Row 5795

Row ID: 5795 | Dataset Entry | Axioma AXP Content Repository

Content Data

This page contains data entry 5795 from the Axioma AXP content repository. The structured data below represents the complete record for this entry.

A victim today lost over 68 MILLION in wBTC simply by copying and pasting the wrong address.

**PSA - ALWAYS CHECK YOUR WALLET ADDRESS AND NEVER SEND LARGE FUNDS WITHOUT VERIFYING!**

I think the scammer is going to have a REAL hard time trying to launder 68 MILLION with so many eyeballs on this case. So far I can see all the funds accounted for.

No money laundering attempts yet.

Here are the main wallets to follow:

* **0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 - 68M wBTC VICTIM MAIN** * **0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 - VICTIM's intended destination** * **0xd9A1C3788D81257612E2581A6ea0aDa244853a91 - 68M wBTC Scammer MAIN**

[Above is a mapping of where all the stolen funds went. At the time of this posting, all of the funds are accounted for. I'm sure there will be more movement in time. The funds went to various intermediary wallets where they currently sit.](https://preview.redd.it/a6hfuj1hu9yc1.png?width=2204&format=png&auto=webp&s=80052df19bbcf598726d25d9ea0790ac9ab34835)

Below are where all the stolen funds are currently located:

* 0x68414dbe49AE09Db49F59Db44299A3642273e7C7 - ($3.27M here) * 0xF14A5e70190d694Dd1C25f13B21639B33192A774 - (4.38M here) * 0xcf049aa810caE4c402908E77Bbf14710673CdA6D - (5.08M here) * 0x20cC20715954E0097F402e466067B3aF40b6df6f - (3.66M here) 0x02E5aD70386AeC6ea2aad0ccd32A9Ae6e3A4C86a - (6.88M here) * 0x31C43429Cd5f918F19C05287E0bF7588Dfce592e - (8.13M here) * 0xF34527c397BD1d151908e8b1Fb51CE4405f61afe - (9.45M here) * 0x943706835942d3f0E9a2bc9aCe9dAF6973722EB0 - (10.88M here) * 0x74C55e1B92c8C69DaD85Cc552F42731A45c8111a - (11.41M here) * 0x32eA020A7bb80c5892df94C6E491E8914CcE2641 - (7.50M here)

# About the Scammer

I looked about at some clues on who the scammer might be and I came across this wallet - **0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2**. This scammer appears to be well funded and it seems this was a very targeted attack.

[Above is a look inside 0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2. There's numerous confirmed scammer wallets associated with this wallet. Further investigation is needed but I can see the off-ramping method of choice is ChangeNOW.](https://preview.redd.it/viyv7dolu9yc1.png?width=2502&format=png&auto=webp&s=e73eccd5c4170b24728fd22acb208cb64ee56e83)

**0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2** has numerous deposits into ChangeNOW. Below are a few. I'm showing about 300K deposited in total.

* 0xd9DCCD722cec4CdA2c863353288359b63192e657 - ChangeNOW * 0xBec2815457f20c3B67E8D5ed8535C382Bd82C35B - ChangeNOW * 0x810d3BCA5f46701B896F2818eF3b8B2F2aac0108 - ChangeNOW * 0xda2a290cCaeEa7adB65E61484D6D5EA1f7E12722 - ChangeNOW * 0x847A8e5Edc89069E6aBCe8B94bdC9B9A27fD776a - ChangeNOW * 0xFB2D881B32437Dd924c400B191790A4a26f5f4FA - ChangeNOW

**0x2bb7848Cf4193a264EA134c66bEC99A157985Fb8** also appears to be connected to the scammer. I noticed some smaller deposits into the following:

* 0x5d8f46E4733ab1707C0a5a968Ca305713847bE09 - Uphold * 0xb2663153D818ab211e106d9995FdB938C5fD2aA1 - Uphold * 0xE9eC5bA80dAABB0F5310CE3D81929D1Dbb0A892a - Amber Group * 0x555C62E27b460Fc91D2C3218bAb47a68770cC35b - OKX * 0x1f44238d8c9643dCAA3578BAf2680DE695D442F5 - Ceffu * 0x8546Fb132F0d70C3C61BDd8CF5D3f4E16e399A9C - Copper

Lastly, I also followed the money trail to this wallet - **0xA5335dB79413e9D2CD5B1E01A42F67ff3e55e49A** which is an older wallet created in 2017 with about 3M sitting in it. I did notice a Binance deposit address associated with this wallet doing large txns.

* 0xbc389803FF2E2d564c55e4034246BF285B3B2DDD - Binance

This needs further investigation before 100% confirming it belongs to the scammer. I don't want to jump ahead and confirm this is a scammer wallet but it's very suspicious.

