2024

Refund

Read

<div class="protos">
 The victim of a $70 million ‘address poisoning’ scam is in the process of being refunded, following on-chain negotiations with the perpetrator.
 At the time of writing, over half of the funds (14,500 ETH, worth $43.5M) have been <a rel="noopener noreferrer nofollow" title="returned" href="https://thebittimes.com/tag/returned.html">returned</a> to the victim’s Ethereum <a rel="noopener noreferrer nofollow" title="address" href="https://thebittimes.com/tag/address.html">address</a>.
 Beginning at around 8AM UTC, almost exactly a week after the initial loss of 1155 WBTC, transactions of between 25 ETH ($75k) and 50 ETH ($150k) began to stream into the victims address. The transfers came directly from the hundreds of addresses into which the attacker had previously dispersed the stolen funds.
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 The attackers behind the 1155 $WBTC phishing incident appear to be returning the funds. https://t.co/RLALtihedO pic.twitter.com/mzPf4O2enL— SlowMist (@SlowMist_Team) May 10, 2024
 </blockquote>
 </div>
 </figure>
 Address poisoning is a method scammers use to trick crypto users into sending funds to an address which appears almost identical to one they have interacted with previously.
 As crypto security firm SlowMist’s report explains, the attack requires pre-emptively generating thousands of addresses, before monitoring blockchain transactions for potential targets. Scammers then send ‘dust’ transactions (of negligible value) from an address which has matching leading and trailing characters, in order to ‘poison’ the victim’s transfer history.
 <figure class="wp-block-image"><img decoding="async" src="https://thebittimes.com/image/getimage/?url=https://lh7-us.googleusercontent.com/fZLACTA9y8W0P01nWeptNpKYkjpIBV-Vf80Q0fBdkM0Pxlef62Q3mr5yh-e_DbAU0GjzErcXQHMx0vxCcxEhs9Rw8jBjLhGskWsAo59zgD4mgDFaZ2KCoKB6eEBPkotvXIucpoN_7NHQxDKeMIsShVM" alt>
 </figure>
 Once the trap is set, the attackers rely on the victim accidentally copy-pasting the malicious <a rel="noopener noreferrer nofollow" title="address" href="https://thebittimes.com/tag/address.html">address</a> from a wallet or block explorer, inadvertently sending funds directly to the scammer.
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 ALERTAre we mistaken, or has someone truly lost $68M worth of $WBTC? Our system has detected another address falling victim to address poisoning, losing 1155 $WBTC. Victim: https://t.co/5NKlOFnepJ Address poisoner: https://t.co/R6fF0QipBH Poison transaction:… pic.twitter.com/UpG34ZcZvY— Cyvers Alerts (@CyversAlerts) May 3, 2024
 </blockquote>
 </div>
 </figure>
 Read more: Crypto security firms more concerned with social media clout than the details
 In this case, once the attack had proved a success, the resulting 1,155 WBTC were swapped to 22,955 ETH, before being layered into hundreds of further <a rel="noopener noreferrer nofollow" title="address" href="https://thebittimes.com/tag/address.html">address</a>es.
 The day after making their costly error, the victim sent a message to the scammer via Ethereum’s input data messaging system:
 “You won bro. Keep 10% to yourself and get 90% back. Then we’ll forget about that. We both know that 7m will definetely make your life better, but 70m won’t let you sleep well.”
 Read more: Here’s what on-chain messages reveal about the $200M Euler Finance hack
 The victim kept up the pressure the following day, sending three more messages and setting a deadline for the ‘bounty’ offer.
 In SlowMist’s report, published Wednesday, the firm identified previous attacks carried out by the perpetrator as well as an exchange <a rel="noopener noreferrer nofollow" title="address" href="https://thebittimes.com/tag/address.html">address</a>, OTC desks and IP <a rel="noopener noreferrer nofollow" title="address" href="https://thebittimes.com/tag/address.html">address</a>es connected&nbsp; to their activities (though, as SlowMist points out, these may be simply be VPN <a rel="noopener noreferrer nofollow" title="address" href="https://thebittimes.com/tag/address.html">address</a>es).&nbsp;
 Yesterday, the scammer sent an on-chain message asking for the victims’s Telegram handle along with 50 ETH, seemingly a gesture of good faith. From there, negotiations went off-chain.
 Earlier today, the refund process began. Over half of the stolen amount has so far arrived over the course of more than 200 transactions, following the victim’s confirmation of receipt of the first batch.
 Got a tip? Send us an email or ProtonMail. For more informed news, follow us on&nbsp;X,&nbsp;Bluesky, and&nbsp;Google News, or subscribe to our&nbsp;YouTube&nbsp;channel.
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/refund-of-70m-address-poisoning-scam-ongoing-over-50-returned-protos-tbt87991.html">https://thebittimes.com/refund-of-70m-address-poisoning-scam-ongoing-over-50-returned-protos-tbt87991.html</a>

Refund of $70M 'address poisoning' scam ongoing, over 50% returned | Protos

TheBitTimes

Other articles published on May 10, 2024

Impact of Whale Movements on Altcoin Prices

Bitcoin to Hit $1M by the Year 2030: Jack Dorsey

Bitcoin’s Recent Surge: Key Market Insights

What Roger Ver’s last major public speech may tell us about his prosecution

Digest Decimal

Massive Dogecoin (DOGE) Withdrawal Stuns Robinhood Amid SEC Drama

Join our free newsletter for daily crypto updates!