2024

Mist

when

<div class="finbold">
 <p class="paragraph">A whale lost 1,155 Wrapped BTC (WBTC), <a rel="noopener noreferrer nofollow" title="worth" href="https://thebittimes.com/tag/worth.html">worth</a> $71 <a rel="noopener noreferrer nofollow" title="million" href="https://thebittimes.com/tag/million.html">million</a>, due to a <a rel="noopener noreferrer nofollow" title="phishing" href="https://thebittimes.com/tag/phishing.html">phishing</a> attack on May 3. Surprisingly, the attacker returned all the funds to the <a rel="noopener noreferrer nofollow" title="victim" href="https://thebittimes.com/tag/victim.html">victim</a> a week later.</p>
 <p class="paragraph">On May 2, the whale spent $29.6 million DAI to buy 502 WBTC at $58,951. Later, on May 4, the victim created a new address and transferred 0.05 ETH for testing—a usual practice when moving large amounts.</p>
 <p class="paragraph">As reported by Finbold, the attacker generated phishing addresses in advance and monitored users’ on-chain activities. When the victim whale was about to transfer WBTC, the attacker sent 0 ETH using a phishing address.</p>
 <div class="border border-red-300 rounded-xl p-6 not-prose mb-6">
  <h3 class="text-2xl font-black mt-0 flex gap-x-3 mb-5">
   <svg width="32" height="32" viewbox="0 0 32 32" fill="none" xmlns="//www.w3.org/2000/svg"><path d="M4 10.6665V25.3332C4 28.2678 6.392 29.3332 8 29.3332H28V26.6665H8.016C7.4 26.6505 6.66667 26.4078 6.66667 25.3332C6.66667 24.2585 7.4 24.0158 8.016 23.9998H28V5.33317C28 3.8625 26.804 2.6665 25.3333 2.6665H8C6.392 2.6665 4 3.73184 4 6.6665V10.6665ZM8 5.33317H25.3333V21.3332H6.66667V6.6665C6.66667 5.59184 7.4 5.34917 8 5.33317Z" fill="#EF4444"> 
    </path> <path d="M15.996 18.6668L20.4626 14.2815C20.738 14.0166 20.9571 13.6989 21.1068 13.3473C21.2564 12.9957 21.3336 12.6176 21.3336 12.2355C21.3336 11.8534 21.2564 11.4752 21.1068 11.1236C20.9571 10.7721 20.738 10.4543 20.4626 10.1895C19.9074 9.64148 19.1587 9.33422 18.3786 9.33422C17.5985 9.33422 16.8498 9.64148 16.2946 10.1895L15.996 10.4801L15.6973 10.1881C15.1423 9.64023 14.3938 9.33301 13.614 9.33301C12.8341 9.33301 12.0856 9.64023 11.5306 10.1881C11.2552 10.453 11.0361 10.7707 10.8865 11.1223C10.7368 11.4739 10.6597 11.852 10.6597 12.2341C10.6597 12.6162 10.7368 12.9944 10.8865 13.346C11.0361 13.6975 11.2552 14.0153 11.5306 14.2801L15.996 18.6668Z" fill="#EF4444"> 
    </path>
   </svg> Picks for you</h3>
  <div class="grid md:grid-cols-2 gap-x-10 gap-y-3 md:gap-y-5 divide-y divide-gray-300 md:divide-y-0">
   <div class="md:odd:pr-4 md:odd:border-r odd:border-gray-300 pt-3 first:pt-0 md:pt-0">
    Bitcoin or Ethereum? We asked ChatGPT which asset is a better buy for summer 2024 <span class="self-center text-xs text-slate-500">34 mins ago</span>
   </div>
   <div class="md:odd:pr-4 md:odd:border-r odd:border-gray-300 pt-3 first:pt-0 md:pt-0">
    Crypto wallet adds pay-per-use access to premium subscription AIs <span class="self-center text-xs text-slate-500">1 hour ago</span>
   </div>
   <div class="md:odd:pr-4 md:odd:border-r odd:border-gray-300 pt-3 first:pt-0 md:pt-0">
    Economist taunts Bitcoin replacing fiat is like ‘a sideshow in Las Vegas’ <span class="self-center text-xs text-slate-500">3 hours ago</span>
   </div>
   <div class="md:odd:pr-4 md:odd:border-r odd:border-gray-300 pt-3 first:pt-0 md:pt-0">
    Here’s when the XRP price could hit $0.62 <span class="self-center text-xs text-slate-500">4 hours ago</span>
   </div>
  </div>
 </div>
 <div class="mb-4 bg-slate-50 rounded-md layout-adjustment">
  <div id="finbold.com_middle" style="min-width: 300px; min-height: 250px;">
  </div>
 </div>
