TronWeekly

Crypto World News

You are here: Home / Archives for Phishing Scam

Phishing Scam

Karma Hits Fast: zkLend Hacker Gets Scammed

by

  • $5.4 million in ETH was stolen from the hacker who attempted to launder the stolen funds.
  • The attacker mistakenly used a fraudulent version of Tornado Cash, and the entire 2,930 ETH was instantly drained.
  • Certain members of the crypto community doubt whether this hacker really lost the funds or if this was a move to avoid clashing with the law.

The hacker who exploited the Ethereum Layer 2 lending protocol zkLend for millions of dollars has lost a large portion of the stolen funds to a phishing scam. It was a bizarre twist of fate for the attacker, who had initially escaped with 2,930 ETH (around $5.4 million) at the time of the attack, only for them to be scammed while trying to launder the funds.

Hacker’s zkLend Stolen ETH Drained Immediately in Phishing Scam

The hacker wanted to cover the stolen assets using Tornado Cash, a well-known cryptocurrency mixing service. Instead, they went to the rogue site tornadoeth[.]cash, which had existed for years and conned victims. 

As soon as they synced with this fake platform, they lost 2,930 ETH to the fraudulent platform. By the time the hacker realized the transaction was on the fake Tornado platform, all their wallets were already empty.

This saga dates back to February, when zkLend experienced a $9.57 million exploit due to a decimal precision vulnerability. The hacker, using wallet address 0x64…9109, tampered with rounding errors in the lending accumulator to inflate the platform’s balance and withdraw around 3,700 ETH.

zkLend quickly halted withdrawals and started negotiating, offering the attacker a 10% white hat bounty and returning the remaining funds. The hacker, however, disregarded the offer and pushed those stolen assets through different channels like Railgun.

Hacker’s Claimed Loss from Alleged Phishing Questioned by Crypto Community

Despite the dramatic turn of events, some within the crypto community remain skeptical about the hacker’s claims on what actually happened. Some think that the event is a ploy to escape from scrutiny by law agencies and blockchain investigators.

They say that perhaps the attacker transferred the funds to a different address and staged the loss as a smokescreen. Others suspect that the hacker and the phisher are one and the same, orchestrating a scheme in which the money goes missing without too much scrutiny.

BNB Chain Shattered: Audacious $1.57M Heist Rocks Crypto World

by

In a shocking turn of events, a crafty individual with the alias “MEV Bot: 0x21…480C” on BNB Chain managed to pull off one of the most audacious financial exploits in the history of the Binance Smart Chain. On October 11, this mysterious attacker executed a perfectly orchestrated flash loan attack on the Pancakeswap BH/USDT trading pair, yielding an astronomical profit of $1.575 million, setting an unprecedented milestone for the BNB Chain.

According to EigenPhi, the MEV Bot initiated a devious scheme to manipulate the price of the $BH token. Suspicions were confirmed as Beosin monitoring discovered a deliberate act of price manipulation that led to a staggering exploitation of approximately $1.27 million. The ill-gotten gains were skillfully funneled into Tornado Cash, obscuring the path of the funds and adding another layer of anonymity to this audacious heist.

BNB Heist’s Tactical Insights

The attacker’s modus operandi was both sophisticated and daring. Firstly, they orchestrated a massive flash loan of USDT and proceeded to manipulate the Pancakeswap BH/USDT pair. The 0x33688938() call was instrumental in introducing a substantial amount of USDT to the trading contract. This action served to disrupt the liquidity ratios typically present in such pairs, skewing them significantly.

The attacker then masterfully swapped their newly acquired USDT for BH tokens using the trading pair. Following the swap, they invoked the 0x4e290832 function to remove liquidity. The result of this cunning maneuver was a remarkable shift in the liquidity removal ratio, from the standard 1 USDT:100 BH to an astonishing 1 USDT:2 BH. This significant alteration enabled the attacker to withdraw a substantially larger amount of USDT than their initial investment.

F8K8tzGbsAAJFaB
Source: X

The audacity and precision of this exploit have left the BNB Chain community stunned. The identity of the attacker, known as 0xFDbfcEEa1de360364084a6F37C9cdb7AaeA63464, remains shrouded in secrecy, leaving both authorities and cryptocurrency enthusiasts on high alert for further developments. As the cryptocurrency world continues to evolve, this spectacular event serves as a stark reminder of the need for constant vigilance in the ever-shifting landscape of digital finance.

Crypto Tycoon Suffers $24 Million Loss In Phishing Scam

by

In a recent and alarming turn of events in the crypto sphere, a high-profile whale has fallen victim to a devastating phishing scam, losing assets worth more than $24 million. This event is a stark reminder of the ongoing risks within the crypto space, including scams and hacks. The perpetrator, with ties to ten phishing websites like coindroplet.net and trustpad.ca, adds intrigue to the story, a stark reminder of crypto’s inherent dangers.

The targeted crypto whale was a significant liquidity provider on the Uniswap Decentralized Exchange (DEX), where they contributed over $1.6 million worth of liquidity to the WBTC/USDT trading pool. This whale was also actively engaged in various decentralized finance (DeFi) protocols, such as Aave, Curve, 1inch, and multiple blockchains, including EOS and the OMG Network.

In a recent probe by the renowned watchdog PeckShieldAlert, the phishing scam’s mechanics came to light. It all began when the victim mistakenly authorized token access through “increase allowance” transactions. This misstep enabled the scammer to swiftly make off with roughly 4,851 $rETH and 9,579.2 $stETH, amassing a staggering $24.24 million.

Crypto Heist Thief Swaps Stolen Assets

The details about this audacious heist were uncovered by the blockchain security firm Peckshield, which confirmed that the scammer swiftly exchanged the stolen assets for around 13,785 ETH and 1.64 million DAI. Additionally, a portion of the ill-gotten gains, approximately 451,000 DAI, was transferred to FixedFloat, a crypto platform renowned for facilitating seamless token swaps at fixed rates.

Typically, in such phishing attacks, scammers employ deceptive tactics, often sending authentic-looking emails to lure potential victims into entering their wallet’s private keys on fraudulent websites. Armed with this sensitive information, the scammers can assume control of all assets associated with the compromised address.

In a separate development, Peckshield disclosed details of another recent crypto heist. On September 5th, the popular casino Stake suffered a security breach, resulting in losses exceeding $40 million, consisting of 9,620 ETH, 14.24 million MATIC, and 82,650 BNB.

As of September 7th, Peckshield reported that the Stake hacker had successfully swapped 3.376 million MATIC tokens for 72.29 BTC, valued at $1.8 million. Additionally, roughly 800,000 MATIC tokens were dispatched to two newly established wallets.

At the time of this report, the evil actor retains possession of 10.1 million MATIC, equivalent to $5.7 million, and 72.29 BTC within the Polygon network. These incidents are stark reminders that, alongside the tremendous opportunities, the crypto industry is rife with vulnerabilities and challenges. 

According to a recent security report by Certik, crypto hacks and scams collectively accounted for losses exceeding $313 million in the second quarter of 2023. Investors and participants in the crypto space are urged to exercise extreme caution and employ robust security measures to safeguard their digital assets.

Related Reading:| Tennessee’s Crypto Scam: Blessings Turned To Sham