A victim today lost over 68 MILLION in wBTC simply by copying and pasting the wrong address.
PSA – ALWAYS CHECK YOUR WALLET ADDRESS AND NEVER SEND LARGE FUNDS WITHOUT VERIFYING!
I think the scammer is going to have a REAL hard time trying to launder 68 MILLION with so many eyeballs on this case. So far I can see all the funds accounted for.
No money laundering attempts yet.
Here are the main wallets to follow:
0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 – 68M wBTC VICTIM MAIN 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 – VICTIM’s intended destination 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 – 68M wBTC Scammer MAIN
Below are where all the stolen funds are currently located:
0x68414dbe49AE09Db49F59Db44299A3642273e7C7 – ($3.27M here) 0xF14A5e70190d694Dd1C25f13B21639B33192A774 – (4.38M here) 0xcf049aa810caE4c402908E77Bbf14710673CdA6D – (5.08M here) 0x20cC20715954E0097F402e466067B3aF40b6df6f – (3.66M here) 0x02E5aD70386AeC6ea2aad0ccd32A9Ae6e3A4C86a – (6.88M here) 0x31C43429Cd5f918F19C05287E0bF7588Dfce592e – (8.13M here) 0xF34527c397BD1d151908e8b1Fb51CE4405f61afe – (9.45M here) 0x943706835942d3f0E9a2bc9aCe9dAF6973722EB0 – (10.88M here) 0x74C55e1B92c8C69DaD85Cc552F42731A45c8111a – (11.41M here) 0x32eA020A7bb80c5892df94C6E491E8914CcE2641 – (7.50M here)
About the Scammer
I looked about at some clues on who the scammer might be and I came across this wallet – 0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2. This scammer appears to be well funded and it seems this was a very targeted attack.
0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2 has numerous deposits into ChangeNOW. Below are a few. I’m showing about 300K deposited in total.
0xd9DCCD722cec4CdA2c863353288359b63192e657 – ChangeNOW 0xBec2815457f20c3B67E8D5ed8535C382Bd82C35B – ChangeNOW 0x810d3BCA5f46701B896F2818eF3b8B2F2aac0108 – ChangeNOW 0xda2a290cCaeEa7adB65E61484D6D5EA1f7E12722 – ChangeNOW 0x847A8e5Edc89069E6aBCe8B94bdC9B9A27fD776a – ChangeNOW 0xFB2D881B32437Dd924c400B191790A4a26f5f4FA – ChangeNOW
0x2bb7848Cf4193a264EA134c66bEC99A157985Fb8 also appears to be connected to the scammer. I noticed some smaller deposits into the following:
0x5d8f46E4733ab1707C0a5a968Ca305713847bE09 – Uphold 0xb2663153D818ab211e106d9995FdB938C5fD2aA1 – Uphold 0xE9eC5bA80dAABB0F5310CE3D81929D1Dbb0A892a – Amber Group 0x555C62E27b460Fc91D2C3218bAb47a68770cC35b – OKX 0x1f44238d8c9643dCAA3578BAf2680DE695D442F5 – Ceffu 0x8546Fb132F0d70C3C61BDd8CF5D3f4E16e399A9C – Copper
Lastly, I also followed the money trail to this wallet – 0xA5335dB79413e9D2CD5B1E01A42F67ff3e55e49A which is an older wallet created in 2017 with about 3M sitting in it. I did notice a Binance deposit address associated with this wallet doing large txns.
0xbc389803FF2E2d564c55e4034246BF285B3B2DDD – Binance
This needs further investigation before 100% confirming it belongs to the scammer. I don’t want to jump ahead and confirm this is a scammer wallet but it’s very suspicious.
How did this Scam Happen – Address Poisoning
Address poisoning is a tactic where a scammer will try and mirror the victim’s intended wallet. Since many wallets show the first 5 and last 5 of a wallet address, the scammer creates a wallet with the exact first and last digits of the address.
Typically the attacker spams victims with numerous transactions hoping the victim will copy and paste the wrong address.
Below is exactly how this scam worked
Fake Address – 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 – 68M wBTC Scammer MAIN Intended Address – 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 – VICTIM’s intended destination
In between these two outgoing txns, the scammer sent .64 in ETH to 0xd9A1C3788D81257612E2581A6ea0aDa244853a91. The txn was too small for my tools to pick up but Etherscan did.
Here is the Etherscan transaction in between the two transactions above – 0x87c6e5d56fea35315ba283de8b6422ad390b6b9d8d399d9b93a9051a3e11bf73
The scam transaction happened 4 minutes after the victim sent .05 ETH to its intended address. In this instance, the victim mistakenly copied and pasted the fake address of 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 and sent 68.5M to the scammer.
I’d say this looks like a targeted attack. Scammers are watching movements from whales and will try and squeeze in these small txns to make it look like the victim has the correct wallet address. As you can see, the potential for scoring a big payday requires very little investment. In this case less than one dollar.
How to Prevent Address Poisoning
If you’re in this forum I’m expecting one day we’ll all be crypto whales. It may be wishful thinking for some, but there are a few steps you can take to avoid scammers from tricking you.
Use EXTREME Caution – The more funds you’re moving, the more careful you need to be. Avoid sending txns when you’re tired, after a wild night of partying with Jim Beam, or when you’re not in a good state of mind to move funds. Overcheck to make sure you are sending to the correct wallet Whitelist – Most wallets allow you to whitelist to avoid this exact scenario. Avoid being Predictable – A strategy you can use is implementing fresh wallets for moving large funds. The victim took an hour and a half between txns giving the scammer plenty of time to squeeze in a small transaction. Implement a fresh wallet for a small test txn and then go! Track dust – Use blockchain tracing tools like Etherscan to verify all of your on-chain txns. Before sending any large funds make sure there isn’t any address poisoning attempts on your own wallet.
Stay safe out there and I do hope the victim gets his funds back.
submitted by /u/jbtravel84
[link] [comments]
