Ethereum

United

Wrapped Bitcoin

Bitcoin

The address poisoning attacker who drained $68 million worth of Wrapped Bitcoin (WBTC) was exposed through “digital evidence,” including a “device fingerprint,” according to statements made on May 23 by Match Systems CEO Andrey Kutin. These pieces of digital evidence eventually strengthened the victims’ hand in negotiations and resulted in the return of all the funds, he claimed.
According to the Match Systems CEO, the attacker did not use regulated exchanges compliant with Know Your Customer and Anti-Money Laundering requirements. Therefore, researchers couldn’t prove the person’s identity definitively. However, they discovered “secondary” or “circumstantial” evidence that the person they were investigating had not practiced proper due diligence and that stolen funds had fallen into their hands due to negligence. This is what strengthened their hand in negotiations.
The $68 million address poisoning attack occurred on May 5&nbsp;<a href="https://cointelegraph.com/news/trader-loses-68-million-address-poisoning-scam" rel="noopener noreferrer nofollow">against an Ethereum account</a> that begins with “0x1e.” The attacker created a fake transaction that appeared to transfer the victim’s token to themselves. This confused the victim and caused them to believe that the attacker’s address was safe, as it created the appearance that the victim had voluntarily sent funds to this address in the past.
As a result, the victim sent $68 million worth of WBTC to the attacker’s address, causing losses of 97% to the account.
However, on May 10, the attacker sent nearly all of the stolen funds back to the victim, <a href="https://cointelegraph.com/news/wbtc-address-poisoner-all-funds-negotiations" rel="noopener noreferrer nofollow">resulting in a near-full recovery</a>. At the time, blockchain security platform Match Systems claimed that this sudden turn of events was the result of negotiations it had facilitated between the two parties. The team claimed that the Cryptex cryptocurrency exchange had also helped with these negotiations.
<figure data-ct-non-breakable="true"><img src="https://s3.cointelegraph.com/uploads/2024-05/eb538a8d-f733-4453-b33f-7b269642ec9b.png" alt="" title="">
 <figcaption style="text-align: center;">Source: <a href="https://x.com/MatchSystems/status/1789032737124331882" target="_blank" rel="noopener noreferrer nofollow">Match Systems</a>
 </figcaption>
</figure>
In a May 23 conversation with Cointelegraph, Match Systems’ Kutin revealed new details about how they convinced the attacker to return the stolen funds.&nbsp;
According to Kutin, the team first became aware of the poisoning attack on the day it happened, as multiple social media accounts began claiming that a crypto “whale” had transferred $68 million in WBTC to a new address. The team quickly realized the transfer was due to an address poisoning attack. However, the victim’s identity was unknown, and there was no obvious way to contact them.
The Match Systems team decided to <a href="https://etherscan.io/tx/0xc48f786637fd70fae99eff78359801b8f0470edbd00b54533801c77562481871" target="_blank" rel="noopener noreferrer nofollow">post</a> a message to the Ethereum network, addressing it to the victim. “If the hacker does not make a refund, please contact us for help,” the message stated.
In response, a “third party” contacted the Match researchers, Kutin stated. The victim did not want to identify themselves, so they used a liaison to facilitate communication. Cryptex also became involved during this period and offered to help facilitate negotiations.
The attacker did not seed their wallet with funds from a regulated exchange, nor did they attempt to cash out the stolen loot through one of these exchanges. As a result, there was no easy way to determine the attacker’s identity.
However, the team was able to trace some of the attacker’s transactions to IP addresses in Hong Kong, Kutin claimed. These addresses became the springboard for further investigation.
In a May 8 blog post, blockchain security platform SlowMist also claimed to have discovered the IP addresses. According to it, the addresses were&nbsp;<a href="https://slowmist.medium.com/small-bait-big-fish-unveiling-the-1155-wbtc-phishing-incident-22bf53b6fe60" target="_blank" rel="noopener noreferrer nofollow">found</a>&nbsp;through SlowMist’s "intelligence network.”&nbsp;The IP addresses appeared to be related to “mobile stations” or cell phone towers, although SlowMist could not completely rule out the possibility that they were VPN servers.
<figure data-ct-non-breakable="true"><img src="https://s3.cointelegraph.com/uploads/2024-05/ee5099cc-9758-4198-9500-d9ad59d9a006.png" alt="" title="">
