
Address Poisoning Attack, A continuing Threat
This article is jointly published by X-explore and WuBlockchain.Abstract:The address poisoning attack on $0 USD transfers is savage in recent weeks. As of December 2, more than 340K addresses have been poisoned on the chain, totaling 99 victim addresses and more than 1.64M USD stolen. In this article, X-explore provides a comprehensive analysis of the attack landscape, traces the attackers on-chain, and also provides an in-depth analysis of how the attack is implemented. We would like to appe...

Advanced Analysis For Arbitrum Airdrop
This article is jointly published by X-explore and WuBlockchain.OverviewThe long-awaited Arbitrum has finally released its airdrop news. Along with the airdrop news, they also released their rules for checking Sybil addresses.https://github.com/ArbitrumFoundation/sybil-detectionAccording to the rule described, we can infer that the project team:Excluded cross-chain bridges, centralized exchanges, and smart contracts while detecting SybilA relatively tolerant detection was adopted for small-sc...

链上地址投毒,让你防不胜防
Abstract: 近一周,0U 转账的链上地址投毒攻击愈演愈烈,截至12月2日,已经有超过37W地址被投毒,总计92个受害地址,被盗取金额超过164W USD。 本篇文章,X-explore 对攻击态势进行了全面分析,对攻击者进行了链上溯源,同时也深入分析了攻击的实现方式。 我们呼吁钱包APP加强风险提示,普通用户在转账时谨防此类攻击。因为我们注意到UTC时间11月2日10点38分,有一位链上用户损失惨重,近100万美金因投毒而被转到黑客地址。本文由 X-explore 与吴说区块链联合发布。1. 背景近期,我们的链上风险监控发现ETH、BSC链上频繁出现 0u 转账现象,以下图bsc链的交易数据为例,受害者A发出一笔正常交易将452 BSC-USD发给B后,会收到C转来的0 BSC-USD,同时,在同一笔交易hash内用户A自己也会不受控制的给C转0 BSC-USD(实现了“一来一回”的0 BSC-USD转账操作)用户交易列表出现的现象在社区中,很多用户不知所以然,担心自己的钱包私钥已经泄漏,攻击者正在窃取资产。2. 攻击意图其实遇到这种情况的用户不用紧张,大家的资产是安全的...

Address Poisoning Attack, A continuing Threat
This article is jointly published by X-explore and WuBlockchain.Abstract:The address poisoning attack on $0 USD transfers is savage in recent weeks. As of December 2, more than 340K addresses have been poisoned on the chain, totaling 99 victim addresses and more than 1.64M USD stolen. In this article, X-explore provides a comprehensive analysis of the attack landscape, traces the attackers on-chain, and also provides an in-depth analysis of how the attack is implemented. We would like to appe...

Advanced Analysis For Arbitrum Airdrop
This article is jointly published by X-explore and WuBlockchain.OverviewThe long-awaited Arbitrum has finally released its airdrop news. Along with the airdrop news, they also released their rules for checking Sybil addresses.https://github.com/ArbitrumFoundation/sybil-detectionAccording to the rule described, we can infer that the project team:Excluded cross-chain bridges, centralized exchanges, and smart contracts while detecting SybilA relatively tolerant detection was adopted for small-sc...

链上地址投毒,让你防不胜防
Abstract: 近一周,0U 转账的链上地址投毒攻击愈演愈烈,截至12月2日,已经有超过37W地址被投毒,总计92个受害地址,被盗取金额超过164W USD。 本篇文章,X-explore 对攻击态势进行了全面分析,对攻击者进行了链上溯源,同时也深入分析了攻击的实现方式。 我们呼吁钱包APP加强风险提示,普通用户在转账时谨防此类攻击。因为我们注意到UTC时间11月2日10点38分,有一位链上用户损失惨重,近100万美金因投毒而被转到黑客地址。本文由 X-explore 与吴说区块链联合发布。1. 背景近期,我们的链上风险监控发现ETH、BSC链上频繁出现 0u 转账现象,以下图bsc链的交易数据为例,受害者A发出一笔正常交易将452 BSC-USD发给B后,会收到C转来的0 BSC-USD,同时,在同一笔交易hash内用户A自己也会不受控制的给C转0 BSC-USD(实现了“一来一回”的0 BSC-USD转账操作)用户交易列表出现的现象在社区中,很多用户不知所以然,担心自己的钱包私钥已经泄漏,攻击者正在窃取资产。2. 攻击意图其实遇到这种情况的用户不用紧张,大家的资产是安全的...

