TRON

Fraudulent Transactions Exploit Wallet Vulnerability, Could Have Stolen More than $3 Million in TRXCoinsDo, a Singaporean blockchain asset security company, has uncovered a sophisticated scam involving fake transactions and multiple smart contracts targeting major centralized cryptocurrency exchanges. While only a single successful instance of this scam has been confirmed, further analysis of the smart contracts in question revealed that the perpetrators initiated hundreds of these fake transactions, potentially defrauding exchanges, payment gateways, and centralized wallet companies of more than $3 million USD worth of TRX.It is highly possible that both firms who built their own wallet infrastructure as well as major wallet solution providers like Fireblocks are not adequately prepared to detect this type of fraudulent transfers. This presents a major operational loophole to be exploited by malicious actors.The scam began with the perpetrator initiating a fraudulent TRX transfer to their deposit address on a centralized exchange. Through the use of multiple smart contracts, they were able to trick the exchange’s wallet infrastructure into validating the fraudulent transaction. This led the exchange to credit the equivalent amount of cryptocurrency to the perpetrator’s account, which they promptly liquidated for cash.<img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc5OkpBtdLO-bPOZIaWIqJl0xFMwGBy6qiMZ1IjZmQP71CAOwNzzahcxG1PK9P7u8TISoAItMR-EOPa5gzFhQvUzcWsbH3MNRIquknw_QqjAEyFdCnfj2muDpqLCyUKs7kHo_N43om7OMXucoX6MH5smnIL?key&#61;Yzt-OJPXBK6QK_4e7678Ag" />The transaction looks just like a regular, successful transfer via smart contract.The perpetrator had mass-triggered a smart contract (Smart Contract A) to initiate multiple transfers via a proxy smart contract (Smart Contract B) to roughly 100 end-user deposit addresses on various centralized exchangesSmart Contract A was programmed to interact with Smart Contract B to initiate transfers as internal transactions, a sophisticated technique allowing the perpetrator to make fraudulent transactions appear legitimate.<img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXf2-pQiL_fc4kl1hnsOUrBtBeWse3nHW2B8aQMJAKeNe2Y-9Z-wh8u0TUy7y5klPd-yFmtxTBBT5fsOTThM9U-MEEBiB0o389KB6BuIay-YGRslHPQhqlyd8d8vz_YfFRkULTl2jxpZarI6Rm45fh3aijU?key&#61;Yzt-OJPXBK6QK_4e7678Ag" />Graphical illustration on how the <a href="https://tronscan.org/#/transaction/4aadc66568c51683e5c319ab6bfa5a4ba01a1185d1e6de04e060e32b6b53c550" rel="noopener noreferrer nofollow">fraudulent transaction</a> was madeWhat was so insidious about this fraudulent transaction was the fact that it could only be identified by a single parameter in the transaction data - &#34;rejected&#34;: true.<img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXflPUMPdSl1QrW6crFjWu9-C2vPqUA_chSdSRKPyn4B6d-doKHpCIKZKFuO4__1osyxgM4oPQ7flFMWEdI5qhLT32I4Y4f1p5jP1JRkGG6dRFMdJ2PMLyi67BulImso96NpQZItOqWtRiWfQupV0ZBkl7Uw?key&#61;Yzt-OJPXBK6QK_4e7678Ag" />A tell-tale sign of a fraudulent transaction.Malicious actors are getting more creative in their ways of stealing funds, targeting previously overlooked loopholes and vulnerabilities instead of private keys. Just look at <a href="https://www.coindesk.com/business/2024/07/19/wazirx-liminal-custody-blame-each-other-as-230m-crypto-exploit-leaves-customers-stranded/" rel="noopener noreferrer nofollow">the recent WazirX and Lmnl case</a>, which resulted in losses over $230 million. This raises the question of whether wallet providers are overly focused on encryption technologies and algorithms, potentially at the expense of more practical security measures.To better protect yourself from scams like the one mentioned, it is recommended that all wallet solution providers take extra care to verify transaction details, both internal and external, especially when smart contracts are involved.Source: <a href="https://www.coinsdo.com/en/blog/new-scam-alert-tron" rel="noopener noreferrer nofollow">https://www.coinsdo.com/en/blog/new-scam-alert-tron</a>

Singaporean Blockchain Wallet Security Company Discovers New Type of Scam Targeting Centralized Exchanges

Crypto Adventure

Other articles published on Aug 6, 2024

Do Kwon to be Extradited to South Korea: Montenegro Court Upholds Decision

Ronin Got Exploited for $12M

Chainlink Join Hands With Wenia to Boost Transparency of Colombian Peso-Backed Stablecoin

MultiversX (EGLD) Faces Pressure Near Demand Zone: Can Bulls Prevail

Worst Day in 2024: Bitcoin (BTC) Obliterated With -$10,000 Move, Ethereum (ETH) In Freefall, Shib...

Trump’s $35 Trillion Debt Plan: Analysing The Impact on Cryptos

Join our free newsletter for daily crypto updates!