This was nearly the case for a crypto whale who, on May 3, 2024, fell victim to a sophisticated phishing attack, resulting in the loss of 1,155 Wrapped Bitcoin (WBTC), valued at a staggering $71 million. The incident serves as a stark reminder of the ever-present dangers lurking in the digital finance space.
The Attack: A Case of Address Poisoning
The whale, whose identity remains undisclosed, had recently acquired 502 WBTC at the cost of $29.6 million DAI, with each WBTC priced at $58,951. In preparation for a significant transfer, the whale conducted a test transaction, sending 0.05 ETH to a newly created address—a common security measure among seasoned crypto investors.
However, the attacker was lying in wait, having pre-generated phishing addresses that mirrored the victim’s. Utilizing a technique known as “Address Poisoning,” the scammer sent a 0 ETH transaction to the whale, which appeared innocuous but was, in fact, a trap. The phishing address shared the same starting and ending characters as the whale’s genuine address, a detail easily overlooked since many crypto wallets display only these parts of an address for user convenience.
Tragically, the whale fell for the ruse and inadvertently sent the 1,155 WBTC to the attacker’s address. The funds were swiftly converted into 22,960 ETH, presumably to obscure the trail and facilitate money laundering.
The Twist: A Surprising Act of Remorse
In a surprising turn of events, the attacker returned the entire sum to the whale a week later. This unexpected act of contrition followed the whale’s offer of a 10% bounty for the return of 90% of the stolen assets. Although initially unresponsive, the attacker relented and transferred back the funds after cybersecurity firm Slow Mist began tracking the IP addresses involved, which were possibly located in Hong Kong.
Lessons Learned: Vigilance and Prevention
This incident underscores the importance of vigilance in the digital asset space. Users are advised to meticulously verify entire addresses during transfers, utilize address books for storing trusted contacts, and enable small transaction filtering to detect and prevent phishing attempts.
While the whale’s story had a fortunate resolution, it serves as a cautionary tale for all who navigate the treacherous waters of cryptocurrency. The community must remain ever-watchful, for the next phishing attempt could be just around the corner, and the outcome might not be as forgiving.
Source:
https://finbold.com/hacker-returns-71-million-worth-of-crypto-to-phishing-victim/
