The stolen assets amounted to 12,083 wrapped ether tokens (spWETH).
According to reports, a cryptocurrency whale lost over $32 million in tokens as a result of a malicious transaction after falling victim to a phishing attack.
ScamSniffer, a blockchain security company, first reported the incident on social media platform X.
12,083 wrapped ether tokens (spWETH), worth about $32.4 million, were among the stolen assets that were connected to the DeFi (decentralized finance) protocol Spark.
The attack was planned with the use of the infamous scam-as-a-service tool, Inferno Drainer, claims blockchain intelligence firm Arkham.
Software Creates Fake Versions of Popular DeFi Apps
The program trick users into signing transactions that give up control of their wallets by faking versions of well-known DeFi applications.
Inferno Drainer has reportedly been responsible for stealing over $215 million from more than 200,000 victims throughout its existence, as highlighted by a Dune Analytics dashboard created by ScamSniffer.
On stolen tokens, the operators of the service are said to take a commission of 20%.
Despite being taken down by its creators in November 2023, Inferno Drainer reappeared in May 2024 promising new features, hiring personnel, and support for hundreds of DeFi apps in addition to 28 distinct blockchains.
The victim’s identity is still unknown, but major transactions were seen by blockchain investigator ZachXBT connecting the compromised wallet to a whale identified as CZSamSun—not to be confused with the Paradigm researcher known as @samczsun on X.
A 20% reward for the return of the funds that were taken was offered in a message sent from the victim’s wallet; however, the purported scammer has not responded.
The blockchain analytics company LookOnChain cautioned users against falling victim to similar attacks by advising them to be cautious and double-check all transactions before signing.
Someone lost 12,083.6 $spWETH(worth $32.33M)! due to a phishing attack!
— Lookonchain (@lookonchain) September 28, 2024
According to Arkham, the wallet may be related to DiscusFish(@bitfish1).
To avoid being phished, please do not click on any unknown links and do not sign any unknown signatures.
Always double-check when… pic.twitter.com/LSLMDeNQzb
Fake Wallet App Steals $70K in Crypto
A fraudulent cryptocurrency wallet app on Google Play has reportedly stolen $70,000 from users in a sophisticated scam that has been described as a world-first for targeting mobile users exclusively.
The malicious program, called WalletConnect, appeared to be a well-thought-out plan to empty cryptocurrency wallets while imitating the reliable WalletConnect protocol.
Over 10,000 users were tricked into downloading the fraudulent app, according to Check Point Research (CPR), the cybersecurity company that first discovered the scheme.
The app’s scammers were well aware of the common problems web3 users encounter, like compatibility problems and the dearth of WalletConnect support across wallets.
They took advantage of the fact that there is not an official WalletConnect app on the Play Store to market the fraudulent app as a fix for these issues.
In another attempt, Cybersecurity scammers are using automated email replies to compromise systems and deliver stealthy crypto mining malware.
This comes on the heels of another malware threat identified in August.
Similar to this, the “Cthulhu Stealer,” which targets MacOS systems, poses as trustworthy software and steals personal data such as IP addresses, MetaMask passwords, and cold wallet private keys.