Rocket

Rocket Pool

Pink

Allowance

A phishing scammer suddenly returned nearly $9.3 million to a victim after stealing $24 million from them in a September 2023 phishing attack.&nbsp;
First noticed by Scam Sniffer on July 13, the scammer used the Dai (<a href="https://cointelegraph.com/dai-price-index">DAI</a>) stablecoin to return the funds across two transactions last week.
The first transfer saw $5.23 million returned on July 8, while another $4.04 million was sent on July 13 at 12:06 pm UTC, Etherscan data <a href="https://etherscan.io/address/0x13e382dfe53207e9ce2eeeab330f69da2794179e#tokentxns" target="_blank" rel="noopener nofollow">shows.</a>
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-07/e69d089b-3e3c-489a-b652-9ba10e828d01.png" alt="Scammer returns $9.3M in DAI to victim 10 months after phishing them" title="">
 <figcaption style="text-align: center;">
 Transfers from the scammer to the victim’s wallet address. Source: Etherscan
 </figcaption>
</figure>
It comes 10 months after the victim fell for a <a href="https://cointelegraph.com/news/whale-loses-24-million-in-crypto-phishing-attack">$24.2 million phishing scam</a> on Sept. 6, 2023, losing 9,579 Lido Staked Ether (stETH) and 4,850 Rocket Pool Ether (rETH) tokens. 
The victim&nbsp;<a href="https://twitter.com/realScamSniffer/status/1699605367829995578?s=20" target="_blank" rel="noopener nofollow">enabled</a> token approvals to the scammer by signing “Increase Allowance” transactions, according to Scam Sniffer’s post at the time of the incident. 
Allowance is an <a href="https://cointelegraph.com/explained/erc-20-tokens-explained">ERC-20 token</a> feature that enables a third party to have the right to spend tokens belonging to that owner.
Crypto market data platform CoinMarketCap and other industry players have <a href="https://coinmarketcap.com/community/articles/65fc2a7d715b7f34b261e8d9/" target="_blank" rel="noopener nofollow">flagged</a> the loophole, noting that it can potentially allow anonymous developers to <a href="https://cointelegraph.com/news/how-to-revoke-smart-contract-access-to-your-cryptocurrency">deploy malicious smart contracts</a> to scam users.
The recent $9.3 million return equates to a 38.4% fund return at Sept. 6 prices, though the 14,429&nbsp; staked Ether tokens would have been worth $47.5 million at today’s prices.
Onchain data shows the Dai came through an address labeled as Railgun Relay — an intermediary for the privacy protocol — shortly before being transferred to the victim.
Scam Sniffer pointed Cointelegraph to an onchain message of the hacker reaching out to the victim via a different wallet address on July 6.
“Hello, I am the guy who took your money,” he <a href="https://etherscan.io/tx/0xab8d6d34a4188932bb25ff905cfccf38ddcac0415268d21cb462accea2f39f12" target="_blank" rel="noopener nofollow">said</a>. “I want to give the moneyback.”
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-07/3b259505-cfd4-42b2-a57f-92d83da5e236.png" alt="Scammer returns $9.3M in DAI to victim 10 months after phishing them" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/realScamSniffer/status/1812165578611962164" target="_blank" rel="noopener nofollow">Scam Sniffer</a>
 </figcaption>
</figure>
Etherscan data <a href="https://etherscan.io/address/0x693b725a375f599f0b6efa0d910e749e1bec1555#multichain-portfolio" target="_blank" rel="noopener nofollow">shows</a> that the scammer’s wallet address now has a little over $3 million in funds after the $9 million transfer.
Nearly 99% of those funds comprise the Metagalaxy Land (MEGALAND) token on BNB Chain. 
Related: <a href="https://cointelegraph.com/news/new-scam-drains-wallets-without-user-approving-transaction">New crypto scam drains users' wallets without transaction approval</a>
Phishing scammers <a href="https://cointelegraph.com/news/crypto-phishing-scams-2023-300-million-dollars-324k-victims-report">stole almost $300 million worth</a> of crypto from 324,000 victims in 2023, according to Scam Sniffer’s 2023 Wallet Drainers Report.
In 2023, Inferno Drainer and MS Drainer were the two most notorious phishing scammers, stealing $81 million and $59 million, respectively.
Pink Drainer became one of the most prominent phishing scammers in 2024, stealing over $85 million before it <a href="https://cointelegraph.com/news/pink-drainer-hacker-retirement-85m-theft">shut down</a> in May.
Magazine: <a href="https://cointelegraph.com/magazine/phishing-crypto-erc-20-bait-scammers/">Ethereum’s ERC-20 design flaws are a crypto scammer’s best friend</a>

Scammer returns $9.3M in DAI to victim 10 months after phishing them

Cointelegraph

Other articles published on Jul 15, 2024

BONK Token Soars After 84 Billion Burn, Outperforms Altcoin Market

Explosive Growth: Blockchain Tokens Set to Soar with Predicted 1000% Increase

Top Presales for July: Join Latest Tokens

AT&T Pays $400,000 BTC Ransom to Hackers in 2022 Data Breach

BlockDAG Amasses 81K Fans, Presale Rockets to $58M Amid Ethereum’s Fee Reign & Solana ETF Showdown

Sportex Announces Incoming Collaborations For its Social Media-Marketplace Hybrid App

Join our free newsletter for daily crypto updates!