2024

Wrapped Bitcoin

Bitcoin

The address-poisoning attacker who allegedly tricked a user into sending them $68 million worth of Wrapped Bitcoin (WBTC) has sent $153,000 worth of Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>) back to the victim in an apparent show of good faith. In the same transaction, the attacker sent a message agreeing to negotiate and asking the victim for a Telegram username where they can be contacted. The amount sent back represents just 0.225% of the total funds allegedly stolen.
Blockchain data shows that on May 5, the attack victim, whose account ends in 8fD5, <a href="https://etherscan.io/idm?addresses=0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5%2C0x20cBf5c444D4F07F4Cb5C37585e59F4aC1b472F1%2C0xcf049aa810caE4c402908E77Bbf14710673CdA6D&amp;type=1" target="_blank" rel="noopener nofollow">sent</a> three messages to an account ending in dA6D. The recipient of the message had received funds from the attacking account, <a href="https://etherscan.io/address/0xd9a1c3788d81257612e2581a6ea0ada244853a91" target="_blank" rel="noopener nofollow">labeled</a> “FakePhishing327990” on Etherscan, through several intermediate accounts. This implies that dA6D was likely to have been controlled by the attacker. 
The messages implied that the victim was willing to give the attacker 10% of the funds as a bounty and refrain from prosecuting if they returned the other 90%. The victim stated:
<blockquote>
 “We both know there's no way to clean this funds. You will be traced. We also both understand the ‘sleep well’ phrase wasn't about your moral and ethical qualities. Nevertheless, we officially admin your right to the 10%. Send 90% back. There are 24 hours for you before 10am UTC, 6th May 2024 to make a decision that will change your life, in any case.”
</blockquote>
At 11:37 am UTC on May 9, another account ending in 72F1 responded by <a href="https://etherscan.io/tx/0xbf38e389b6b584642fffa4ea923637789cbdc667a3e379a8d72e02df087cb8a9" target="_blank" rel="noopener nofollow">sending</a> 51 Ether (ETH) (worth $153,000 at today’s price) to the victim. 72F1 had also received funds from FakePhishing327990 through several intermediate accounts, indicating it was also under the attacker's control. 
In the transaction that sent the 51 ETH, the attacker also posted a message stating “PleaseleaveyourtelegramandIwillcontactyou.” They then attempted to correct their bad punctuation at 11:43 am, posting an additional message that stated: “Please leave your telegram and I will contact you[.]”
In response, the victim posted a Telegram username where they can be contacted.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-05/48198367-f887-4d5d-8eb4-7c046a4ac2c3.png">
 <figcaption style="text-align: center;">
 Address poisoning victim negotiates with attacker. Source: Etherscan.
 </figcaption>
</figure>
The negotiation occurred after the attacker allegedly <a href="https://cointelegraph.com/news/trader-loses-68-million-address-poisoning-scam">tricked the victim into sending</a> 1,155 Wrapped Bitcoin (WBTC) (worth $68 million at the time) into their account by mistake, which they did through an “address poisoning” transaction.
Blockchain data shows that at 09:17 am on May 3, the attacker used a smart contract to <a href="https://etherscan.io/tx/0x9147d74ef5749b7f27eb2e2528e5a611060b3f609b435f7f50ac87f49e5b957c" target="_blank" rel="noopener nofollow">transfer</a> 0.05 of a token from the victim’s account to the attacker's account. The token transferred had no name listed on Etherscan and was simply referred to as “ERC-20.” Under normal circumstances, an attacker cannot transfer a token from another user without their consent. But in this case, the token had a custom design that allowed it to be transferred from an account without the user’s consent.
At 10:31 am on the same day, the victim <a href="https://etherscan.io/tx/0x3374abc5a9c766ba709651399b6e6162de97ca986abc23f423a9d893c8f5f570" target="_blank" rel="noopener nofollow">sent</a> 1,155 WBTC to this address, apparently by mistake. The address may have appeared similar to an address used by the victim to deposit funds into a centralized exchange or for some other reason.
In addition, the victim may have seen that they sent 0.05 of a token to this address in the past and therefore assumed it was safe. However, the 0.05 tokens were sent by the attacker and only appeared to have come from the victim. 
When an attacker attempts to confuse victims by spamming them with transactions that appear to be coming from them but are actually coming from the attacker, security experts call it an “address poisoning attack.” Experts recommend that users <a href="https://cointelegraph.com/news/address-poisoning-attacks-in-crypto">carefully inspect the sending address</a> in a transaction before confirming it, so as to avoid costly errors from these kinds of attacks.
Related: <a href="https://cointelegraph.com/news/scammers-are-targeting-crypto-users-with-new-zero-value-transferfrom-trick">How to avoid zero-value transfer address poisoning attacks</a>

Address poisoning attacker sends $153K ETH to victim and agrees to negotiate

Cointelegraph

Other articles published on May 9, 2024

How is Litecoin a Winner? LTC Leads As Most Widely-Used Coin for Payments and Simple Transactions

Bitcoin's Battle: Can BTC Break Through $61,500 Resistance?

Top 9 Altcoins Poised for Significant Growth in the 2024-2025 Cycle: Solana-Based POPCAT Leads Th...

6 Meme Coins With 10X Investment Potential – Next Cryptos Set to Explode

$1.35B in Bitcoin options expire this week — Do BTC bulls or bears have the upper hand?

Daily Market Review: BTC, ETH, AKT, RUNE, KAS

Join our free newsletter for daily crypto updates!