As a seasoned cybersecurity analyst with years of experience in the crypto space, I’ve seen my fair share of scams and phishing attacks. The recent case of the $24.2 million heist is particularly disheartening because it could have been prevented if proper security measures were in place.


It’s unexpected that a con artist who swindled $24.2 million from an individual has since repaid them with $9.3 million. The money was transferred in two installments using DAI stablecoin: the initial transaction valued at $5.23 million took place on July 8, followed by a second transfer worth $4.04 million on July 13.

On September 6, 2023, the funds were illegally obtained through a well-executed phishing scam. The scammers managed to swindle away 9,579 Lido Staked Ether (stETH) and 4,850 Rocket Pool (rETH) tokens, currently valued at approximately $47 million. The victim unwittingly granted the scammer permission to access their tokens by signing the “IncreaseAllowance” function embedded in ERC-20 tokens, enabling designated third parties to make transactions on behalf of their holders.

Last year on X, Scam Sniffer reported an astonishing incident where someone lost a staggering $24.23 million worth of stETH and rETH due to a crypto phishing attack just 8 hours prior. The post included the relevant transaction details, displayed on Etherscan for transparency: . In response, Scam Sniffer noted that the victim had granted the scammer permission to access their tokens by signing “increaseAllowance” transactions. This controversial functionality has sparked much debate, as it can potentially enable unscrupulous individuals and developers to pilfer funds from the unwary.

In their latest announcement, Scam Sniffer revealed that the con artist transferred $9.27 million in DAI back to the crypto community victim. Yet, there is no clarity as to why they chose to return a portion of their fraudulent earnings to the victim. No on-chain message was left explaining this unusual action.

Thirty-eight point four percent of the funds retrieved following phishing attacks is a consolation for victims, representing a more favorable outcome than no recovery at all. Tracing the culprit behind these transactions and recovering the remaining funds might present a challenge due to the privacy protocol utilized during the return of funds via DAI, concealing the malicious actor’s financial movements.

 

Read More

2024-07-15 13:52