Ethereum

In a concerning trend, hackers, specifically wallet drainers, have begun to leverage the CREATE2 opcode on the Ethereum network to sidestep security measures in select wallets. This development was revealed on Sunday via an<a href="https://x.com/realScamSniffer/status/1723627800828195030?s=20" target="_blank" rel="noopener nofollow"> X post</a> by blockchain security company Scam Sniffer.&nbsp; 
<h2 id="strong-over-60-million-lost-to-hackers-via-create2-exploit-report-says-strong">Over $60 Million Lost To Hackers Via CREATE2 Exploit, Report Says</h2> 
The CREATE2 opcode was designed to allow the prediction of a contract address before deployment. Most notably, it is used by prominent decentralized exchange Uniswap to facilitate the creation of pair contracts.&nbsp; 
However, using this feature, cybercriminals have found a way to bypass security checks in regard to investor wallets. Scam Sniffer explains that hackers use CREATE2 to effortlessly generate momentary new addresses, each with a malicious signature.&nbsp; 
When unsuspecting investors sign this crafted signature, the hackers deploy a contract at the predicted address and process an unauthorized transfer of assets. Using this technique, these bad actors have been able to operate undetected, siphoning large amounts of funds from innocent victims. 
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
 1/ Here is a real case happened 9 hours ago 
 A victim lost $927k worth of <a href="https://twitter.com/search?q=%24GMX&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">$GMX</a> after signing a `signalTransfer(address receiver)` transaction to the GMX Reward Router on Arbitrum.<a href="https://t.co/kB2Je5a0pK" rel="nofollow" target="_blank">https://t.co/kB2Je5a0pK</a> <a href="https://t.co/78k82fbRfk" rel="nofollow" target="_blank">https://t.co/78k82fbRfk</a> <a href="https://t.co/izfKPeBW9p" rel="nofollow" target="_blank">pic.twitter.com/izfKPeBW9p</a> 
 — Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) <a href="https://twitter.com/realScamSniffer/status/1723666398482944080?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">November 12, 2023</a>
</blockquote> 
Speaking about a sample incident, Scam Sniffer <a href="https://x.com/realScamSniffer/status/1723666398482944080?s=20" target="_blank" rel="noopener nofollow">explains</a> how a victim lost $927,000 worth of GMX on Sunday after unknowingly authorizing a “signalTransfer” transaction that allowed hackers to withdraw these assets to a pre-computed contract address.&nbsp; 
In total, Scam Sniffer revealed that the main group of wallet drainers exploiting the CREATE2 feature has so far stolen $60 million from an estimated 99,000 victims in the last six months.&nbsp; 
Meanwhile, during a discussion with <a href="https://bitcoinist.com/slowmist-security-researcher-crypto-phishing-attack/" target="_blank" rel="noopener ">SlowMist,</a> another prominent blockchain security firm, Scam Sniffer learned a separate group of hackers has been using the same technique in address poisoning. 
Since August, findings reveal that this second group has stolen nearly $3 million worth of assets from 11 victims, of which $1.6 million belonged to a single victim. In wrapping up its report, Scam Sniffer reminds crypto users to stay on alert and verify every transaction, as the continuous cycle of detection and counter-detection in the crypto space will likely not end. 
<h2 id="strong-beyond-hacks-crypto-scams-remain-a-peril-strong">Beyond Hacks, Crypto Scams Remain A Peril</h2> 
Just like hacks, <a href="https://bitcoinist.com/uk-crypto-scams-surge-by-23-lloyds-bank-warns/" target="_blank" rel="noopener ">crypto scams</a> are also still considered a major source of concern for many investors.&nbsp;According to <a href="https://www.footprint.network/@Beosin/Footprint-Beosin-H1-2023-Report" target="_blank" rel="noopener nofollow">FootPrint x Boesin’s H1 2023 security report,</a> scams resulted in a total asset loss of $184.17 million, accounting for 28% of losses recorded by investors in the first half of the year.&nbsp; 
Notably, Scam Sniffer has reported two major scam incidents over the last 48 hours in which both victims lost a combined $468, 000 worth of assets. These attacks only underscore the continuous need for enhanced security measures in the cryptocurrency ecosystem.&nbsp; 
<img loading="lazy" decoding="async" class="aligncenter size-medium" src="https://www.tradingview.com/x/fuvcAgJO/" alt="Hackers" width="1479" height="913">

Hackers Exploit New Feature To Bypass Security Alerts – Report

Table of Contents

Bitcoinist

Other articles published on Nov 12, 2023

WEEKLY CRYPTO PRICE ANALYSIS: BTC, ETH, BNB, XRP, DOGE, ADA, AND SOL

Jim Cramer’s Predictions Defied as Bitcoin Price Witnesses Surge

Poloniex loses $100m in hack, BlackRock looks at ETH amid ETF hype, BTC targets $38K, SEC replies...

Ripple Technical Analysis: Important Support and Resistance Levels

Ready for changes? Anticipating the web3 revolution in 2024 | Opinion

Exploring Nexo (NEXO): An All-in-One Leading Crypto Platform

Join our free newsletter for daily crypto updates!