# How did this Scam Happen - Address Poisoning

Address poisoning is a tactic where a scammer will try and mirror the victim's intended wallet. Since many wallets show the first 5 and last 5 of a wallet address, the scammer creates a wallet with the exact first and last digits of the address.

Typically the attacker spams victims with numerous transactions hoping the victim will copy and paste the wrong address.

Below is exactly how this scam worked

* Fake Address - 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 - 68M wBTC Scammer MAIN * Intended Address - 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 - VICTIM's intended destination

[Above is a look inside the most recent txns of 0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 - 68M wBTC VICTIM MAIN. ](https://preview.redd.it/r49azcqru9yc1.png?width=1638&format=png&auto=webp&s=68bcc8f8712d6e1f37a3a765c0f14b2ebb87c860)

In between these two outgoing txns, the scammer sent .64 in ETH to 0xd9A1C3788D81257612E2581A6ea0aDa244853a91. The txn was too small for my tools to pick up but Etherscan did.

Here is the Etherscan transaction in between the two transactions above - **0x87c6e5d56fea35315ba283de8b6422ad390b6b9d8d399d9b93a9051a3e11bf73**

The scam transaction happened 4 minutes after the victim sent .05 ETH to its intended address. In this instance, the victim mistakenly copied and pasted the fake address of 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 and sent 68.5M to the scammer.

I'd say this looks like a targeted attack. Scammers are watching movements from whales and will try and squeeze in these small txns to make it look like the victim has the correct wallet address. As you can see, the potential for scoring a big payday requires very little investment. In this case less than one dollar.

# How to Prevent Address Poisoning

If you're in this forum I'm expecting one day we'll all be crypto whales. It may be wishful thinking for some, but there are a few steps you can take to avoid scammers from tricking you.

1. Use EXTREME Caution - The more funds you're moving, the more careful you need to be. 2. Avoid sending txns when you're tired, after a wild night of partying with Jim Beam, or when you're not in a good state of mind to move funds. Overcheck to make sure you are sending to the correct wallet 3. Whitelist - Most wallets allow you to whitelist to avoid this exact scenario. 4. Avoid being Predictable - A strategy you can use is implementing fresh wallets for moving large funds. The victim took an hour and a half between txns giving the scammer plenty of time to squeeze in a small transaction. Implement a fresh wallet for a small test txn and then go! 5. Track dust - Use blockchain tracing tools like Etherscan to verify all of your on-chain txns. Before sending any large funds make sure there isn't any address poisoning attempts on your own wallet.

Stay safe out there and I do hope the victim gets his funds back.

**UPDATE 1**

A victim has been found. All funds are still sitting in decentralized wallets. If I were the hacker I'd take the offer of 10% and walk away with 7 MILLION! Here's the proof - [https://twitter.com/somaxbt/status/1786699612302004580](https://twitter.com/somaxbt/status/1786699612302004580)

FieldValue
text A victim today lost over 68 MILLION in wBTC simply by copying and pasting the wrong address. **PSA - ALWAYS CHECK YOUR WALLET ADDRESS AND NEVER SEND LARGE FUNDS WITHOUT VERIFYING!** I think the scammer is going to have a REAL hard time trying to launder 68 MILLION with so many eyeballs on this case. So far I can see all the funds accounted for. No money laundering attempts yet. Here are the main wallets to follow: * **0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 - 68M wBTC VICTIM MAIN** * **0…
label r/cryptocurrency
dataType post
communityName r/CryptoCurrency
datetime 2024-05-03
username_encoded Z0FBQUFBQm5LakwyQi1yejdpdGc0amZOaEZ4RE1NanJlVmhkQjhVemVUY19VZnJHRDBoTGFGM0RDcGZmTHVFVkotb0FYd0ZYaHpWNGw3clRvdWFmaUZsNll4MXNlaGVYcnc9PQ==
url_encoded Z0FBQUFBQm5Lak9HT2s5MVR4MEIxMDVfV0g4WmRQenpweVNPTmV2MnR4ZnEwUlRtTTJUbDFMTUo5T1hnVFRvb2RSTHR1bWZnbG9vb3BGNGhmSUQ0S252YUI5enV3d1pjZnFmTmdXUkVhb1JES2NVVWllQ0o4NUZiY191WE9MdjlOTkpSMlBpUGlUeUtpMTBiZGtaYTdJNG1NN1lQRHRzTFJPV2lSU09FLWdfTzJtcTVvYTdoU2x2TU9JZHN6SkVqZ0xNUDFEYVlRaTZkamdXa1JCZ3dXaDFYSzFnR1F5UlUxdz09

