New Tactics and Trends about Transfer Phising Attacks, $8 Million has been stolen

This article is jointly published by X-explore and WuBlockchain.

Ⅰ. Introduction

The zero-value transfer phishing attack, which has been ongoing for nearly half a year, has recently undergone a technological upgrade. On-chain monitoring has revealed that it has now evolved into small-value transfer phishing and fake token transfer phishing. The new attack methods have already generated profits of up to $8 million, and combined with our previous report on zero-value transfer phishing (Address Poisoning Attack, A continuing Threat), the total loss on the chain has reached $32 million.

We urge users to triple-check the correctness of the address when making transactions. Wallet APP and blockchain browser teams should promptly improve product security features.

In addition, X-explore can provide real-time address labels for this attack.

Ⅱ. (Old) Overview of Zero-Value Transfer Fishing Attacks

Since November 2022, a new phishing method has emerged on the chain. Attackers construct addresses that are similar to the intended recipients of normal transactions, and then send large amounts of false token transfer data with a value of zero to on-chain users. This allows them to profit from mistaken transactions.

Zero Value Token Transfer Phishing with same characters as victim's

This type of attack has the following characteristics:

The attack is covert and pervasive. Attackers construct addresses that have only one character difference or no difference at all from legitimate addresses. Blockchain browsers automatically omit the middle characters of an address. Therefore, attackers only need to focus on creating addresses that appear identical to the original ones. Additionally, as mainstream token logic does not verify zero-value transfers, anyone can initiate such transfers, which means any transactions can be inserted into anyone's transaction list.

The cost is low, and the return is high. The gas cost of Zero Value Phishing on the ETH chain alone is around 2,000 ETH (about $4M), and the accumulated funds obtained through this scam amount up to $21M.

Costs and Stolen Funds of Zero Value Phishing Attacks on the Ethereum Blockchain

Ⅲ. (Latest) Small-Amount Transfer Fishing Attacks

1. Introduction to the Principle

After monitoring normal token transfers, the attacker narrows the original token amount by tens or hundreds of thousands of times, and then forwards it to the victim through the phishing wallet in order to skip the monitoring of traditional zero value token phishing, including bypassing Etherscan's zero-value transfer phishing attack warning. By increasing the credibility of the address through actual transfers, more victims are deceived.

2. Attack Situation

The small-value transfer phishing attack first occurred on February 19, 2023 and lasted until March 26, with a total of 250,000 phishing attacks inserted into users' transaction lists. Currently, there is only one small-value transfer phishing attacker on the Ethereum network.

The attacker launched 30,000 contract calls for the attacks, with a total gas fee cost of 404 ETH (about $727k), and the cost for the small-value tokens was approximately $40k. Among them, the cost of phishing tokens for USDT accounted for 71% of all phishing tokens.

There were a total of 73,000 victims of the poisoning attacks, and a total of 23 unfortunate users transferred to the wrong address, totaling $1.2 million. Among the stolen funds, USDC and USDT accounted for 51% and 49%, respectively.

3. Attack Tracing

The attacker's direct source of funds comes from other phishing addresses. Tracing back to the earliest address, the source of funds is FixedFloat. The attacker's real address is User1:0xe153605BA5bDAa492246603982AbfCcb297c72e9, and two other commonly used addresses are also associated with this address: User2:0x0a153cd1b0f36447e4d541e08fabd45f7a302817 and User3:0x5b8544e1e7958715ededa0e843561ebbf0c728a8. The attacker's address is also associated with deposit addresses from Binance, Coinbase, Kucoin, and Kraken exchanges, which can be further investigated through the exchange's KYC information.

The attacker's fund flow mainly consists of three parts:

Ⅰ. Transferring funds is the cost of other attacks, such as gas fees for zero-value transfer phishing.

Ⅱ. Keeping the funds in the current address, or participating in staking to earn profits.

Ⅲ. Laundering the funds. For example, the attacker transferred 130 ETH to Avalanche, then through multiple hops, transferred them back to ETH, and finally converted them into USDT, which was laundered into MEXC for withdrawal. The MEXC user deposit address is 0xDa818c1174105a49C8B3Fe43a96039024244df6B.