DEA falls victim: Agency loses $55,000 in address manipulation scheme

24

DEA falls victim: Agency loses $55,000 in address manipulation scheme

The United States Drug Enforcement Administration (DEA) — the organization responsible for enforcing the nation’s drug regulations — lost $55,000 in confiscated Tether () earlier this year due to a scam.

Forbes reported on Aug. 24 that in May, the agency confiscated over $500,000 worth of USDT from two Binance accounts suspected of laundering money from drug transactions as part of a prolonged investigation.

The assets were placed in DEA-controlled Trezor cryptocurrency wallets and stored securely, as indicated by a search warrant reviewed by Forbes. As part of the standard forfeiture procedure, the DEA transferred a test amount of slightly more than $45 worth of USDT to the U.S. Marshals Service.

An on-chain investigator detected the transaction and promptly created a cryptocurrency wallet with the same first five and last four characters as the Marshals account — a scam method referred to as “address poisoning.”

The scammer airdropped a token to the DEA’s wallet to make the spoofed address appear as a recent transaction, thereby deceiving the owner into inadvertently sending funds to the incorrect address.

I almost fell victim to an address poisoning scam.
Sent a second transaction to someone just after the first, and was careless and simply copy-pasted his address from my transaction history.
Indeed, I copy-pasted the poisoned transaction address.
Just before confirming, @Rabby_io alerted me that I had never… pic.twitter.com/XlHPTs8PZy

— N̴̡̩̠̻̩͜͝a̴͍͙̫̹̅u̶̼̠̭͐̂͘h̷͇̻̭̚c̴͉͈̎̂̅͗̉̈́̆͑̍̀ (@nauhcner) April 18, 2023

This tactic was effective against the DEA agent, who transferred over $55,000 to the scammer.

By the time the Marshals noticed and informed the DEA, who subsequently requested Tether to freeze the funds, it was already too late.

The USDT had been exchanged for Ether () and Bitcoin () and then moved to various cryptocurrency wallets.

Related: SEC charges former corrections officer with involvement in unusual crypto scam

The DEA, in conjunction with the FBI, is investigating the incident and has yet to identify the perpetrator. So far, they have only discovered two Binance accounts that covered the gas fees for the attacker’s wallet, which were registered using two Gmail addresses.

It is hoped that Google possesses information that could help identify the owner of the Gmail accounts.

The DEA did not provide an immediate response to a request for comment.

Magazine: $3.4B of Bitcoin in a popcorn tin — The Silk Road hacker’s narrative