Raw Record

{
  "text": "A victim today lost over 68 MILLION in wBTC simply by copying and pasting the wrong address.\n\n**PSA - ALWAYS CHECK YOUR WALLET ADDRESS AND NEVER SEND LARGE FUNDS WITHOUT VERIFYING!**\n\nI think the scammer is going to have a REAL hard time trying to launder 68 MILLION with so many eyeballs on this case. So far I can see all the funds accounted for.\n\nNo money laundering attempts yet.\n\nHere are the main wallets to follow:\n\n* **0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 - 68M wBTC VICTIM MAIN**\n* **0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 - VICTIM's intended destination**\n* **0xd9A1C3788D81257612E2581A6ea0aDa244853a91 - 68M wBTC Scammer MAIN**\n\n[Above is a mapping of where all the stolen funds went. At the time of this posting, all of the funds are accounted for. I'm sure there will be more movement in time. The funds went to various intermediary wallets where they currently sit.](https://preview.redd.it/a6hfuj1hu9yc1.png?width=2204&format=png&auto=webp&s=80052df19bbcf598726d25d9ea0790ac9ab34835)\n\nBelow are where all the stolen funds are currently located:\n\n* 0x68414dbe49AE09Db49F59Db44299A3642273e7C7 - ($3.27M here)\n* 0xF14A5e70190d694Dd1C25f13B21639B33192A774 - (4.38M here)\n* 0xcf049aa810caE4c402908E77Bbf14710673CdA6D - (5.08M here)\n* 0x20cC20715954E0097F402e466067B3aF40b6df6f - (3.66M here) 0x02E5aD70386AeC6ea2aad0ccd32A9Ae6e3A4C86a - (6.88M here)\n* 0x31C43429Cd5f918F19C05287E0bF7588Dfce592e - (8.13M here)\n* 0xF34527c397BD1d151908e8b1Fb51CE4405f61afe - (9.45M here)\n* 0x943706835942d3f0E9a2bc9aCe9dAF6973722EB0 - (10.88M here)\n* 0x74C55e1B92c8C69DaD85Cc552F42731A45c8111a - (11.41M here)\n* 0x32eA020A7bb80c5892df94C6E491E8914CcE2641 - (7.50M here)\n\n# About the Scammer\n\nI looked about at some clues on who the scammer might be and I came across this wallet - **0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2**. This scammer appears to be well funded and it seems this was a very targeted attack.\n\n[Above is a look inside 0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2. There's numerous confirmed scammer wallets associated with this wallet. Further investigation is needed but I can see the off-ramping method of choice is ChangeNOW.](https://preview.redd.it/viyv7dolu9yc1.png?width=2502&format=png&auto=webp&s=e73eccd5c4170b24728fd22acb208cb64ee56e83)\n\n**0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2** has numerous deposits into ChangeNOW. Below are a few. I'm showing about 300K deposited in total.\n\n* 0xd9DCCD722cec4CdA2c863353288359b63192e657 - ChangeNOW\n* 0xBec2815457f20c3B67E8D5ed8535C382Bd82C35B - ChangeNOW\n* 0x810d3BCA5f46701B896F2818eF3b8B2F2aac0108 - ChangeNOW\n* 0xda2a290cCaeEa7adB65E61484D6D5EA1f7E12722 - ChangeNOW\n* 0x847A8e5Edc89069E6aBCe8B94bdC9B9A27fD776a - ChangeNOW\n* 0xFB2D881B32437Dd924c400B191790A4a26f5f4FA - ChangeNOW\n\n**0x2bb7848Cf4193a264EA134c66bEC99A157985Fb8** also appears to be connected to the scammer. I noticed some smaller deposits into the following:\n\n* 0x5d8f46E4733ab1707C0a5a968Ca305713847bE09 - Uphold\n* 0xb2663153D818ab211e106d9995FdB938C5fD2aA1 - Uphold\n* 0xE9eC5bA80dAABB0F5310CE3D81929D1Dbb0A892a - Amber Group\n* 0x555C62E27b460Fc91D2C3218bAb47a68770cC35b - OKX\n* 0x1f44238d8c9643dCAA3578BAf2680DE695D442F5 - Ceffu\n* 0x8546Fb132F0d70C3C61BDd8CF5D3f4E16e399A9C - Copper\n\nLastly, I also followed the money trail to this wallet - **0xA5335dB79413e9D2CD5B1E01A42F67ff3e55e49A** which is an older wallet created in 2017 with about 3M sitting in it. I did notice a Binance deposit address associated with this wallet doing large txns.\n\n* 0xbc389803FF2E2d564c55e4034246BF285B3B2DDD - Binance\n\nThis needs further investigation before 100% confirming it belongs to the scammer. I don't want to jump ahead and confirm this is a scammer wallet but it's very suspicious.