Disclaimer: Information found on CryptoreNews is those of writers quoted. It does not represent the opinions of CryptoreNews on whether to sell, buy or hold any investments. You are advised to conduct your own research before making any investment decisions. Use provided information at your own risk.
CryptoreNews covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money.
Crypto whale loses $24 million in staked Ethereum due to phishing scam
A cryptocurrency whale has become a target of a significant phishing scheme, resulting in the loss of millions in staked Ethereum via the liquid staking service Rocket Pool.
A prominent cryptocurrency investor lost the total balance of their Lido Staked ETH (stETH) and Rocket Pool ETH (rETH) due to this phishing incident, as reported by the cryptocurrency security firm PeckShield.
The breach occurred through just two transactions, with one involving the theft of 9,579 stETH and the other 4,851 rETH. At the time of the incident on Sept. 6, the value of the stolen assets amounted to $15.5 million in stETH and $8.5 million in rETH, totaling an astonishing $24 million.
The phishing transactions involved in the $24 million hack. Source: X
As per data from PeckShield, the perpetrator later exchanged the stolen assets for 13,785 Ether (ETH) and 1.64 million Dai (DAI) tokens.
A large portion of the DAI funds has already been moved to the fully automated cryptocurrency exchange FixedFloat, according to PeckShield.
SlowMist’s crypto tracking division, MistTrack, also reported that most of the remaining stolen assets were sent to three addresses: 0x4f2f02ee, 0x7023505, and 0x2abdc2ab.
Related: MetaMask scammers hijack government websites to target cryptocurrency investors
Data from the anti-scam platform, Scam Sniffer, indicates that the victim inadvertently granted token approvals to the scammer by signing “Increase Allowance” transactions.
“Increase Allowance” method utilized in the phisher’s transaction. Source: Etherscan
Allowance or access permissions are a characteristic of ERC-20 tokens that allow a third party to spend certain tokens belonging to another owner through smart contracts. Some cryptocurrency analysts have previously advised caution regarding the risks tied to approving ERC-20 allowances, highlighting that anonymous developers could deploy harmful smart contracts to deceive users.
This news follows shortly after at least five Ethereum liquid staking providers implemented or began to enforce a self-limit rule to ensure they do not control more than 22% of the Ethereum staking market. The providers reportedly included Rocket Pool, StakeWise, Stader Labs, and Diva Staking.
Magazine: Asia Express: Thailand’s national airdrop, Delio users impacted, Vietnam leading in cryptocurrency