Ethereum

Bank

Bitcoin

when

The SlowMist security team has uncovered a novel cryptocurrency scam that exploits altered Ethereum nodes' remote procedure call (RPC) function. This type of fraud commonly targets physical offline transactions, employing Tether (<a href="https://cointelegraph.com/tether-price-index" rel="noopener noreferrer nofollow">USDT</a>) as the preferred payment method.
According to SlowMist&nbsp;<a href="https://slowmist.medium.com/unveiling-a-new-scam-malicious-modification-of-rpc-node-links-to-steal-assets-2ca324200853" target="_blank" rel="noopener noreferrer nofollow">findings</a>, the scam starts with convincing the victim to download the legitimate imToken wallet and gain trust by transferring a small amount of 1 USDT and Ether (<a href="https://cointelegraph.com/ethereum-price" rel="noopener noreferrer nofollow">ETH</a>) as bait.
Subsequently, the scammer directs the victim to change their ETH RPC URL to a node controlled by the scammer (https://rpc.tenderly.co/fork/34ce4192-e929-4e48-a02b-d96180f9f748).
The scammer modifies the node using Tenderly’s fork feature, which falsifies the user’s USDT balance to make it appear that the scammer has deposited funds into the user’s wallet. When users view the balance, they mistakenly believe the funds are legitimate.
<figure><img src="https://s3.cointelegraph.com/uploads/2024-04/5550e0fd-8adf-4b25-9b11-c9243f93261d.png" alt="" title="">
 <figcaption style="text-align: center;">Analysis of a victim’s wallet address (0x9a7…Ce4) shows that the victim’s address received a small amount of 1 USDT and 0.002 ETH from another address (0x4df…54b)&nbsp; Source: <a href="https://slowmist.medium.com/unveiling-a-new-scam-malicious-modification-of-rpc-node-links-to-steal-assets-2ca324200853" target="_blank" rel="noopener noreferrer nofollow">SlowMist</a>
 </figcaption>
</figure>
However, upon attempting to transfer out the miner’s fees to cash out the USDT, they realize they have been deceived. By this point, the scammer has disappeared without a trace.
In addition to modifying displayed balances, the fork feature can alter contract information, presenting an even more significant threat to users.
SlowMist Technology’s report stated that this type of scam exploits users’ trust and negligence, resulting in asset losses. The SlowMist security team reminds users to remain vigilant when trading and avoid using untrusted RPC nodes.
A remote procedure call lets a program run code on one computer on a remote server, mimicking local execution. In blockchain like Ethereum, RPC interacts with nodes, querying balances, sending transactions, or interacting with smart contracts.
Related: <a href="https://cointelegraph.com/news/bitcoin-hating-european-bankers-arent-stopping-scammers" rel="noopener noreferrer nofollow">Bitcoin-hating European Central Bank isn't doing much to stop scammers</a>
According to SlowMist, a user can adjust balance values using Tenderly’s custom JSON-RPC to control account balances within Tenderly Forks. This feature enables modifying account balances by setting specific values or increasing them as desired.
However, to establish a specific balance, use the code snippet “ether4s.utils.hexvalue(aBignumberish)” to convert the big number value into a suitable format without leading zeros. This snippet sets the balance value to 100 ETH for one or more addresses through the tenderly_setBalance custom RPC endpoint.
A similar scam circulated on Telegram, <a href="https://cointelegraph.com/news/new-scam-drains-wallets-without-user-approving-transaction" rel="noopener noreferrer nofollow">allowing the attacker to drain a victim’s crypto wallet</a> without the victim needing to confirm a transaction. While the method does not require users to approve a transaction, it appears to require tricking the user into signing a message.
Magazine: <a href="https://cointelegraph.com/magazine/6b-scam-accused-court-china-loophole-hong-kong-bitcoin-etf-asia-express/" rel="noopener noreferrer nofollow">$6B scam accused in court, China loophole for Hong Kong Bitcoin ETFs: Asia Express</a>

SlowMist uncovers crypto scam exploiting altered Ethereum nodes

Cointelegraph

Other articles published on Apr 26, 2024

Is SUI Sinking? TVL Tanks As Crypto Price Fails To Keep Afloat

Eminem Replaces Matt Damon as Crypto.com Celebrity Spokesperson

SHIB Burns Skyrocket 2,076%, Three XRP Price Levels to Keep Eye On, Nearly $500 Million in Ethere...

An Interview With Fleek

Ex-Ethereum Advisor Reaffirms ETH Is A Security Amid Consensys Vs SEC Lawsuit

Bitcoin Price Prediction: As “Buy Bitcoin” Sign Behind Janet Yellen Sells For $1M, Investors Floc...

Join our free newsletter for daily crypto updates!