Azoundria: Created page with "{{Case Study Under Construction}}{{Unattributed Sources}} GraphicAfter receiving 0 ethereum from a wallet with a very similar address, a wrapped bitcoin holder made an unfortunate mistake in sending their funds to that wallet instead of their own. The funds were split up and transferred throughout the blockchain, and it doesn't seem clear whether any were recoverable. This is a global/international case not involving a specif..."

2024-09-17T19:19:28Z

Created page with "{{Case Study Under Construction}}{{Unattributed Sources}} thumb|GraphicAfter receiving 0 ethereum from a wallet with a very similar address, a wrapped bitcoin holder made an unfortunate mistake in sending their funds to that wallet instead of their own. The funds were split up and transferred throughout the blockchain, and it doesn't seem clear whether any were recoverable. This is a global/international case not involving a specif..."

New page

{{Case Study Under Construction}}{{Unattributed Sources}}

[[File:Ethereumaddresspoisoning.jpg|thumb|Graphic]]After receiving 0 ethereum from a wallet with a very similar address, a wrapped bitcoin holder made an unfortunate mistake in sending their funds to that wallet instead of their own. The funds were split up and transferred throughout the blockchain, and it doesn't seem clear whether any were recoverable.

This is a global/international case not involving a specific country.<ref name="slowmisthackedarchive-14002" /><ref name="misttrackiotwitter-14003" /><ref name="coinmarketcap-623" /><ref name="transak-14004" /><ref name="cointelegraph-14005" /><ref name="etherscan-14006" /><ref name="etherscan-14007" /><ref name="etherscan-14008" /><ref name="cyversalertstwitter-14009" /><ref>https://etherscan.io/idm?addresses=0x1e227979f0b5bc691a70deaed2e0f39a6f538fd5,0xd9a1c3788d81257612e2581a6ea0ada244853a91&type=1</ref><ref>https://etherscan.io/idm?addresses=0x1e227979f0b5bc691a70deaed2e0f39a6f538fd5,0x20cbf5c444d4f07f4cb5c37585e59f4ac1b472f1&type=1</ref><ref>[https://unchainedcrypto.com/68-million-stolen-in-dust-attack-returned-to-victim/#:~:text=An%20anonymous%20crypto%20whale%20lost,tokens%20that%20had%20been%20stolen. https://unchainedcrypto.com/68-million-stolen-in-dust-attack-returned-to-victim/#:~:text=An%20anonymous%20crypto%20whale%20lost,tokens%20that%20had%20been%20stolen.]</ref>

== About The Victim ==
Very little is known about the victim of the address poisoning attack.

Their wallet address is 0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5, which appears to be active on Ethereum<ref>[https://etherscan.io/address/0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 Victim Address - Etherscan] (Accessed May 30, 2024)</ref>, and not on other networks such as Binance Smart Chain<ref>[https://bscscan.com/address/0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 Victim Address On Binance Smart Chain - BSCScan] (Accessed May 30, 2024)</ref>.

== The Reality ==
While the first and last 4 characters of the ethereum address where the wrapped bitcoin were sent were matching the correct address, the other characters in the address did not generally match, as the wallet was owned by a malicious actor.

== What Happened ==
The victim sent their 1155 wrapped bitcoin to a malicious actor instead of transferring to their other wallet.
{| class="wikitable"
|+Key Event Timeline - Wrapped Bitcoin Whale Address Poisoning Attack
!Date
!Event
!Description
|-
|May 3rd, 2024 3:14:47 AM MDT
|Legitimate Victim Transfer
|The victim makes a legitimate transfer from one of their other wallets of 0.05 ETH (presumably to cover gas fees)<ref name="etherscan-14006" />.
|-
|May 3rd, 2024 3:17:59 AM MDT
|Fake Zero ETH Transaction
|A very similar wallet address sends 0 ethereum to the same victim's wallet, which would now show up on block explorers like Etherscan<ref name="etherscan-14007" />.
|-
|May 3rd, 2024 4:31:35 AM MDT
|Blockchain Transaction
|The poisoned blockchain transaction happens, where 1,155.28802767 wrapped bitcoin are sent from the victim to the attacker wallet by mistake<ref name="etherscan-14008" />.
|-
|May 3rd, 2024 5:53:00 AM MDT
|Cyvers Alert Tweet
|Cyvers Alert detects the transaction and reports about it in a new tweet<ref name="cyversalertstwitter-14009" />.
|-
|May 3rd, 2024 6:36:00 AM MDT
|Scam Sniffer Tweet
|A Twitter account called realScamSniffer posts a notification about a transaction "2 hours ago", where "another victim lost $68 million by copying the wrong address from a contaminated transfer history"<ref name=":0">[https://twitter.com/realScamSniffer/status/1786374327740543464 realScamSniffer - "2 hours ago, another victim lost $68 million by copying the wrong address from a contaminated transfer history." - Twitter]</ref>.
|-
|May 3rd, 2024 9:50:00 AM MDT
|MistTrack Update Tweet
|MistTrack shares an update to notify that the funds have now been spread between 8 separate Ethereum wallet addresses<ref name="misttrackiotwitter-14003" />.
|}

