Phishing Attack Leads to $10M Ether Transfer to Tornado Cash: Unmasking Crypto Security Threats
Summary:
This article discusses the transfer of $10 million in Ether (ETH) linked to a September 2023 phishing attack to the crypto-mixing protocol, Tornado Cash. Blockchain security experts have traced the movement of funds from a $24 million hack involving a crypto whale. The scenario revived discussions about the potential misuse of smart contracts and token approvals by hackers. The article also discusses how phishing continues to plague the crypto community with millions lost to such scams, primarily on the Ethereum network and involving ERC-20 tokens.
In October 2023, a phishing assault was connected to a particular account, which has now moved $10 million of Ether (ETH) into the crypto-mixing protocol known as Tornado Cash. As reported by Etherscan, the hacker transferred the funds to Tornado Cash. Blockchain security agency CertiK reported on March 21 that an account tied to a $24 million hack sent 3,700 ETH to Tornado Cash. A prominent crypto-asset holder fell victim to a phishing operation on September 6, 2023, losing $24 million in ETH staked on Rocket Pool, a liquid staking provider. The deceptive act was split into two transactions; 9,579 stETH was taken in the first, and 4,851 rETH was siphoned off in the second. Scam Sniffer, a project tackling scams, revealed that the victim signed an "Increase Allowance" transaction, providing the hacker with token permissions. In the context of smart contracts, this feature allows sanctioned third parties to expend ERC-20 tokens belonging to others. This token authorization element has been discussed broadly in the crypto sphere, emphasizing the potential misuse by developers through malicious smart contracts. Blockchain security firm PeckShield identified that the attacker exchanged the assets for 13,785 ETH and 1.64 million Dai (DAI). Some of the DAI was moved to the FixedFload exchange, whereas most of the purloined funds were placed in other wallets. Phishing incursions persist as a major issue in the crypto sphere. According to Scam Sniffer's crypto phishing report, $47 million was lost to such scams in February. The report illustrated that 78% of the thefts occurred on the Ethereum network and 86% of the pilfered assets were ERC-20 tokens. The endorsement of tokens has instigated recent losses amongst crypto holders. On March 20, an obsolete contract, once utilized by the Dolomite exchange, was exploited to extract $1.8 million from its users. This breach impacted users who had authorized approvals for the contract, leading to Dolomite's development crew recommending users cancel prior approval gestures to the old contract address. Although some attacks result in multi-million losses, some crypto theft attempts are intercepted swiftly. For instance, on March 20, the Layerswap group averted further harm after a website breach by timely intervention from its domain provider. Despite this prompt action, hackers managed to extract approximately $100,000 in assets from 50 users. Layerswap pledged to refund the affected users and extend extra compensation for their hassle.
Published At
3/21/2024 4:41:56 PM
Disclaimer: Algoine does not endorse any content or product on this page. Readers should conduct their own research before taking any actions related to the asset, company, or any information in this article and assume full responsibility for their decisions. This article should not be considered as investment advice. Our news is prepared with AI support.
Do you suspect this content may be misleading, incomplete, or inappropriate in any way, requiring modification or removal?
We appreciate your report.