Collab.Land

Apple

ERC20

A new scam circulating on Telegram allows the attacker to drain a victim’s crypto wallet without the victim needing to confirm a transaction, according to user reports and blockchain data.
The scam only works on tokens that comply with the ERC-2612 token standard, which allows for “gas-less” transfers or transfers by a wallet that does not hold Ether (ETH). While the method does not require users to approve a transaction, it appears to require tricking the user into signing a message.&nbsp;
As more tokens implement the ERC-2612 standard, this particular type of attack may become more prevalent.
Cointelegraph was contacted by a user who said he lost over $600 worth of Open Exchange (OX) tokens after visiting what he thought was the official Telegram group for the token’s developer, OPNX. However, it was a phishing scam.
When he entered the Telegram group, he was asked to press a button to connect his wallet to prove that he is not a bot. This opened a browser window and he connected his wallet to the site, believing that a mere connection did not pose a risk to his funds. However, within a few minutes, all of his OX tokens were drained. The victim claimed that he never approved a single transaction from the page, yet his funds were stolen anyway.
Cointelegraph visited the Telegram group and found that it featured a fake version of the Collab.Land Telegram verification system. The real Collab.Land system sends messages from Telegram channel @collablandbot, spelled with two lowercase “l”s. This fake version sent messages from @colIablandbot, with a capital “I” instead of a second lowercase “l.” In the font that Telegram uses for its usernames, these two letters look extremely similar.
<figure><img src="https://s3.cointelegraph.com/uploads/2024-02/35bfd64f-ec85-4d59-8dcc-0d303bf9085c.png">
 <figcaption style="text-align: center;">Fake Collab Land bot profile. Source: Telegram.
 </figcaption>
</figure>
In addition, the “connect wallet” button on authentic Collab.Land messages sends users to the URL connect.collab.info, which contains no dashes, whereas this fake version sent users to connect-collab.info, with a dash instead of a period.
<figure><img src="https://s3.cointelegraph.com/uploads/2024-02/38b954b0-6222-4d90-a89e-5a7c5ef09a14.png">
 <figcaption style="text-align: center;">User interface for malicious app. Source: connect-collab.info.
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/scammers-are-targeting-crypto-users-with-new-zero-value-transferfrom-trick" rel="noopener noreferrer nofollow">Scammers are targeting crypto users with new ‘zero value TransferFrom’ trick</a>
According to blockchain data, the attacker drained the funds by <a href="https://etherscan.io/tx/0xbc7e2e2e5cd921ef1ff0726cad1bef52e5863bf1a10d3b0b5c10d6470628acca" target="_blank" rel="noopener noreferrer nofollow">calling</a> the “transferFrom” function on the OX token contract. Under normal circumstances, this function can only be called by a third-party if the owner first calls “approve” through a separate transaction and sets a spending limit. Blockchain data shows no evidence that the victim ever made such an approval.
Approximately one hour and 40 minutes before the transfer, the attacker <a href="https://etherscan.io/tx/0x7ec830ded121ca911d389b8b672c627e47ba9eb0dd9bbd964ffa534940d6fb45" target="_blank" rel="noopener noreferrer nofollow">called</a> “Permit” on the OX token contract, setting itself as the “spender” and the victim’s account as the “owner.” They also set a “deadline” or period of time after which the permit would expire and a “value” or amount of tokens that could be transferred. The “value” was set to an arbitrarily large number.
<figure><img src="https://s3.cointelegraph.com/uploads/2024-02/41846378-d639-4bfa-b42d-3b4d4c13a7d9.png">
 <figcaption style="text-align: center;">Permit transaction made by attacker. Source: Etherscan.
 </figcaption>
</figure>
The Permit function is on lines 116-160 of the token contract's ERC20.sol file. It&nbsp;<a href="https://etherscan.io/address/0x78a0a62fba6fb21a83fe8a3433d44c73a4017a6f#code" target="_blank" rel="noopener noreferrer nofollow">allows</a> a third-party to authorize tokens to be transferred on behalf of its owner, but only if the owner delivers a signed message giving them authorization.
<figure><img src="https://s3.cointelegraph.com/uploads/2024-02/ccb1675c-04c1-4a4c-9cd4-11466a27ef47.png">
 <figcaption style="text-align: center;">OX token signing requirement for Permit function, line 154. Source: Etherscan
 </figcaption>
</figure>
The setup may explain why the attacker was able to drain the funds without tricking the owner into making a traditional token approval. However, it also implies that the attacker did trick the owner into signing a message.&nbsp;After being confronted with this evidence, the victim reported that he attempted to connect to the site a second time. This time, he noticed that there was an “additional signing dialogue,” which he must have confirmed the first time without realizing it.
The Permit function appears to be a new feature of some token contracts. It is being implemented as part of the ERC-2612 standard, which <a href="https://eips.ethereum.org/EIPS/eip-2612" target="_blank" rel="noopener noreferrer nofollow">allows</a> for transactions by wallets that don’t hold ETH. Web3 developer OpenZeppelin <a href="https://docs.openzeppelin.com/contracts/4.x/api/token/erc20#ERC20Permit" target="_blank" rel="noopener noreferrer nofollow">describes</a> the function’s purpose in this way:
<blockquote>
 “[It] can be used to change an account’s ERC20 allowance (see IERC20.allowance) by presenting a message signed by the account. By not relying on IERC20.approve, the token holder account doesn’t need to send a transaction, and thus is not required to hold Ether at all.”
</blockquote>
Over time, this feature could allow wallet developers to create user-friendly wallets that only hold stablecoins. However, Cointelegraph’s investigation has revealed that scammers are also using this feature to trick users into giving away their funds. Web3 users should be aware that an attacker can drain their funds even if they don’t make an approval transaction, as long as they sign a message giving the attacker this ability.
Related: <a href="https://cointelegraph.com/news/apple-yet-to-remove-fake-rabby-wallet-app-despite-users-being-drained" rel="noopener noreferrer nofollow">Apple yet to remove fake Rabby Wallet app as users report being drained</a>
Cointelegraph contacted the Collab.Land team for comment. Developers confirmed that the bot and website involved in this attack are not associated with the real Collab.Land protocol. After being informed of this imposter, project developers reported the scam to Telegram.

New crypto scam drains users' wallets without transaction approval

Cointelegraph

Other articles published on Feb 23, 2024

Top 10 Crypto Bot Trading Strategies to Automate Your Trading

Kelexo (KLXO) Set to Outrank Hedera (HBAR) and Aave (AAVE) as Revolutionary Crypto Platform of 2024

3 cryptocurrencies cheaper than a burger for a 2500% ROI by 2024

Dmail Network: Highly Secure Decentralised Email System

Get Ready! TEAMZ WEB3 / AI SUMMIT 2024 in Japan is on the Horizon!

Orchid Price Prediction: OXT Slumps 6% As Traders Flock To This GameFi Meme Coin With Time Runnin...

Join our free newsletter for daily crypto updates!