== Technical Details ==

"victim:
0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5

wrong address:
0xd9A1C3788D81257612E2581A6ea0aDa244853a91

correct address:
0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91"

== Total Amount Lost ==
$70m from 1155 WBTC
$62,889.84 x 1,155.28802767 WBTC = 72655879.2140818728

The total amount lost has been estimated at $72,656,000 USD.

== Immediate Reactions ==

"ALERT Are we mistaken, or has someone truly lost $68M worth of $WBTC? Our system has detected another address falling victim to address poisoning, losing 1155 $WBTC."<ref name="cyversalertstwitter-14009" />

"not even sure how do you even explain this your boss"<ref name="misttrackiotwitter-14003" />

"2 hours ago, another victim lost $68 million by copying the wrong address from a contaminated transfer history."<ref name=":0" />

== Ultimate Outcome ==
Funds appear to have been spread between several different blockchain addresses<ref name="misttrackiotwitter-14003" />.

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
It is unclear whether any further investigation has been undertaken to recover the funds.
== Individual Prevention Policies ==
{{Prevention:Individuals:Double Check Transactions}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Cryptocurrency Education Mandate}}

{{Prevention:Regulators:Establish Industry Insurance Fund}}

{{Prevention:Regulators:End}}

== References ==
<references>
<ref name="slowmisthackedarchive-14002">[https://web.archive.org/web/20240528162656/https://hacked.slowmist.io/?c=&page=2 SlowMist Hacked - SlowMist Zone] (Accessed May 28, 2024)</ref>
<ref name="misttrackiotwitter-14003">[https://twitter.com/MistTrack_io/status/1786423196490535329 MistTrack - "So far the scammers has moved the funds to the following addresses" - Twitter] (Accessed May 28, 2024)</ref>
<ref name="coinmarketcap-623">[https://coinmarketcap.com/currencies/bitcoin/historical-data/ Historic Bitcoin Prices - CoinMarketCap] (Accessed May 16, 2021)</ref>
<ref name="transak-14004">[https://transak.com/blog/what-are-address-poisoning-attacks What Are Address Poisoning Attacks? - Transak] (Accessed May 28, 2024)</ref>
<ref name="cointelegraph-14005">[https://cointelegraph.com/news/address-poisoning-attacks-in-crypto What are address poisoning attacks in crypto and how to avoid them? - CoinTelegraph] (Accessed May 28, 2024)</ref>
<ref name="etherscan-14006">[https://etherscan.io/tx/0xb18ab131d251f7429c56a2ae2b1b75ce104fe9e83315a0c71ccf2b20267683ac Victims Sends 0.05 ETH To Their Wallet - Etherscan] (Accessed May 28, 2024)</ref>
<ref name="etherscan-14007">[https://etherscan.io/tx/0x87c6e5d56fea35315ba283de8b6422ad390b6b9d8d399d9b93a9051a3e11bf73 Empty 0 ETH Transaction From Attacker - Etherscan] (Accessed May 28, 2024)</ref>
<ref name="etherscan-14008">[https://etherscan.io/tx/0x3374abc5a9c766ba709651399b6e6162de97ca986abc23f423a9d893c8f5f570 Transfer Of 1,155.28802767 WBTC To Attacker - Etherscan] (Accessed May 28, 2024)</ref>
<ref name="cyversalertstwitter-14009">[https://twitter.com/CyversAlerts/status/1786363410243858869 Cyvers Alerts - "Are we mistaken, or has someone truly lost $68M worth of $WBTC? Our system has detected another address falling victim to address poisoning, losing 1155 $WBTC." - Twitter] (Accessed May 28, 2024)</ref>
</references>

Wrapped Bitcoin Whale Address Poisoning Attack - Revision history