CyberFi Phishing Attack BetItAllJonny

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

CyberFi

CyberFi was a staking platform growing in popularity around March 2021. Reddit user BetItAllJonny was an investor who had staked their assets for 30 days, along with other coins also, totalling $140k, in the same wallet. It was a hot wallet they were interacting with using MetaMask.

After a nap, they were tricked by a fraudster who pretended to be an administrator in CyberFi on Telegram. They were sent to a malicious website, where they promptly entered their seed phrase. Their assets were immediately taken, except for the CyberFi which was still staked.

They were able to convince a white-hat hacker to assist them in front-running the attacker and retrieve the staked CyberFi at the contract expiration date. It doesn't appear that their wallet address has been published, and none of the other funds have been reported to be recovered.

This is a global/international case not involving a specific country.

About CyberFi

"CyberFi mission is to create a user-friendly DeFi experience and add a new layer of features available. Users of our platform will experience zero-stress, automated DeFi trading and farming, smaller fees and tools for Impermanent Loss mitigation."

"I put all my tokens in a staking contract for 30 days." The contract expires "April 2nd". "It's a project I believe will easily 10x."

"Had an issue with a recently staked token not showing any balances. I went to the official telegram of the token. There I asked an admin to assist me on this issue. No response from an official admin so I tinker around and found that a simple refresh after metamask connect solved the problem. Cool."

"I get off and take a nap. Woke up with a well known admin messaging me if I need help. My brain is slowly waking up. I tell him it's all good."

"Then he tells me that people are no[w] getting integrated into their system for bonuses. So asks me if I received full integration. As a noob, I'm like I don't think so. Then he sends me this link."

"Tells me to integrate to take advantage of all the new bonuses and allotments. (New project with a lot of promotions and collabs). So I eagerly click on it and give my seed phrases. Doesn't dawn on me until I hit enter to check the admins credentials. I check it and it's a copy of his profile. Stomach hits my feet."

"Seems like a group targets CFI investors. They have legit looking sites and telegram."

"In my mind I'm accepting this as a loss. But still going to try." "[CyberFi i]s just starting out and it's going to kill me to see it go to the moon without me."

"[M]y coins were locked in staking. Had 3 weeks before unlock. I begged every white hat in the world and finally one said ok.... he got a group of people to put eth sweepers in while hijacking my coins by bribing a miner. Was awesome to see in real time. Was very intense and nail biting."

"Alex saved me too." "H[e] extracted my CFI tokens that were in a time locked contract. Safely sent them to another wallet without gas using flash bots." "I almost lost 140k but manage a rescue, thank god." "$139k today's prices $11k - 2eth tip. $7k. Well still glad I have it than the hacker."

"I'm in a good place with the mistake. Not the end of the world. Just sucks I'm in a "would of/could of" scenerio if I lose it. If I buy more of the coins, I'm taking away from another project. So if the lost coins 100x I'm gonna always have a gut punch, and if I repurchased said coins the other project I liquidified 100x I'll go insane. So im not going to enjoy that aspect of it all. But my other projects are doing well, so make up sooner than later. Thx for your words."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - CyberFi Phishing Attack BetItAllJonny
Date	Event	Description
March 14th, 2021 12:36:07 AM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

The primary protection is to never enter the seed phrase anywhere online. It is best to use a hardware wallet, in which case the seed phrase is only ever entered into the device itself. Losses could have been limited by separating assets into more wallets, ideally keeping most assets on an offline wallet which is fully disconnected and not used for regular transactions.

The CyberFi platform can use an alternative system for providing support, which does not allow anonymous strangers (without prior history) to privately contact users of the platform. It is recommended to have some support resources available to assist phished users whose cases can be shown to be valid. This could take the place of resources to track down theft quickly and assist with police report filing, or a shared fund to partially reimburse users.