Ethereum

2024

random

ZachXBT

<p>The past few months of 2024 looked like the calm before the storm, with much fewer rug pulls, scams and bridge exploits compared to previous periods. A new way to divert funds is making the rounds and is affecting bigger wallets.</p>
<p>The exploit became known as address poisoning. It involves sending funds to malicious wallets instead of the targeted destination. The attack affects DeFi users and decentralized traders.&nbsp;</p>
<h2 class="wp-block-heading" id="biggest-heist-affects-wrapped-btc-on-the-ethereum-blockchain">Biggest Heist Affects Wrapped BTC on the Ethereum Blockchain</h2>
<p>The most recent heist affected a sum estimated between $68M and $71M due to fluctuating market prices.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">can someone pls explain how that adress poising happens? how can one protect oneself??</p>— Karuso (@CryptoKaruso) <a href="https://twitter.com/CryptoKaruso/status/1786376764811268161?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">May 3, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>The most serious danger of address poisoning is that all involved addresses are entirely valid and usable. Most likely, an attacker injects the exploit address into a user’s history using microtransactions.</p>
<p>Then, the user may copy-paste the Ethereum address without checking, thinking it is the address of an exchange or another wallet. Ultimately, the exploit relies on human error and failure to check a few sub-strings of the address.&nbsp;</p>
<p>Supporters of human-readable identities also noted that ENS names could save the hassle of comparing address strings. But even comparing the first and last four address letters is sometimes not enough against sending funds to the wrong destination.&nbsp;</p>
<p>The current exploit did not even include attacks against the copy-paste function but relied on overlooking the address injected into the wallet’s history. Another form of poisoned address attack is more advanced and involves a compromised wallet that generates private keys already known to the creator.</p>
<h2 class="wp-block-heading" id="impersonators-run-with-the-latest-big-scam">Impersonators Run with the Latest Big Scam</h2>
<p>The latest large-scale attack has been used by multiple social media personas, who seem to impersonate the real victim. The wallet’s owner has not come forward in a reliable way, and many claim to be the actual owner, as a way to shill their tokens or NFT.&nbsp;</p>
<p>Researcher @Zachxbt remains skeptical, while watching out for new scammers:&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Sign a message from “your” address to prove ownership or stop larping. <br><br>I highly doubt someone with $68M is going to:<br><br>&gt;post a donation address after<br>&gt;do a 1-1000 SOL meme coin challenge<br>&gt;shilling ref links<br>&gt;participate in a $24K giveaway <a href="https://t.co/zDCsBQ0TKe" rel="noopener noreferrer nofollow" target="_blank">pic.twitter.com/zDCsBQ0TKe</a></p>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1786864926381781056?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">May 4, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>The high-profile exploit has been used once again for fake giveaways, NFT airdrops or simply to gain exposure for a donation address.</p>
<h2 class="wp-block-heading" id="can-funds-be-saved-from-tainted-addresses">Can Funds be Saved from Tainted Addresses?</h2>
<p>Not all blockchain transactions are irreversible. Currently, the wallet owner has reached out to the hackers, offering a 10% commission if they return the funds. Depending on the protocol, wrapped BTC may also be eligible for a return on the side of block validators.&nbsp;</p>
<p>At present, there is no evidence of fund relocation.&nbsp;</p>
<h2 class="wp-block-heading" id="is-the-address-poisoning-hack-a-serial-offense">Is the Address Poisoning Hack a Serial Offense?</h2>
<p>Some skeptics see the recent heist as a tool for engagement farming or social media clout. There is still not enough evidence to trace the wallet to its owner, though some claim to be the affected account.&nbsp;</p>
<p>What is more curious, the funds from the exploit ended up in a wallet cluster that is tied to previous token thefts.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Finally got time to trace out the $68m address poisoning.<br><br>Same threat actors stole 253+ ETH (~$800k) last month 🥴<br><br>Mar 21 $3.5k<br>Mar 22 $2.6k<br>Apr 16 $13.5k<br>Apr 24 $16k<br>Apr 26 $3.1k<br>Apr 27 $10.9k<br>Apr 29 $747k<br><br>Stolen funds dormant @ 0x87f72e2cdf45c966554c1fab942d14687a7f8996 <a href="https://t.co/biIoVUWenS" rel="noopener noreferrer nofollow" target="_blank">pic.twitter.com/biIoVUWenS</a></p>— Tay 💖 (@tayvano_) <a href="https://twitter.com/tayvano_/status/1786648942031393187?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">May 4, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>Tokens and assets on the Ethereum blockchain remain highly transparent, so this wallet cluster has been <a href="https://etherscan.io/address/0xd9a1c3788d81257612e2581a6ea0ada244853a91" rel="noopener noreferrer nofollow" target="_blank">singled out for “fake phishing”</a>. The funds have not been sent to a mixer or a decentralized protocol, or laundered though NFT.</p>
<h2 class="wp-block-heading" id="is-dust-phishing-scam-revived">Is Dust Phishing Scam Revived?&nbsp;</h2>
<p>The current exploit also looks like a revival of the <a href="https://dune.com/metasleuth/dust-phishing-scam" rel="noopener noreferrer nofollow" target="_blank">“dust phishing”</a> scam, which has been around for more than a year. The approach of this attack is the same – the attackers send small transactions to rich wallets, making them believe the sums are coming from other legitimate addresses.&nbsp;</p>
<p>Sometimes, the attacker is allowed to generate an address where even the first and last four digits are similar. The best way to avoid problems is to never copy and paste addresses from the transaction history. Instead, get the address from a reliable source each time.&nbsp;</p>
<p>The Ethereum network and its token standard cannot prevent dust transactions, and not all malicious addresses can be flagged.</p>
<p>Developers are offering a workaround using wallets that can compare random parts of the address’s digits and letters. This will prevent the problem of only verifying characters at the beginning and the end of an address.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Can wallets not warn people about these address poisoning attacks? Seems like a simple pattern to detect. Something like this…? <a href="https://t.co/WYYccZfg2d" rel="noopener noreferrer nofollow" target="_blank">https://t.co/WYYccZfg2d</a> <a href="https://t.co/J1kggebfTW" rel="noopener noreferrer nofollow" target="_blank">pic.twitter.com/J1kggebfTW</a></p>— Christoph Ono (@GBKS) <a href="https://twitter.com/GBKS/status/1787015292243026027?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">May 5, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>Other solutions include a visual representation of the address to avoid having to compare the long, unreadable strings.</p>
<p><gwmw style="display:none;"></gwmw></p>

Is This the Biggest Address Poisoning Heist? User Claims $71M wBTC Loss with New Ethereum Scam

Table of Contents

Cryptopolitan_News

Other articles published on May 6, 2024

Worldcoin Price Prediction: Is WLD $10 Target on the Horizon

The Rise of PvP Competitive Games in Web3

900 Million Telegram Users Send TON Token Soaring 15% – Details

Expert Crypto Trader Reveals Top Three Altcoins (BTC, ETH, LTC) and Bullish Outlook on Memecoin w...

XRP Community Events Ignite Enthusiasm in Ripple CEO Brad Garlinghouse: A Boost for XRP?

Binance founder’s jail sentence, BTC’s rollercoaster ride, spot Bitcoin ETFs hit record outflows ...

Join our free newsletter for daily crypto updates!