A crypto scam case with millions of dollars in losses once again reminded us that the most dangerous kind of crypto attack is not the one that exploits broken codes or stolen private keys, but an attack on the human psyche.
On March 5, a crypto influencer under the name Sillytuna lost $24 million due to an address poisoning scam. Reported by the blockchain security firm PeckShield, the assets stolen were in aEthUSDC, a bridged version of the USDC stablecoin.
Also Read: What is USDT Stablecoin and Why is It So Popular?
After the theft, the attacker immediately swapped the assets to ETH, then converted them to the DAI stablecoin worth $20 million.
The stolen $20 million is then split in half and placed in two wallets controlled by the attacker. The funds have not gone through the mixer system to obscure their source, but crypto investigators observe a small portion of funds being sent to Arbitrum. This signals the intention of further laundering.
The losses from this scam amount to $24 million, the biggest address poisoning loss in recent months.
Address poisoning is a social engineering attack that takes advantage of users’ habits in managing their wallet addresses. First, attackers generate a wallet address similar to an address the victim is familiar with. Typically, the string of numbers and letters in the first and last parts of the address is the same.
Then, the attackers send a small transaction to the victim from the fake wallet address. The fake address is now recorded in the victim’s transaction history.
When the victim wants to send funds to another wallet, they will copy the wallet address from their transaction history and may unintentionally select the fake address. As a result, the funds will directly go to the attacker’s wallet.
Address poisoning is one of the most prevalent phishing scams in the crypto world. Research shows that there are over 6,000 successful attacks on the Ethereum and BNB Chain blockchains.
Address poisoning is not the only scam in crypto. Learn different types of scams and how to prevent them in the article What is a Scam? A Complete Guide to Digital & Cryptocurrency Fraud.
