Chainalysis Reveals $1 Billion Stolen in Cryptocurrency Phishing Scam
Date: 2023-12-15 Author: Dima Zakharov Categories: CRYPTO PAYMENTS
In a recent report by Chainalysis, it has been revealed that cybercriminals have successfully stolen approximately $1 billion in cryptocurrencies through approval phishing scams. These scams have been on the rise, with the peak of illicit gains occurring in May 2022.
Approval phishing is a fraudulent technique where scammers manipulate users into signing or "approving" malicious transactions on the blockchain. This grants the scammer permission to carry out operations within the victim's wallet, such as transferring funds to other addresses.
Many decentralized applications (dApps) on blockchain platforms, like Ethereum, require users to approve transactions to allow smart contracts to access their stored funds. These permissions are typically safe and necessary for the normal functioning of dApps.
Malicious smart contracts employed by scammers, facilitating fund transfers, are referred to as "drainers." By approving a scammer's transaction, users unwittingly hand over access to their assets.
Chainalysis began tracking this fraudulent scheme in May 2021, and the reported losses have now reached the staggering $1 billion mark. However, this could be just the tip of the iceberg, as not all phishing cases are reported, especially when scammers build trust with their victims, convincing them to approve malicious transactions for seemingly romantic reasons.
According to Chainalysis, the peak of earnings for approval-seeking phishers was in May 2022. In total, victims lost $516.8 million in 2022 and $374.6 million in the first 11 months of 2023.
Like many cryptocurrency-related crimes, the majority of phishing thefts are carried out by a handful of successful participants. Chainalysis has identified 1,013 phishing addresses, with just 73 of them accounting for half of all stolen assets.
One proposed solution is to educate users and industry participants not to approve transactions for other addresses unless they are absolutely certain of the trustworthiness of the individual or company on the other end, or fully understand the level of access they are granting.
On December 14, due to a vulnerability in the authentication service of the Ledger cryptocurrency wallet, an unknown hacker stole nearly half a million dollars in various cryptocurrencies. The hacker managed to embed drainer code into the interface of several popular crypto services that were using Ledger Connect's software code.
