In a striking reminder of the vulnerabilities that exist in the cryptocurrency space, two separate incidents led to a staggering loss of $62 million for crypto users due to wallet errors and phishing attacks. One victim lost $12.25 million in January by mistakenly copying an incorrect wallet address, while another user lost $50 million in December under similar circumstances. These alarming figures were reported by Scam Sniffer, a well-known Web3 security solution.
Compounding these losses, phishing attacks targeting crypto wallets saw a significant rise in January. According to Scam Sniffer, approximately $6.27 million was siphoned from 4,741 victims, marking a 207% increase from December”s figures. The largest individual thefts included $3.02 million taken from SLVon and XAUt through malicious permit approvals, alongside $1.08 million stolen from aEthLBTC.
One particularly insidious tactic employed by scammers is known as address poisoning. In this scheme, attackers send small transactions from wallet addresses that closely resemble legitimate ones. This method aims to trick users into copying the wrong address from their transaction history, ultimately leading to funds being sent directly to the scammers.
Furthermore, signature phishing attacks have escalated, increasing the risk for crypto users by persuading them to sign malicious approvals that grant attackers future access to their funds. Such scams exploit social engineering tactics and human error, making even seasoned crypto users susceptible.
A stark example of this occurred in November, when a crypto holder lost over $3 million worth of PYTH tokens after inadvertently sending them to a scammer”s wallet. The victim mistakenly copied a fraudulent deposit address that closely matched the real one, leading to the disastrous transfer. Blockchain analysts from Lookonchain revealed that the scammer had created a lookalike address and sent a minuscule SOL transaction to lend an air of legitimacy.
In light of these rising threats, Safe, previously known as Gnosis Safe, has issued warnings to its users regarding a large-scale address poisoning campaign specifically targeting multisig wallets. Attackers have been generating thousands of fraudulent addresses that closely resemble legitimate Safe addresses, aiming to deceive users into misdirecting their funds. Safe confirmed that this incident was not the result of a protocol exploit or an infrastructure breach, but rather a targeted social engineering campaign. To mitigate risks, Safe has flagged and removed approximately 5,000 malicious addresses from its wallet interface.
As the cryptocurrency landscape continues to evolve, these incidents underscore the critical importance of vigilance and verification in every transaction. Users must exercise caution and ensure they are sending funds to the correct addresses to safeguard their assets in an environment rife with deception and fraud.