 <figcaption style="text-align: center;">The address poisoner’s suspected IP addresses with redacted portions. Source: Slowmist
 </figcaption>
</figure>
According to Kutin, Match Systems was able to connect these IP addresses to further pieces of “digital evidence” that could be used to identify the attacker, including a “device fingerprint.”
&nbsp;A “device fingerprint” can <a href="https://trustdecision.com/resources/blog/what-is-device-fingerprint-how-does-it-work" target="_blank" rel="noopener noreferrer nofollow">include</a> information such as the user’s operating system, processor type, memory, screen resolution, browser version, plugins and extensions, time zone settings, language preferences, installed fonts, average typing speed, and browning habits, among other data, according to cybersecurity platform Trust Decision.
Related: <a href="https://cointelegraph.com/news/assange-dao-crypto-activities-suspicious-caution" rel="noopener noreferrer nofollow">AssangeDAO’s crypto activities suspicious, analysts urge caution</a>
Kutin claimed that such digital evidence is the only way to catch cybercriminals in today’s environment. Attackers rarely attempt to cash out through regulated exchanges anymore. Today, there are “special laundering services” that make it easy for hackers to trade their crypto for cash.
The United States sometimes prosecutes these laundering services, but “maybe they have self-destroyed chats, and there will be nothing in their phones or their devices,” making it impossible for authorities to gather evidence against them, Kutin suggested. People have become “well educated on both sides.”
Instead of attempting to go after these laundering services, Match Systems focuses on finding a “very thin thread” of digital evidence that can be used to identify a scammer. This thin thread can include IP addresses, device fingerprints, and other “tips and tricks.”
The evidence was “secondary” or “circumstantial,” Kutin acknowledged. Since it only proved that a device was used to launder the stolen funds, it could not be tied directly to the attack itself. However, it could still prove that the person who performed the transactions had not practiced due diligence in determining the source of the funds received.
“Oh no, we received the stolen money. It’s not our stolen money,” Kutin said, mimicking what he often hears from attackers. But “you must know the very simple principle of due diligence,” he said.
The team used this evidence in negotiations with the attacker, who it&nbsp;<a href="https://cointelegraph.com/news/address-poisoning-attacker-sends-153-k-ethereum-negotiate" rel="noopener noreferrer nofollow"></a><a href="https://cointelegraph.com/news/address-poisoning-attacker-sends-153-k-ethereum-negotiate" rel="noopener noreferrer nofollow">contacted&nbsp;using a blockchain message</a> and attempted to start a conversation. The end result was that the attacker returned all of the funds and has not yet been prosecuted.
Kutin acknowledged that this could be seen as a bad result since the attacker was no longer of public interest for prosecution. However, he argued that the result is better than most alternatives, as at least the victim was able to recover all of their funds. “It could be a not very good end because the criminal will go away without any punishment, but it’s not very bad for both sides,” he argued.
Address poisoning attacks are a common problem for blockchain users, although most do not result in the massive losses originally seen in this case. Experts suggest that users should <a href="https://cointelegraph.com/news/scammers-are-targeting-crypto-users-with-new-zero-value-transferfrom-trick" rel="noopener noreferrer nofollow">inspect the sending address</a> in every transaction to ensure they do not fall victim to this type of attack.
Related: <a href="https://cointelegraph.com/news/exclusive-hackers-selling-stolen-tokens-coinex-stake" rel="noopener noreferrer nofollow">Cybersecurity experts catch hacker selling stolen tokens on Telegram</a>

WBTC address poisoner was exposed through ‘digital evidence’ — Match Systems

Cointelegraph

Other articles published on May 28, 2024

96 Persen Investor PEPE dalam Posisi Cuan, Harga Terus Melejit

Rollblock presale teases 30x run as DOT, ATOM, BNB holders look to maximize gains for altseason

Semler Scientific Adopts Bitcoin as Primary Treasury Reserve Asset

Crypto Market Analysis: The Rise and Fall (and Potential Rise Again) of AI Tokens

Semler Scientific Shifts To Bitcoin treasury Reserve With A $40M Investment

Semler Scientific unveils strategy for Bitcoin Treasury

Join our free newsletter for daily crypto updates!