Ethereum

United

Uniswap

DeFi

An unfortunate victim who lost 1,807 liquid staked Ether (<a href="https://cointelegraph.com/ethereum-price" rel="noopener noreferrer nofollow">ETH</a>), worth $6.91 million, on May 26 appears to have received a large share of the stolen funds back from scammers.
“Yesterday, the old phishing group Inferno Drainer used the permit offline authorization signature to phishing away nearly US$7 million in ETH re-pledged assets from a user,” <a href="https://x.com/evilcos/status/1794995931680788826" target="_blank" rel="noopener noreferrer nofollow">wrote</a> Yu Xian, co-founder of blockchain analytics firm SlowMist. “Today, they actually got a refund, which is really rare.”&nbsp;
The same day, Scam Sniffer <a href="https://x.com/realScamSniffer/status/1794984921842229391" target="_blank" rel="noopener noreferrer nofollow">posted</a> on X that the victim recouped 1,445 Ether, or 80% of the stolen funds, after the scammers allegedly kept a bounty of 20%. Analysts claimed that the wallet address involved in the breach had suffered a permit phishing attack, where a malicious actor generates an authentic off-chain authorization signature for the designated recipient to transfer ERC-20 tokens from a wallet not owned by them.&nbsp;
<figure><img src="https://s3.cointelegraph.com/uploads/2024-05/e0d1a26e-16a6-4f42-9380-b82604fcb1a9.jpg" alt="" title="">
 <figcaption style="text-align: center;">The victim who allegedly lost $7 million from a permit phishing attack. Source: Scam Sniffer
 </figcaption>
</figure>
According to SlowMist, the attack is executable due to an <a href="https://slowmist.medium.com/examining-permit-signatures-is-phishing-of-tokens-possible-via-off-chain-signatures-bfb5723a5e9" target="_blank" rel="noopener noreferrer nofollow">overlooked</a> feature in Ethereum permits, introduced through EIP-2612. The EIP enables users to interact with smart contracts without requiring prior authorization by attaching an authorization signature. However, the permit function can be executed by any account, irrespective of ownership. Hence, if users had previously compromised their wallet signatures on phishing websites, even if they did not approve of any transactions, then scammers could still utilize the permit exploit to siphon tokens from their wallets.&nbsp;
To protect against such attacks, SlowMist suggested:&nbsp;
<blockquote>
 "It is recommended to periodically use authorization tools like RevokeCash (https://revoke.cash) to identify any abnormal authorizations. For Uniswap Permit2, the authorization management tool at https://app.scamsniffer.io/permit2 can be utilized for verification. If any irregular authorizations are detected, it is crucial to promptly revoke them."
</blockquote>
Not all were sympathetic to the victim in this incident, however.&nbsp;
"How do you get phished last year for $638K and then again this year for $6.9M. Some people are just careless with their assets," <a href="https://x.com/zachxbt/status/1794580692287787139" target="_blank" rel="noopener noreferrer nofollow">commented</a> prominent DeFi sleuth ZachXBT.&nbsp;
In March, Cointelegraph reported that cryptocurrency-related scams are <a href="https://cointelegraph.com/news/crypto-investment-fraud-fbi-united-states-scams" rel="noopener noreferrer nofollow">up 53% within the past year</a>. According to the FBI, cryptocurrency-related investment fraud accounted for 86% of all investment losses within the United States in 2023.
Related:&nbsp;<a href="https://cointelegraph.com/news/normie-memecoin-team-mulls-hacker-demands-after-token-falls-99" rel="noopener noreferrer nofollow">Normie memecoin team mulls hacker demands after token falls 99%</a>

Victim who lost $7M in Ethereum re-staking exploit gets funds back

Cointelegraph

2024年5月27日公開の他の記事

The Future of Work: Personal Tokens and Career Tokenization

Crypto: The new marketing methods of Web3

Cryptocurrency Renzo Restaked ETH Up More Than 3% In 24 hours

Notcoin (NOT) Price Pumps – Here’s Why This Summer Could be All About TON Ecosystem

Spot Ether ETFs are now officially legal in the US: Law Decoded

Justin Sun Advocates Pro-Crypto President Amid Trump-Biden Tensions

ニュースレターを購読して暗号資産の最新情報を毎日入手！