Subscribe to X-explore

Subscribe to X-explore
Share Dialog
Share Dialog


>300 subscribers
>300 subscribers
Conclusion: X-explore reports a sybil attack warning. The XEN Crypto project is suffering from large sybil attacks. The total number of sybil addresses is recognized 335K by us, and the sybil attacks are becoming increasingly severe. On October 12, around 80% of participating addresses are sybil addresses.
The project XEN Crypto founded by Jack Levin, who claims to be Google's 21st employee, has aroused a trendy topic in recent days. XEN project pioneering Proof of Participation mining mechanism has skyrocketed the single-digit gas fee on Ethereum to around 30 gwei. As of our analysis time (13:00 UTC on October 12), the total number of addresses participating in the XEN mint has reached 750,000.
**Domain:**Defi / Mint
Webiste:https://www.xencrypto.io/
**Chain:**ETH
**Participated Addresses:**750K
**Community Updates:**Some KOLs revealed that an address can earn a maximum of 800 USD, and there is still chance for arbitrage. Some airdrop scientists have conducted sybil attacks on the project.

As of October 12, we have counted 335,000 sybil attack addresses, accounting for 45% of the total participating addresses. It can be seen that as time goes by, the proportion of econnoisseur has gradually increased, and till today (October 12, 2022) the proportion of econnoisseur has reached a peak at 80%.

The picture below shows the largest group using batch transfer tools, involving a total of 38K batch transfer addresses. There is a clear consistency in the behavior:
Same source of funds: the sources of funds all come from the address 0x8BC110Db7029197C3621bEA8092aB1996D5DD7BE
Same transfer method: funds are distributed in batches through the contract address of Disperse.app, and the distribution address can evenly distribute funds to multiple addresses in one transaction


From our perspective, the project is now sufferring and will continously suffer from the tremendous loss because of the sybil attacks. As long as there is a small profit margin to take advantage of, econnoisseur parties will still pour into XEN project.
Moreover, the sybil attack is the main reason that influences the plunge in the XEN coin price and even further forming a death spiral. That is why the XEN price fell by more than 95% in one day after the CEX exchange went listing.
Conclusion: X-explore reports a sybil attack warning. The XEN Crypto project is suffering from large sybil attacks. The total number of sybil addresses is recognized 335K by us, and the sybil attacks are becoming increasingly severe. On October 12, around 80% of participating addresses are sybil addresses.
The project XEN Crypto founded by Jack Levin, who claims to be Google's 21st employee, has aroused a trendy topic in recent days. XEN project pioneering Proof of Participation mining mechanism has skyrocketed the single-digit gas fee on Ethereum to around 30 gwei. As of our analysis time (13:00 UTC on October 12), the total number of addresses participating in the XEN mint has reached 750,000.
**Domain:**Defi / Mint
Webiste:https://www.xencrypto.io/
**Chain:**ETH
**Participated Addresses:**750K
**Community Updates:**Some KOLs revealed that an address can earn a maximum of 800 USD, and there is still chance for arbitrage. Some airdrop scientists have conducted sybil attacks on the project.

As of October 12, we have counted 335,000 sybil attack addresses, accounting for 45% of the total participating addresses. It can be seen that as time goes by, the proportion of econnoisseur has gradually increased, and till today (October 12, 2022) the proportion of econnoisseur has reached a peak at 80%.

The picture below shows the largest group using batch transfer tools, involving a total of 38K batch transfer addresses. There is a clear consistency in the behavior:
Same source of funds: the sources of funds all come from the address 0x8BC110Db7029197C3621bEA8092aB1996D5DD7BE
Same transfer method: funds are distributed in batches through the contract address of Disperse.app, and the distribution address can evenly distribute funds to multiple addresses in one transaction


From our perspective, the project is now sufferring and will continously suffer from the tremendous loss because of the sybil attacks. As long as there is a small profit margin to take advantage of, econnoisseur parties will still pour into XEN project.
Moreover, the sybil attack is the main reason that influences the plunge in the XEN coin price and even further forming a death spiral. That is why the XEN price fell by more than 95% in one day after the CEX exchange went listing.
No activity yet