A significant security breach involving a sophisticated phishing attack resulted in the loss of $6.91 million in liquid staked Ether. The victim, who suffered this considerable financial loss on May 26, remarkably recovered a substantial portion of the stolen funds.
Incident Details
On May 26, the phishing group known as Inferno Drainer exploited the permit offline authorization signature feature to illicitly transfer nearly $7 million worth of ETH re-pledged assets from a user’s account. This type of attack exploits a vulnerability inherent in Ethereum’s permit system, introduced through EIP-2612, allowing transactions without prior on-chain approval.
- Amount Stolen: 1,807 ETH, valued at approximately $6.91 million.
- Recovery: 1,445 ETH, equating to 80% of the stolen assets.
- Remaining with Scammers: 20% of the stolen funds, kept as a ‘bounty’ by the scammers.
Analysis of the Attack
The breach was facilitated by a permit phishing attack, where a malicious actor creates a legitimate off-chain authorization signature that permits them to transfer tokens from a victim’s wallet. This vulnerability arises because the permit function does not verify ownership before execution. Consequently, if a user’s wallet signature has been compromised on a phishing site, scammers can utilize this exploit to withdraw funds without actual user consent.
In response to this incident, blockchain analytics firm SlowMist provided several security measures to prevent similar exploits:
- Regular Audits: Use tools like RevokeCash to check for unauthorized token permissions.
- Authorization Management: Utilize platforms like Scam Sniffer’s Permit2 tool for verifying and managing token authorizations.
- Prompt Action: Quickly revoke any suspicious or unauthorized permissions detected.
Community Reaction
While the victim’s partial recovery of the stolen funds was viewed positively, some community members criticized the repeated nature of such incidents involving significant sums. Notable DeFi sleuth ZachXBT pointed out the carelessness of falling victim to phishing attacks multiple times, referencing a prior $638K loss by the same individual.
This incident underscores the growing trend of cryptocurrency-related scams, which have reportedly increased by 53% over the past year. The FBI notes that crypto-related investment fraud constituted 86% of all investment fraud losses in the U.S. in 2023, highlighting the critical need for enhanced security measures and user education in the digital asset space.
The recovery of a substantial portion of the stolen assets in this instance provides a rare outcome in the realm of crypto theft. It emphasizes the necessity for continued vigilance and proactive security practices among cryptocurrency holders.
Featured image credit: YES Studio via Vecteezy