Solana

Medium

when

Zero

Methods of injecting malicious links are increasing, and it appears to have spread to even AI chat. In this case, the AI bot proposed scam API services, which led to user losses.&nbsp; 
A user discovered ChatGPT is not as security conscious as they expected, especially with crypto links when they tried to create a simple crypto app, a token bumper for Pump.fun. The API link that ChatGPT provided was contaminated and led to an immediate loss.&nbsp; 
The token bumper connected to the flawed API, which ended up demanding the wallet’s private key and siphoning all its assets. The incident serves as a timely reminder that artificial intelligence tools are not entirely reliable when it comes to Web3 security. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Be careful with information from <a href="https://twitter.com/OpenAI?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@OpenAI</a> ! Today I was trying to write a bump bot for <a href="https://t.co/cIAVsMwwFk" rel="nofollow" target="_blank">https://t.co/cIAVsMwwFk</a> and asked <a href="https://twitter.com/ChatGPTapp?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@ChatGPTapp</a> to help me with the code. I got what I asked but I didn't expect that chatGPT would recommend me a scam <a href="https://twitter.com/solana?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@solana</a> API website. I lost around $2.5k 🧵 <a href="https://t.co/HGfGrwo3ir" rel="nofollow" target="_blank">pic.twitter.com/HGfGrwo3ir</a> 
 — r_ocky.eth 🍌 (@r_cky0) <a href="https://twitter.com/r_cky0/status/1859656430888026524?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">November 21, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The fake API site has been busy with siphoning SOL from multiple wallets. The destination of the exploiter has already performed 281 transactions. While most of the sums were relatively small, all wallets used were compromised.&nbsp; 
Rumors of AI poisoning attacks have been around for a while, but the recent attack is the first complete exploit in the crypto space. 
The <a href="https://x.com/evilcos/status/1859752658061623593?s=46&amp;t=ZUN3JJTgrEwNx2vnqNNE5g" rel="nofollow" target="_blank">founder</a> of the SlowMist on-chain security firm corroborated the story, stating that the most probable explanation was that the user was playing around with AI without verifying the code. The end product was a functional bot with a carefully disguised backdoor. 
<h3 id="span-style-font-weight-400-fake-solana-api-attacks-meme-token-traders-span">Fake Solana API attacks meme token traders</h3> 
The exploiter used their API link to steal some of the latest meme tokens and store them in an identified known <a href="https://app.nansen.ai/profiler?address=FdiBGKS8noGHY2fppnDgcgCQts95Ww8HSLUvWbzv1NhX&amp;chain=solana&amp;tab=transactions" rel="nofollow noopener" target="_blank">wallet</a>. The haul included USDC, SOL, in addition to ELIZA, CHILLGIRL, and AI16Z.&nbsp; 
The site also acted extremely fast after each connection. It is unknown who else made the call to the fake API site, which made its way into OpenAI’s data. One possible explanation is that ChatGPT accesses Python code from multiple repositories, which can be used to contaminate its available data. In the end, the intent to steal wallet data originates from a human agent. Artificial intelligence is only an amplification tool.&nbsp; 
The code created by ChatGPT itself generated a part that asked for the private key. According to ScamSniffer, the exploiters deliberately seeded AI-generated Python code, which users would deploy to snipe new Pump.fun tokens.&nbsp; 
Trusting the code was the first mistake, as users were quick to demand Moonshot or Pump.fun trading bots. Some of the repositories are still active, while others have been reported.&nbsp; 
There is nothing to stop users from attempting to use the bots. The repositories of one such user, Solanaapisdev, still contain risky <a href="https://github.com/solanaapisdev/moonshot-trading-bot/commits?author=solanaapisdev" rel="nofollow noopener" target="_blank">trading bots</a>, which may end up draining wallets. 
It is uncertain who created the bot, but the rush for meme tokens was enough to make unwitting users fall for these malicious trading bots. The best approach is to avoid using unknown repositories, or at least to review the code to the best of one’s knowledge.&nbsp; 
Worse, the flawed APIs were also promoted in a Medium article, leading to a&nbsp;<a href="https://docs.solanaapis.com/solana-api/create-keypair" target="_blank" rel="noopener nofollow">documentation</a> page with the same name as the flawed GitHub repository. The available code is promoted to end users&nbsp;who want to automate the process on Jupiter, Raydium, Pump.fun, and Moonshot.&nbsp; 
While some services can limit flawed links, there is little to do when end users have decided to risk their wallets with unverified code. 
With more than 69K new meme tokens launched, the need and greed for speedy sniping has laid the foundation for a new type of exploit. OpenAI has not mentioned how ChatGPT was trained to create the risky bot code.&nbsp; 
<h3 id="span-style-font-weight-400-malicious-span-span-style-font-weight-400-zoom-span-span-style-font-weight-400-link-scams-also-evolve-span">Malicious Zoom link scams also evolve</h3> 
Another elaborate attack is evolving at the same time as the API exploit. The fake Zoom link that downloads <a href="https://x.com/realScamSniffer/status/1859613550622409012" rel="nofollow" target="_blank">malware</a> has also changed.&nbsp; 
The service, previously known as Meeten, is now spreading as Meetio, prompting users to download files. The malware also uses elements of social engineering, such as reaching out to crypto influencers, or known large-scale holders. 
Recently, one of the fake Zoom meeting exploits drained an influencer’s wallet, leading to a crash in <a href="https://www.cryptopolitan.com/giga-token-crash-scammer-sells/">GIGA</a> token prices.&nbsp; 
The advice in each case is to store wallets and private keys on a different device than the one used for riskier connections. For token mints and other connections, the best approach is to use a newly assigned wallet. 
From Zero to Web3 Pro: Your 90-Day <a href="https://www.cryptopolitan.com/crypto-career-launchpad-waitlist/?utm_source=cryptopolitan&amp;utm_medium=banner&amp;utm_campaign=ccl-waitlist-3" target="_blank">Career Launch Plan</a>

User Solana wallet exploited in first case of AI poisoning attack

Table of Contents

Cryptopolitan_News

Other articles published on Nov 22, 2024

5 Best Crypto Payment Gateways for Seamless Transactions

Michael Saylor’s MicroStrategy Expands its Bitcoin Reserves to 331,000 With Latest Acquisition

Bitcoin Approaches Six-Digit Milestone

Solana (SOL) Price Hits $264 ATH: Will $300 Be the Next Stop?

NEAR Protocol to Build World’s Largest Open-Source AI Model with 1.4T Parameters

Ali Martinez Raises BNB Price Outlook Significantly

Join our free newsletter for daily crypto updates!