AB Finance Airdrop Scam

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

AB Finance

At some point on August 25th of 2021, millions of Binance smart chain addresses received a mysterious ABFin token, which appeared to be valuable and directed them to abfin.org. On that website, AB Finance claimed to be a regulated company and that all users had to do to sell their tokens was to unlock them. The unlocking process only required users to give full control over their wallet to the website, at which point any other tokens in their wallet could be withdrawn. The website appears to have subsequently upgraded to look more similar to PancakeSwap, which likely enticed more users to attempt the swap. It's unclear how many users were affected, and whether any further investigation was performed to attempt to recover funds.

This is a global/international case not involving a specific country.

About AB Finance

"ABFIN Token Finance is a regulated [c]ompany. All you need to do in order to exchange your ABFIN Token is going through easy step by clicking on the Claim ABFIN Token Button, after this is done, you will be able to Exchange them to BNB in PancakeSwap."

Homepage:

The Reality

"Today I'm bringing you a token called AB Finance, which you probably received eight million, and you're trying to sell it on PancakeSwap and it doesn't work. So, this is a scam. Let's take a look at the token first. As you can see, one million people - one million four hundred thousand people received this token. Everyone seems to be having this almost nine million tokens."

"As you can see, uh, there is, uh, the burn address has 100 percent of the tokens. One of the - this is the scammers address has 99 percent, and everyone seems to have, you know, that - this is more than 100 percent, so. And if you add together that a million people received these tokens you can see that it's way more than 100 percent in total. So, when you're trying to unlock this then, it tells you to, tells you to go to this website called abfin.org, but this is redirected to abfin.me. Which this is the website."

Scamdrop warning:

What Happened

An entity called "ABFinance" released an airdrop token, attempting to get viewers to visit a website and authorize a smart contract to access all other tokens in their wallet.

Key Event Timeline - AB Finance Airdrop Scam

Date	Event	Description
August 25th, 2021	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
August 7th, 2021 11:30:07 AM MDT	YouTube Video Warning	Altcoin Detective publishes a YouTube video about the AB Finance token airdrop, which highlights that trading of the tokens is not possible and warns users not to attempt to connect their wallets with the malicious website.
August 27th, 2021 7:53:42 PM MDT	Scamdrop Warning	The Scamdrop service publishes a warning specifically about the ABFin token airdrop.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

"As you can see, uh, there is, uh, the burn address has 100 percent of the tokens. One of the - this is the scammers address has 99 percent, and everyone seems to have, you know, that - this is more than 100 percent, so. And if you add together that a million people received these tokens you can see that it's way more than 100 percent in total. So, when you're trying to unlock this then, it tells you to, tells you to go to this website called abfin.org, but this is redirected to abfin.me. Which this is the website."

"The scam only works if you click on this button, right. There is a pop-up and you unlock the wallet. When you do this, you authorize the scammer to take other tokens from your wallet and and take it from you. So whatever you do, don't click this and you know, either MetaMask will pop up and and ask for authorization. Once you do that, you are in trouble." "This is the only way they can take money from you."

Total Amount Lost

The total amount lost is unknown.

TBD: Need to do further analysis on how many funds were taken via the smart contract.

Immediate Reactions

A YouTube video and some online articles were published to warn users about the potential risks of smart contract approval.

YouTube Video Warning

Altcoin Detective published a YouTube video about this fraudulent airdrop.

"From that one million four hundred thousand addresses that received this airdrop, nobody was able to trade the token on poocoin, so it's not possible to get rid of, you know, get rid of the tokens from your wallet. It's not possible to buy or sell this token. So what you can do is just leave it alone in your wallet. Don't go to this website and try to unlock your wallet."

Ultimate Outcome

"From that one million four hundred thousand addresses that received this airdrop, nobody was able to trade the token on poocoin, so it's not possible to get rid of, you know, get rid of the tokens from your wallet. It's not possible to buy or sell this token. So what you can do is just leave it alone in your wallet. Don't go to this website and try to unlock your wallet."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

TBD: Has any investigation been done about this?

Ongoing Developments

TBD

Individual Prevention Policies

When self-custodying, users have a responsibility to always take great care with any approvals they make. Approving full permissions to a website is usually not advisable. Another method of reducing risk would be to move the majority of funds to a fully offline wallet which is not interacted with.

Any time that you are promised any profit or benefit in exchange for an initial payment, smart contract approval, or deposit, pay special care as to whether the entity making that offer is trustworthy, actually who they say they are, and has the means to fulfill what they're promising. There are no magic algorithms providing guaranteed returns from trading or mining. Trading on average will lose money. Mining is expensive and complex. No one is going to immediately send back more than you sent them. NFT projects will rarely announce a surprise mint in only a single location. Are you fully prepared for the event your money is kept and nothing is delivered in return?

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.