‘Address Poisoning’ Attack Sees Scammer Make Off With $1.3M in ARB Tokens

Initially reported as a “fortunate” Arbitrum airdrop recipient, one crypto deal with seems to have really scammed out over 600 totally different crypto wallets for greater than 930,000 ARB tokens.

Blockchain intelligence agency Arkham confirmed with Decrypt that they too have recognized that the deal with “belongs to a hacker who’s sweeping funds from Arbitrum customers.”

A better have a look at the precise deal with’s transactions reveals that it acquired 933,365 ARB tokens from a distinct Arbitrum deal with on March 24, a day after the layer-2 community’s highly-anticipated airdrop. ARB is the native governance token behind the layer-2 scaling answer for Ethereum referred to as Arbitrum.

The supply of these tokens is one other contract whose creator is tagged as “Fake_Phishing18” on Arbitrum’s blockchain explorer.

Impartial on-chain researcher 0xKnight additionally confirmed that he discovered sufferer experiences of the hack. Customers complained that their ARB tokens had been “auto-claimed” to the hacker’s wallets.

Ethereum sensible contract developer Brainsy signaled the malicious contract created by “Fake_Phishing18” on March 24 as properly. They mentioned that interacting with the contract creates an extra transaction request that seems as if it’s from the sender’s pockets however as an alternative is a phishing assault.

MetaMask has warned in opposition to this type of assault and termed it “deal with poisoning.”

It’s an try the place attackers poison the deal with checklist of customers’ wallets by sending arbitrary transactions from addresses that carefully resemble these with which the consumer has already interacted.

On this case, the attacker seems to have used each a phishing assault by a malicious sensible contract and deal with poisoning, with Brainsy indicating that it makes the transaction look “prefer it’s from [the users’] pockets.”

The “Fake_Phishing18” tag can also be related to one other deal with referred to as “Fake_Phishing47” which deployed a pretend ARB token contract on March 21.

The picture beneath exhibits that the “Fake_Phishing18” tagged account created the contract for the pretend ARB tokens after which transferred possession to “Fake_Phishing47.”

The identical entity could have created a pretend Aribtrum claiming web site that if customers interacted with the web site, it will give the hacker management over the consumer’s wallets.

As an illustration, there was at the least one an identical webpage to the Arbitrum Basis’s declare web site circulating in some social media teams on the day of the airdrop.

The pretend web site claimed ARB tokens on the consumer’s behalf and transferred them to their wallets. The one delicate distinction between them is that the unique web site has a countdown for when the claiming course of will finish.