A $12.25M Mistake: Address Poisoning A few hours ago, a…
2 reactions
A $12.25M Mistake: Address Poisoning
A few hours ago, a user was address poisoned and mistakenly sent 12.25 MILLION in ETH to a hacker instead of a deposit address.
* 0xd6741220a947941bF290799811FcDCeA8AE4A7Da - User Wallet
* 0x6D90CC8Ce83B6D0ACf634ED45d4bCc37eDdD2E48 - Intended Deposit (Galaxy Digital)
* 0x6d9052b2DF589De00324127fe2707eb34e592e48 - Hacker Wallet
# How does Address Poisoning Happen?
I've talked about Address poisoning in other large theft posts. It's a spray and pray method used to target large wallets with predictable destination addresses.
It's unfortunate that some wallets don't have better security for these type of attacks. The hacker mimicked the first 6 and last 4 digits of the Intended Destination Address.
Here's a visual of what that looks like
* Fake Address - **0x6d90**52b2DF589De00324127fe2707eb34e59**2e48**
* Intended Destination Address - **0x6D90**CC8Ce83B6D0ACf634ED45d4bCc37eDdD**2E48** \- Galaxy Digital Deposit Address
A look inside the user's wallet of 0xd6741220a947941bF290799811FcDCeA8AE4A7Da. https://preview.redd.it/28xy7q4f9qgg1.png?width=1484&format=png&auto=webp&s=d5d7d15f2d13a7caa7f8c91b2edd36c044173021
It appears the attacker was trying to poison the user's wallet for quite some time with tiny transactions of USDC.
The attacker sent numerous transactions hoping the victim will copy and paste the wrong address, which is exactly what happened.
* Total investment by hacker: About .04 cents
* Return on investment by hacker: 12.25M
# Following the Funds
This is a theft in progress. As I write this, the hacker is sending 100 ETH quantities into Tornado Cash.
The Main Hacker wallet of 0x6d9052b2DF589De00324127fe2707eb34e592e48 sent the entire balance of stolen funds to **0x49a21FC945312C6fB4f8C6C4D224E74A5B96e9DF**.
The above image shows the flow of funds from the Victim's wallet --\> Hacker Wallet --\> Tornado Cash https://preview.redd.it/gwrxwqvpeqgg1.png?width=2058&format=png&auto=webp&s=d2ad8960b04d94d5063dfe204984d1cfbf86520c
What's interesting is the wallet 0x49a...e9DF appears to be an intermediary for other address poisoning victims. The 12.25M theft appears to be by far the biggest single individual loss.
The next highest appears to be about 31K in losses due to the same type of scam. I do have a destination address where I think some of the funds post Tornado Cash funds landed. I'll refrain from posting until further investigation and will post updates.
It's typically pretty hard to launder 12M without drawing the attention of law enforcement and the cybersecurity community.
# How to Prevent Address Poisoning to Your Wallet
* **Verify the Full Address:** The scammer can ONLY receive funds if you send them. Verify 2, 3, 4 times before sending funds. Oh and try to avoid sending when you're tired.
* **Use Address Book/Whitelist:** Utilize the address book feature in wallets verified addresses.
* **Avoid Historical Copy-Paste:** Don't copy and paste from your transaction history. Bad idea!
* **Use Proven Addresses:** Source recipient addresses. Again avoid transaction history as these attacks happen all too often!
Stay safe out there!
#cryptocurrency
A few hours ago, a user was address poisoned and mistakenly sent 12.25 MILLION in ETH to a hacker instead of a deposit address.
* 0xd6741220a947941bF290799811FcDCeA8AE4A7Da - User Wallet
* 0x6D90CC8Ce83B6D0ACf634ED45d4bCc37eDdD2E48 - Intended Deposit (Galaxy Digital)
* 0x6d9052b2DF589De00324127fe2707eb34e592e48 - Hacker Wallet
# How does Address Poisoning Happen?
I've talked about Address poisoning in other large theft posts. It's a spray and pray method used to target large wallets with predictable destination addresses.
It's unfortunate that some wallets don't have better security for these type of attacks. The hacker mimicked the first 6 and last 4 digits of the Intended Destination Address.
Here's a visual of what that looks like
* Fake Address - **0x6d90**52b2DF589De00324127fe2707eb34e59**2e48**
* Intended Destination Address - **0x6D90**CC8Ce83B6D0ACf634ED45d4bCc37eDdD**2E48** \- Galaxy Digital Deposit Address
A look inside the user's wallet of 0xd6741220a947941bF290799811FcDCeA8AE4A7Da. https://preview.redd.it/28xy7q4f9qgg1.png?width=1484&format=png&auto=webp&s=d5d7d15f2d13a7caa7f8c91b2edd36c044173021
It appears the attacker was trying to poison the user's wallet for quite some time with tiny transactions of USDC.
The attacker sent numerous transactions hoping the victim will copy and paste the wrong address, which is exactly what happened.
* Total investment by hacker: About .04 cents
* Return on investment by hacker: 12.25M
# Following the Funds
This is a theft in progress. As I write this, the hacker is sending 100 ETH quantities into Tornado Cash.
The Main Hacker wallet of 0x6d9052b2DF589De00324127fe2707eb34e592e48 sent the entire balance of stolen funds to **0x49a21FC945312C6fB4f8C6C4D224E74A5B96e9DF**.
The above image shows the flow of funds from the Victim's wallet --\> Hacker Wallet --\> Tornado Cash https://preview.redd.it/gwrxwqvpeqgg1.png?width=2058&format=png&auto=webp&s=d2ad8960b04d94d5063dfe204984d1cfbf86520c
What's interesting is the wallet 0x49a...e9DF appears to be an intermediary for other address poisoning victims. The 12.25M theft appears to be by far the biggest single individual loss.
The next highest appears to be about 31K in losses due to the same type of scam. I do have a destination address where I think some of the funds post Tornado Cash funds landed. I'll refrain from posting until further investigation and will post updates.
It's typically pretty hard to launder 12M without drawing the attention of law enforcement and the cybersecurity community.
# How to Prevent Address Poisoning to Your Wallet
* **Verify the Full Address:** The scammer can ONLY receive funds if you send them. Verify 2, 3, 4 times before sending funds. Oh and try to avoid sending when you're tired.
* **Use Address Book/Whitelist:** Utilize the address book feature in wallets verified addresses.
* **Avoid Historical Copy-Paste:** Don't copy and paste from your transaction history. Bad idea!
* **Use Proven Addresses:** Source recipient addresses. Again avoid transaction history as these attacks happen all too often!
Stay safe out there!
#cryptocurrency
1
1
| 5,000 mlx | |
| 9 | |
| 2 |