- An unidentified user suffered a $4.2 million loss in a recent crypto phishing scam, falling prey to sophisticated malware
- The attacker manipulated a falsified ERC-20 permission signature using opcode contracts, deceiving the victim
- Opcode malware, known for evading traditional security measures, complicates detection and removal, making it easier to ensnare victims in such sophisticated attacks
A recent crypto phishing scam led to a substantial $4.2 million loss for an unidentified user, who fell victim to opcode malware. The victim was taken in by a sophisticated attack in which the perpetrator exploited a falsified ERC-20 permission signature using ‘opcode’ contracts to deceive the victim. This type of malware often evades traditional security measures, complicating detection and removal efforts, and making it easier to trap victims.
Opcode Malware to Blame
Web3 security firm Scam Sniffer reported that the victim was undone by unknowingly approving multiple transactions, with the opcode contract manipulating ERC-20 authorization to bypass security alerts:
insane! someone lost $4.20m worth of aEthWETH and aEthUNI to crypto phishing about 40 minutes ago!https://t.co/PqtYbfjrW5 pic.twitter.com/2Nhx4HDQcK
— Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) January 22, 2024
The deceptive strategy involved generating new addresses for each signature and diverting funds to an unauthorized address before the intended transactions were executed.
Opcode malware, a potent threat in such attacks, exploits operation codes in scripting languages across various platforms. Its capabilities include rerouting funds, authorizing unauthorized expenditures, and immobilizing assets within smart contracts. It often evades traditional security measures, complicating detection and removal efforts.
Opcode malware can take control of a victim’s CPU, memory, and system resources by exploiting vulnerabilities in the operating system or other software. Once infiltrated, the malware executes a sequence of machine code instructions to carry out malicious activities.
Potent Reminder of Hack Threat
The rise in phishing activities over the past year has seen attackers adopting increasingly advanced tactics. Even prominent crypto whales with significant market-influencing holdings have become victims, facing substantial financial losses as fraudsters continue to exploit vulnerabilities in the crypto ecosystem.
The rise in such hacks makes it even more important to securely store your cryptocurrencies and only interact with contracts you implicitly trust.
