot does not automatically restore the mount in some configurations To recover it, you run: zfs mount zroot/home Everything comes back instantly. This is why the trick is attractive to scammers — it looks like total data loss to the customer, but recovery takes 10 seconds. PROOF THE FILES WERE NEVER DELETED When I logged in and checked: zpool history zroot - Result: Zero destroy operations since pool creation in March 2025. Not a single delete at any level. zfs get used zroot/home - Result: 1.71 GB of data still in the dataset zfs get mounted zroot/home - Result: mounted = no zfs mount zroot/home - Result: Everything reappeared: server source code, server files, jails, and his own tgz and zip backups. Nothing missing. PROOF IT WAS HIM 1. His own IP screenshot When he was defending himself, he voluntarily sent me a screenshot from omeuip.pt showing his IP address: 104.28.166.6. This is a Cloudflare WARP VPN IP. 2. That same IP appears in the VPS auth log These entries are from /var/log/auth.log on the server: Apr 16 20:54:45 sshd Connection closed by user root 104.28.166.6 Apr 16 20:55:36 sshd Accepted for root from 104.28.166.6 port 16618 Apr 16 20:59:15 sshd Accepted for root from 104.28.166.6 port 15707 Apr 16 20:59:34 sshd Accepted for root from 104.28.166.6 port 14647 Four logins from his own confirmed IP during the exact window when the folder went "missing." I did not log in until 21:05. 3. His own admissions In Discord he told me: "I was connected way before we spoke about payment." "When i told you the home folder was gone i was backing up the project again." "I dont think i have to explain why do I use warp on my computer." These place him on the server at the exact moment of the incident, by his own words. 4. Backdoor SSH key He placed a public SSH key into /root/.ssh/authorized_keys at 16:58:35 on the same day — about 4 hours before the incident. Comment field was "Admin@PC". Key fingerprint: SHA256:nxvzGhNwHa0hfrcP3j0F9HUYWMLZIuq0kbpG3s86PJo This means even if I changed the root password, he could still log in with the key. This was preparation, placed before the scam. I removed it. HIS STORY CONTRADICTS ITSELF At 21:01 he said: "No automatic backup on panel?" — as if he had nothing and was asking me to check. At 21:43 he said: "I have everything backed up and I can put it again on the vps." At 00:07 (next day) he said: "I was backing up the project with tar zcvf like I always do." But when I checked the server, there are zero manual tar archives from the 21:00 to 21:10 window. The only today's backups are the automated cron jobs that run every 6 hours (06:00, 12:00, 18:00) and the ones I made myself at 21:43 and 21:44 after mounting the dataset. His reaction when I mounted the dataset and files reappeared was telling. He wrote: "wait its there / wtf / its there now." An honest developer would say "thank god, they came back." Writing "WTF" is the reaction of someone surprised that something he knew wasn't deleted suddenly became visible again. WHAT SAVED ME - The server had automated cron backups running every 6 hours into a root-only folder. The developer account had no access to them. - I didn't panic. Instead of paying extra for "recovery" I SSH'd in, ran zpool history, zfs get, and checked the auth log. - The umount trick was visible within 30 minutes of investigation. WARNING TO OTHER SERVER OWNERS If you hire any developer and they tell you "everything got deleted" on the VPS, before paying for recovery or accepting the loss, check these three things: zpool history yourpoolname If there is no destroy operation, nothing was deleted at the ZFS level. zfs get mounted,used yourdataset If mounted is no but used shows data, someone unmounted. Run zfs mount to recover instantly. cat /var/log/auth.log Look for Accepted lines during the time of the incident. Every SSH login is recorded with IP and time. If mounted is no and used has data, you are not looking at deletion. You are looking at a scam. EVIDENCE I HAVE SAVED - Full Discord chat log with timestamps - His "O meu IP: 104.28.166.6" screenshot - His Cloudflare WARP "Connected" screenshot - Server auth.log with all the 104.28.166.6 entries - zpool history output - zfs get output showing the unmounted dataset with data still in it - File listing after mounting, showing nothing was missing - The backdoor SSH public key with its timestamp - Payment transaction details on Ethereum I can share this archive privately with forum moderators or other verified victims. HIS WALLET ADDRESS FOR TRACKING 0x0428906cB2440971251518f6Cade102Ce9FE514FC If you paid this wallet, contact me. If you know someone else who worked with sykes on Metin2 projects, please share this post with them. CURRENT STATUS: I politely requested a refund for the 59 USDT, but he flatly refused and started acting aggressively towards me. It is clear now that he has no intention of paying. I am keeping this post up as a permanent public record so other members of the community can see this pattern and protect themselves. Not here for drama, just here to prevent others from being victimized. His discord name:sykes His discord login name:siiigues His discord ID: 796863940495015988