Ethereum

Rocket

Rocket Pool ETH

Rocket Pool

After interacting with a malicious link set up by phishing scammers, a crypto whale lost millions in liquid staking derivatives Rocket Pool Ethereum (rETH) and Lido staked Ethereum (stETH). 
Scammers drained millions in Ethereum (ETH) derivatives from a wallet holder in what blockchain analytics provider Peckshield called a phishing attack. Total losses from the attack are estimated at $24 million in crypto. 
The crypto whale, a term designated to on-chain addresses with substantial crypto balances, lost 4,851 in Rocket Pool ETH (rETH) worth $8.5 million and 9,579 Lido staked ETH (stETH) valued around $15.6 million&nbsp; 
Both assets are liquid staking derivatives (LSDs) of Ethereum’s proprietary token Ether (ETH).&nbsp; 
On-chain data showed that the theft happened over two transactions. The whale seemingly authorized access to these two LSDs after clicking on a malicious link provided by a phishing scammer. 
After gaining access to the whale’s wallet, the attacker sent rETH and stETH tokens to an address labeled “Fake_Phishing186943” on block explorer <a href="https://etherscan.io/address/0x693b725a375f599f0b6efa0d910e749e1bec1555#tokentxns" data-type="link" data-id="https://etherscan.io/address/0x693b725a375f599f0b6efa0d910e749e1bec1555#tokentxns" target="_blank" rel="noopener noreferrer nofollow">Etherscan</a>. 
Peckshield added that the stolen assets were swapped for 13,785 ETH and 1.6 million in Maker’s DAI stablecoin. The scammer also sent a portion of DAI, an algorithmic stablecoin; to a non-custodial exchange, FixedFloat, crypto exchange OKX, and a mixing service.&nbsp; 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 <a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#PeckShieldAlert</a> A whale fell victim to a <a href="https://twitter.com/hashtag/phishing?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#phishing</a> attack, losing $24.24M worth of cryptos, including ~4,851 <a href="https://twitter.com/search?q=%24rETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$rETH</a> and 9,579.2 <a href="https://twitter.com/search?q=%24stETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$stETH</a>. The phisher has already swapped these <a href="https://twitter.com/search?q=%24rETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$rETH</a> and <a href="https://twitter.com/search?q=%24stETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$stETH</a> for ~13,785 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$ETH</a> and 1.64M <a href="https://twitter.com/search?q=%24DAI&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$DAI</a>. A portion of the <a href="https://twitter.com/search?q=%24DAI&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$DAI</a> (~451K <a href="https://twitter.com/search?q=%24DAI&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$DAI</a>) has already been… <a href="https://t.co/3jPTJWeqw4" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/3jPTJWeqw4</a>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1699620018739466632?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 7, 2023</a> 
 </blockquote> 
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
Crypto phishing attacks work by luring decentralized finance (defi) users with fake links masked as legitimate URLs.&nbsp; 
Scammers are then able to authorize transactions and withdrawals from the victim’s wallets before siphoning stolen assets through mixers and anonymization tools.&nbsp; 
The $24 million in ETH derivatives lost to bad actors is one of several similar incidents in 2023. 
In March, another victim <a href="https://crypto.news/investor-loses-3-8m-worth-of-tokens-in-phishing-attack/" data-type="link" data-id="https://crypto.news/investor-loses-3-8m-worth-of-tokens-in-phishing-attack/" rel="noopener noreferrer nofollow">lost</a> $3.8 million in Rocket Pool (RPL) to a phishing scam. 
Phishing hackers have also targeted <a href="https://crypto.news/phishing-scammer-linked-to-nft-thefts-including-bayc/" target="_blank" rel="noopener noreferrer nofollow">non-fungible token (NFT) holders</a>, MetaMask users, X accounts (former Twitter), and even blockchains. 
On Aug. 22, layer 1 network Terra halted its website to mitigate phishing attacks. 
 Read more: <a href="https://crypto.news/terra-blockchain-shuts-down-its-website-to-prevent-phishing/" rel="noopener noreferrer nofollow"> Terra blockchain shuts down its website to prevent phishing </a>

Crypto whale losses over $24m in phishing scam

crypto.news

Other articles published on Sep 7, 2023

Ripple Invests $11 Million in European Blockchain Education

Thailand embraces crypto wallets for nationwide airdrop

Whale Sells PEPE Tokens Worth $1.2 Million, Faces $242,000 Loss

Stake hacker bridges $1.5m in stolen MATIC

Genesis Sues Parent Firm DCG Over $600 Million Loan Repayment

Ben Armstrong Is Back, Speaks His Mind in Explosive Interview Prior to Incident

Join our free newsletter for daily crypto updates!