 <figure class="wp-block-image size-large"><img decoding="async" width="1024" height="187" src="https://cdn.thebittimes.com/images/2024/05/13/5e27e29346463cb96625a746cc7b7e51.webp" alt class="wp-image-175526" srcset="https://cdn.thebittimes.com/images/2024/05/13/5e27e29346463cb96625a746cc7b7e51.webp 1024w, https://cdn.thebittimes.com/images/2024/05/13/5e27e29346463cb96625a746cc7b7e51.webp 300w, https://cdn.thebittimes.com/images/2024/05/13/5e27e29346463cb96625a746cc7b7e51.webp 768w, https://cdn.thebittimes.com/images/2024/05/13/5e27e29346463cb96625a746cc7b7e51.webp 1476w" sizes="(max-width: 1024px) 100vw, 1024px">
  <figcaption class="wp-element-caption">
   Victim’s transaction history. Source: <em>Etherscan</em> / <em>Lookonchain</em>
  </figcaption>
 </figure>
 <h2 class="wp-block-heading" id="h-a-specific-phishing-address-poisoning-attack">A specific phishing: Address poisoning attack</h2>
 <p class="paragraph">Interestingly, this attack used a technique known as “Address Poisoning,” as it poisons the victim’s transaction history. The phishing address had the same starting and ending letters as the whale’s new address.</p>
 <p class="paragraph">This attack is particularly hard to spot because many <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a> wallets hide the middle part of the address with “…” to improve the user interface. Moreover, users often copy addresses from transaction histories and only check the starting and ending letters.</p>
 <p class="paragraph">Therefore, the whale mistakenly copied the phishing address and sent 1,155 WBTC to the attacker.</p>
 <h2 class="wp-block-heading" id="h-attacker-returns-stolen-71-million-to-phishing-victim">Attacker returns stolen $71 million to phishing victim</h2>
 <p class="paragraph">On-chain data shows that the attacker immediately converted the stolen WBTC into 22,960 ETH, possibly for money laundering purposes. <em>Lookonchain</em> reported the entire development of these events and summarized it in a post on X on May 12.</p>
 <figure class="wp-block-image size-large"><img decoding="async" width="1024" height="260" src="https://cdn.thebittimes.com/images/2024/05/13/ff221fc68897c5301480fc3e6aaad716.webp" alt class="wp-image-175527" srcset="https://cdn.thebittimes.com/images/2024/05/13/ff221fc68897c5301480fc3e6aaad716.webp 1024w, https://cdn.thebittimes.com/images/2024/05/13/ff221fc68897c5301480fc3e6aaad716.webp 300w, https://cdn.thebittimes.com/images/2024/05/13/ff221fc68897c5301480fc3e6aaad716.webp 768w, https://cdn.thebittimes.com/images/2024/05/13/ff221fc68897c5301480fc3e6aaad716.webp 1290w" sizes="(max-width: 1024px) 100vw, 1024px">
  <figcaption class="wp-element-caption">
   Attacker’s swap history. Source: <em>Etherscan</em> / <em>Lookonchain</em>
  </figcaption>
 </figure>
 <p class="paragraph">Notably, the whale tried to contact the attacker, offering a 10% bounty for returning 90% of the funds. Initially, the attacker did not respond, but as the cybersecurity company <em>Slow Mist</em> tracked the attacker’s IPs, possibly from Hong Kong, the attacker replied and returned all the funds.</p>
 <p class="paragraph">To prevent such attacks, users should carefully check the entire address when making transfers. Saving trusted addresses in the address book and copying from there is recommended. Enabling small transaction filtering in wallets can also help filter out phishing transactions, further preserving the funds.</p>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/hacker-returns-71-million-worth-of-crypto-to-phishing-victim-tbt88143.html">https://thebittimes.com/hacker-returns-71-million-worth-of-crypto-to-phishing-victim-tbt88143.html</a></p>

Hacker returns $71 million worth of crypto to phishing victim

Table of Contents

TheBitTimes

Other articles published on May 12, 2024

NetEase Revises Content Creator Contract for Marvel Rivals After Backlash

Trump's Crypto Pivot Is Bullish...But For Whom? Mad Crypto Money With Ivan

Whales Influence Tellor Token Market

Cardano Founder Charles Hoskinson Advocates for Crypto’s Social Contract Over CBDC

US Presidential Elections Boost Meme Coins

Shiba Inu's Weekly Burn Skyrockets 338%, Millions of SHIB Disappear

Join our free newsletter for daily crypto updates!