Exploiter Steals $68M Worth of Crypto Through Address Poisoning
The victim was duped by a mimicked 0.05 ether transfer.
Updated May 3, 2024, 2:13 p.m. Published May 3, 2024, 2:07 p.m.
- A user unintentionally sent 1,155 wrapped bitcoin to an exploiter's wallet after being targeted by address poisoning.
- The scam has been confirmed by various blockchain security firms.
A cryptocurrency user has lost $68 million worth of wrapped bitcoin (WBTC) after falling victim to an address poisoning exploit, according to blockchain security firm CertiK.
Address poisoning is a technique that involves tricking the victim into sending a legitimate transaction to the wrong wallet address by mimicking the first and last six characters of the true wallet address and depending on the sender to miss the discrepancy in the intervening characters. Wallet addresses can be as long as 42 characters.
In this case, the exploiter mimicked a 0.05 ether {{ETH}} transaction before receiving 1,155 WBTC from the victim.
Security platform Cyvers and blockchain sleuth ZachXBT confirmed that $68 million had been lost to an address poisoning scam.
Crypto investors lost $2 billion to hacks, scams and exploits across decentralized finance (DeFi) in 2023 and an additional $333 million was stolen in the first quarter.
Mehr für Sie
IoTeX offers cross-bridge hackers 10% bounty if they return $4.4 million within 48 hours
Raullen Chai, IoTeX co-founder and CEO, told CoinDesk he would not press charges if the stolen assets or its equivalent is returned within 48 hours.
Was Sie wissen sollten:
- IoTeX is offering a 10% white-hat bounty, about $440,000, and a promise not to pursue legal action if hackers return roughly $4.4 million stolen from its ioTube cross-chain bridge within 48 hours.
- The Feb. 21 exploit stemmed from a compromised validator owner private key on the Ethereum side of the ioTube bridge, which IoTeX and outside experts describe as an operational security failure rather than a flaw in the Layer 1 blockchain or its smart contracts.
- IoTeX traced the stolen funds across chains, identified bitcoin addresses holding about 66.6 BTC, and is rolling out a mainnet upgrade with a default blacklist of malicious addresses, but experts warn that assets already swapped and bridged may be difficult or unlikely to recover.