Crypto Heist: Stolen $71 Million On the Move After Elaborate Wallet Scam

Crypto funds linked to a $71 million wallet impersonation scam are on the move after six days of silence.

On May 3, an investor sent $71 million worth of Wrapped Bitcoin (WBTC) to a bait wallet address, falling prey to the scam of wallet poisoning. The scammer created a wallet address with similar alphanumeric characters and made a small transaction to the victim's account.

Just like most other investors, the victim validated the wallet address by matching the first and last few characters. However, the difference in the middle characters would have been obvious, usually obscured by most platforms for improved visual appeal.

Hackers often then convert stolen crypto into Ether, which is more easily siphoned through privacy protocols like Tornado Cash. This scammer was no different. The 1,155 WBTC was immediately converted into about 23,000 ETH and remained dormant in the scammer's wallet for six days.

On May 8, blockchain investigation firm PeckShield noticed part of the stolen funds being laundered. The scammer began splitting the loot into parts and initiated sending it to multiple crypto wallets.

In the process of shuffling the stolen funds, the hacker used about 400 crypto wallets, making tracking harder. Eventually, over 150 wallets received the funds. However, at the time of writing, all the stolen funds have still been traced back to the unknown scammer.

Scammers and hackers have historically been most active during bull markets. Read the guide on how to securely store your cryptocurrencies by Cointelegraph.

There are bad actors taking advantage of a new scam to drain users' wallets without transaction approval.

This scam only works with tokens that implement the ERC-2612 token standard, which enables "gas-less" transfers or transfers from a wallet that doesn't hold ETH. However, to enable approval-less transactions, users must be tricked into signing a message. Cointelegraph's investigation found that the scam was orchestrated by a Telegram group that used a fake version of the Collab.Land Telegram verification system.