\n\n# How did this Scam Happen - Address Poisoning\n\nAddress poisoning is a tactic where a scammer will try and mirror the victim's intended wallet. Since many wallets show the first 5 and last 5 of a wallet address, the scammer creates a wallet with the exact first and last digits of the address.\n\nTypically the attacker spams victims with numerous transactions hoping the victim will copy and paste  the wrong address.\n\nBelow is exactly how this scam worked\n\n* Fake Address - 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 - 68M wBTC Scammer MAIN\n* Intended Address - 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 - VICTIM's intended destination\n\n[Above is a look inside the most recent txns of 0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 - 68M wBTC VICTIM MAIN. ](https://preview.redd.it/r49azcqru9yc1.png?width=1638&format=png&auto=webp&s=68bcc8f8712d6e1f37a3a765c0f14b2ebb87c860)\n\nIn between these two outgoing txns, the scammer sent .64 in ETH to 0xd9A1C3788D81257612E2581A6ea0aDa244853a91. The txn was too small for my tools to pick up but Etherscan did.\n\nHere is the Etherscan transaction in between the two transactions above - **0x87c6e5d56fea35315ba283de8b6422ad390b6b9d8d399d9b93a9051a3e11bf73**\n\nThe scam transaction happened 4 minutes after the victim sent .05 ETH to its intended address. In this instance, the victim mistakenly copied and pasted the fake address of 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 and sent 68.5M to the scammer.\n\nI'd say this looks like a targeted attack. Scammers are watching movements from whales and will try and squeeze in these small txns to make it look like the victim has the correct wallet address. As you can see, the potential for scoring a big payday requires very little investment. In this case less than one dollar.\n\n# How to Prevent Address Poisoning\n\nIf you're in this forum I'm expecting one day we'll all be crypto whales. It may be wishful thinking for some, but there are a few steps you can take to avoid scammers from tricking you.\n\n1. Use EXTREME Caution - The more funds you're moving, the more careful you need to be.\n2. Avoid sending txns when you're tired, after a wild night of partying with Jim Beam, or when you're not in a good state of mind to move funds. Overcheck to make sure you are sending to the correct wallet\n3. Whitelist - Most wallets allow you to whitelist to avoid this exact scenario.\n4. Avoid being Predictable -  A strategy you can use is implementing fresh wallets for moving large funds. The victim took an hour and a half between txns giving the scammer plenty of time to squeeze in a small transaction. Implement a fresh wallet for a small test txn and then go!\n5. Track dust - Use blockchain tracing tools like Etherscan to verify all of your on-chain txns. Before sending any large funds make sure there isn't any address poisoning attempts on your own wallet.\n\nStay safe out there and I do hope the victim gets his funds back.\n\n  \n**UPDATE 1**\n\nA victim has been found. All funds are still sitting in decentralized wallets. If I were the hacker I'd take the offer of 10% and walk away with 7 MILLION! Here's the proof - [https://twitter.com/somaxbt/status/1786699612302004580](https://twitter.com/somaxbt/status/1786699612302004580)\n\n",
  "label": "r/cryptocurrency",
  "dataType": "post",
  "communityName": "r/CryptoCurrency",
  "datetime": "2024-05-03",
  "username_encoded": "Z0FBQUFBQm5LakwyQi1yejdpdGc0amZOaEZ4RE1NanJlVmhkQjhVemVUY19VZnJHRDBoTGFGM0RDcGZmTHVFVkotb0FYd0ZYaHpWNGw3clRvdWFmaUZsNll4MXNlaGVYcnc9PQ==",
  "url_encoded": "Z0FBQUFBQm5Lak9HT2s5MVR4MEIxMDVfV0g4WmRQenpweVNPTmV2MnR4ZnEwUlRtTTJUbDFMTUo5T1hnVFRvb2RSTHR1bWZnbG9vb3BGNGhmSUQ0S252YUI5enV3d1pjZnFmTmdXUkVhb1JES2NVVWllQ0o4NUZiY191WE9MdjlOTkpSMlBpUGlUeUtpMTBiZGtaYTdJNG1NN1lQRHRzTFJPV2lSU09FLWdfTzJtcTVvYTdoU2x2TU9JZHN6SkVqZ0xNUDFEYVlRaTZkamdXa1JCZ3dXaDFYSzFnR1F5UlUxdz09"
}
Explore Dataset Explore Row

Entry Information