Ethereum

Safe

when

Security

An unnamed cryptocurrency holder recently lost more than $3 million worth of PYTH tokens after erroneously transferring them to a scammer’s wallet. 
The mistake happened when the victim, relying on their transaction history, copied and used a fake deposit address. 
<h2 id="the-high-cost-of-a-small-mistake">The High Cost of a Small Mistake</h2> 
According to a November 25 <a href="https://x.com/lookonchain/status/1860891824363368595" target="_blank" rel="noopener" data-wpel-link="external">post</a> by blockchain analysts Lookonchain, an unknown fraudster created an address whose first four characters were an exact match to the victim’s deposit wallet. They then sent the victim 0.000001 SOL, worth about $0.00025, which caused the fake account to appear on their transaction history. 
Without taking due care, the affected individual copied the forged address directly from the transaction history, seeing as the first four characters matched. They then sent 7 million PYTH tokens valued at about $3.08 million to the criminal without double-checking the unique identifier. 
Security experts refer to these attacks as “<a href="https://cryptopotato.com/heres-how-scammers-have-improved-their-tactics-in-address-poisoning-attacks/" target="_blank" rel="noopener" data-wpel-link="internal">address poisoning</a>.” They exploit a common habit among crypto users: relying on transaction histories to copy the unique wallet identifiers instead of retrieving them from official sources or trusted contacts. While it may seem convenient, the practice is often risky. 
Anti-scam platform Scam Sniffer recently <a href="https://x.com/realScamSniffer/status/1859089504994554363" target="_blank" rel="noopener" data-wpel-link="external">highlighted</a> another case where a user allegedly lost $129 million after copying the wrong address from their transfer history. In that instance, the deceptive account had the same last six characters as the correct one. 
In many wallets, only the first six and last six characters of an address are usually displayed, meaning more than a cursory look may be needed to confirm their veracity.&nbsp;Luckily for that individual or entity, the scammer returned the stolen funds within an hour. 
In May, an Ethereum user <a href="https://cryptopotato.com/costly-mistake-victim-loses-68-million-in-address-poisoning-scam/" target="_blank" rel="noopener" data-wpel-link="internal">lost</a> 1,155 wrapped Bitcoin (wBTC) worth $68 million, while <a href="https://cryptopotato.com/21-victims-and-counting-address-poisoning-attackers-target-safe-wallet-users/" target="_blank" rel="noopener" data-wpel-link="internal">several</a> Safe Wallet owners had $2 million stolen from them using the same trick in December last year. 
<h2 id="understanding-address-poisoning">Understanding Address Poisoning</h2> 
Bad actors commonly use two methods to execute address poisoning: zero-value transfers and fake tokens. In zero-value transfers, the con artist uses actual token contracts but makes very low-value transactions to display misleading activity in a potential victim’s on-chain transaction history. 
Conversely, the fake token method involves creating sham token contracts to mimic real tokens like USDT or USDC. The swindlers then look out for genuine token transactions, and when they see one, they transfer their phony tokens to the address from which the transaction originated. This gives the user the impression that they sent funds to a certain account when, in fact, they didn’t. 
The user may then mistake the counterfeit token transfer for the real one they made when they look at their wallet history or use a blockchain explorer. When wanting to repeat a transaction, they may send money to the scammer’s wallet by unintentionally copying and pasting the bogus address. 
The post <a href="https://cryptopotato.com/careless-crypto-transfer-costs-investor-3-08m-details/" rel="nofollow">Careless Crypto Transfer Costs Investor $3.08M: Details</a> appeared first on <a href="https://cryptopotato.com/" rel="nofollow">CryptoPotato</a>.

Careless Crypto Transfer Costs Investor $3.08M: Details

Table of Contents

CryptoPotato_News

Other articles published on Nov 26, 2024

Justin Sun Bets $30M on Trump’s Crypto Project

TRON’s Justin Sun joins Trump’s crypto venture WLFI as Advisor

Bitcoin Surges Past $81,000 Amid Trump’s Victory and Pro-Crypto Political Shift

XRP Whales Quietly Positioning Themselves For What Is Coming In January 2025

Morocco central bank to legalize all cryptocurrencies: Report

FTX Sues Binance and CEO Changpeng Zhao for $1.8B Over Alleged Fraud

Join our free newsletter for daily crypto updates!