2024

Uniswap

<p>The post <a href="https://coinpedia.org/news/beware-crypto-wallet-drainers-leverage-legitimate-uniswap-contracts-for-phishing-attacks/">Beware: Crypto Wallet Drainers Leverage Legitimate Uniswap Contracts for Phishing Attacks&nbsp;</a> appeared first on <a href="https://coinpedia.org">Coinpedia Fintech News</a></p> 
<p>As a new tactic, wallet drainers are now using Multicall, a legitimate feature of <a href="https://coinpedia.org/price-prediction/uniswap-uni-price-prediction/" target="_blank" rel="noreferrer noopener">Uniswap</a> V3, to circumvent security measures and carry out advanced phishing attacks. It is this strategy that just recently resulted in 85 Lido <a href="https://markets.coinpedia.org/bitcoin/" target="_blank" rel="noreferrer noopener">ETH</a> displacement from a victim who was unfortunately enticed by the fraudulent actions.</p> 
<h2 class="wp-block-heading" id="h-how-did-the-hacker-do-it"><strong>How Did the Hacker Do It??</strong></h2> 
<p>The victim’s experience illustrates the ascending trend for hackers to misuse Permit signatures that make the spender appear as the Uniswap Multicall contract for unauthorized asset transfer.&nbsp;</p> 
<p>Web3 anti-scam platform, Scam sniffer, alerted the community with this latest action of scammers. With the help of Multicall’s aggregate function consisting of permit and transfer features, the drainer executed the transaction stealthily and successfully from the victim, who lost 85 Lido ETH, which is nearly 269,620 s per the market rates.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr"><img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f9f5.png" alt="🧵" class="wp-smiley" style="height: 1em; max-height: 1em;"> [1/6] <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/26a0.png" alt="⚠" class="wp-smiley" style="height: 1em; max-height: 1em;"> Wallet drainers are using legitimate contracts like Uniswap V3's Multicall to bypass wallet security alerts for phishing attacks <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">.<br><br>A victim lost 85 Lido ETH to such tactics 5 days ago. <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f50d.png" alt="🔍" class="wp-smiley" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f4b8.png" alt="💸" class="wp-smiley" style="height: 1em; max-height: 1em;"> <a href="https://t.co/7MsdP5qSVk">pic.twitter.com/7MsdP5qSVk</a></p>— Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) <a href="https://twitter.com/realScamSniffer/status/1786949648160325767?ref_src=twsrc%5Etfw">May 5, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>To stay undetected by MEV (Miner Extractable Value) bots, the attacker also performed checks to ensure the authenticity of the originating address which in return made the attacker’s activity masked and made the identification process more difficult.&nbsp;</p> 
<p>Although different countermeasures were introduced to cope with this type of threat, front-running still proved to be an insurmountable barrier.</p> 
<h2 class="wp-block-heading" id="h-protecting-yourself-from-such-an-attack"><strong>Protecting Yourself From Such an Attack</strong></h2> 
<p>Developers reacted to this by activating a new version of the Multicall contract with improved permission checks to ensure that front-run attempts won’t take place again. Crypto users owe it to themselves to act with care and not give any token approval to Uniswap Multicall or rather, such similar contracts.&nbsp;</p> 
<p>As the ERC token approval function is inherent to the nature of a permissionless environment, phishing attacks can be quite challenging to fight effectively.</p> 
<p>As the crypto ecosystem continues to develop, maintaining awareness of the best security practices by staying away from malicious actors, as well as maintaining trust in the decentralized finance system, is vital. Be informed, and stay safe!</p> 
<p><strong>Also, Read About the Same Incident: <a href="https://coinpedia.org/news/attacker-steals-71-million-in-an-extremely-sophisticated-phishing-attack-that-fooled-the-investor/">WBTC Investor Loses $71 Million in Deceptive Phishing Attack</a></strong></p>

Beware: Crypto Wallet Drainers Leverage Legitimate Uniswap Contracts for Phishing Attacks

Table of Contents

CoinPedia News

Other articles published on May 6, 2024

Runes and BRC-20s are just a stepping stone for Bitcoin DeFi

Chainalysis: Ransomware payments down 50% in 2023

CRA Collects $54 Million in Undeclared Crypto Transactions

Bitfinex CTO Debunks FSociety’s False Claims of Database Breach: Impact on Coin Trading (BTC, ETH)

Binance Futures to Remove 5 Crypto Perpetual Contract Pairs: Impact on Coin Market and Symbols

Worldcoin (WLD) Hits 3-Week High: What’s Next?

Join our free newsletter for daily crypto updates!