As a crypto investor who has gone through my fair share of ups and downs in this volatile market, I can’t help but feel a mix of emotions upon hearing about the recent recovery of $71 million worth of WBTC from a dusting attack. On one hand, I am relieved that the victim was able to recover their funds after a harrowing experience. On the other hand, I am frustrated and disappointed that such attacks continue to occur in our community.


A wealthy cryptocurrency investor, who had $71 million in value represented by wrapped bitcoins (WBTC) taken from them through a dusting attack, has successfully regained their lost assets following discussions with the cybercriminal involved.

As a researcher, I’ve come across some intriguing information from PeckShield’s recent tweet. It appears that a scammer returned the stolen funds in several transactions starting on May 9 and finished on May 11.

Stealing $71M WBTC

On May 3rd, the misfortune of the whale started when they erroneously transferred 1,155 WBTC to an incorrect address due to an address poisoning incident in their transaction history.

A malicious user can carry out an address spoofing or camouflage attack by sending insignificant transactions to a target’s wallet. The goal is to add the attacker’s address to the victim’s transaction history, often with starting and ending characters resembling those of the genuine wallet, making it hard to distinguish at first glance.

In the reported incident by CryptoPotato, the malicious wallet addresses had specific characters at the beginning and end. More precisely, they started with “0xd9A1” and ended with “853a91”. Unsuspecting victims were deceived when they attempted to transfer their Wrapped Bitcoin (WBTC) to these seemingly legitimate wallets.

The thief held off transferring the pilfered resources until five days later, at which point they began dividing the hoard into smaller chunks. Employing over 400 wallets, they dispersed the funds to roughly 150 different addresses. It is worth mentioning that they converted the stolen goods to approximately 23,000 ether (ETH) on May 3.

The Recovery

Information about the conversations between the fraudster and the person they deceived during their negotiations is lacking, since these exchanges reportedly occurred over the Telegram messaging app.

As a crypto investor looking back on a unfortunate experience, I first reached out to the potential scammer on May 5, proposing a 10% return as an enticement for them to return my stolen funds. In collaboration with Match Systems, a respected blockchain cybersecurity firm, and Cryptex, a trusted crypto exchange, I issued a warning that if I didn’t receive a response by May 6, I would initiate a trace of the funds.

After several days of no contact, the scammer transferred some ETH to the victim, accompanied by a message asking for their Telegram username for continued communication. Following these discussions, the hacker repaid the stolen funds in installments. The reason why the attacker chose to return all the assets instead of keeping the 10% bounty is still a mystery.

Over the past week, the value of the retrieved assets hovers around $66.8 million due to ethereum‘s greater price decrease compared to bitcoin. According to CoinMarketCap, ethereum dropped by approximately 6.4%, while bitcoin experienced a decline of about 2.8% within the same time period.

Read More

2024-05-14 01:50