A victim today lost over 68 MILLION in wBTC simply by copying and pasting the wrong address.

PSA - ALWAYS CHECK YOUR WALLET ADDRESS AND NEVER SEND LARGE FUNDS WITHOUT VERIFYING!

I think the scammer is going to have a REAL hard time trying to launder 68 MILLION with so many eyeballs on this case. So far I can see all the funds accounted for.

No money laundering attempts yet.

Here are the main wallets to follow:

• 0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 - 68M wBTC VICTIM MAIN
• 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 - VICTIM's intended destination
• 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 - 68M wBTC Scammer MAIN

Above is a mapping of where all the stolen funds went. At the time of this posting, all of the funds are accounted for. I'm sure there will be more movement in time. The funds went to various intermediary wallets where they currently sit.

Below are where all the stolen funds are currently located:

• 0x68414dbe49AE09Db49F59Db44299A3642273e7C7 - ($3.27M here)
• 0xF14A5e70190d694Dd1C25f13B21639B33192A774 - (4.38M here)
• 0xcf049aa810caE4c402908E77Bbf14710673CdA6D - (5.08M here)
• 0x20cC20715954E0097F402e466067B3aF40b6df6f - (3.66M here) 0x02E5aD70386AeC6ea2aad0ccd32A9Ae6e3A4C86a - (6.88M here)
• 0x31C43429Cd5f918F19C05287E0bF7588Dfce592e - (8.13M here)
• 0xF34527c397BD1d151908e8b1Fb51CE4405f61afe - (9.45M here)
• 0x943706835942d3f0E9a2bc9aCe9dAF6973722EB0 - (10.88M here)
• 0x74C55e1B92c8C69DaD85Cc552F42731A45c8111a - (11.41M here)
• 0x32eA020A7bb80c5892df94C6E491E8914CcE2641 - (7.50M here)

About the Scammer

I looked about at some clues on who the scammer might be and I came across this wallet - 0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2. This scammer appears to be well funded and it seems this was a very targeted attack.

Above is a look inside 0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2. There's numerous confirmed scammer wallets associated with this wallet. Further investigation is needed but I can see the off-ramping method of choice is ChangeNOW.

0xd50Ddd086EEf8E48c597c5A9225F616A2b3250F2 has numerous deposits into ChangeNOW. Below are a few. I'm showing about 300K deposited in total.

• 0xd9DCCD722cec4CdA2c863353288359b63192e657 - ChangeNOW
• 0xBec2815457f20c3B67E8D5ed8535C382Bd82C35B - ChangeNOW
• 0x810d3BCA5f46701B896F2818eF3b8B2F2aac0108 - ChangeNOW
• 0xda2a290cCaeEa7adB65E61484D6D5EA1f7E12722 - ChangeNOW
• 0x847A8e5Edc89069E6aBCe8B94bdC9B9A27fD776a - ChangeNOW
• 0xFB2D881B32437Dd924c400B191790A4a26f5f4FA - ChangeNOW

0x2bb7848Cf4193a264EA134c66bEC99A157985Fb8 also appears to be connected to the scammer. I noticed some smaller deposits into the following:

• 0x5d8f46E4733ab1707C0a5a968Ca305713847bE09 - Uphold
• 0xb2663153D818ab211e106d9995FdB938C5fD2aA1 - Uphold
• 0xE9eC5bA80dAABB0F5310CE3D81929D1Dbb0A892a - Amber Group
• 0x555C62E27b460Fc91D2C3218bAb47a68770cC35b - OKX
• 0x1f44238d8c9643dCAA3578BAf2680DE695D442F5 - Ceffu
• 0x8546Fb132F0d70C3C61BDd8CF5D3f4E16e399A9C - Copper

Lastly, I also followed the money trail to this wallet - 0xA5335dB79413e9D2CD5B1E01A42F67ff3e55e49A which is an older wallet created in 2017 with about 3M sitting in it. I did notice a Binance deposit address associated with this wallet doing large txns.

• 0xbc389803FF2E2d564c55e4034246BF285B3B2DDD - Binance

This needs further investigation before 100% confirming it belongs to the scammer. I don't want to jump ahead and confirm this is a scammer wallet but it's very suspicious.

How did this Scam Happen - Address Poisoning

Address poisoning is a tactic where a scammer will try and mirror the victim's intended wallet. Since many wallets show the first 5 and last 5 of a wallet address, the scammer creates a wallet with the exact first and last digits of the address.

Typically the attacker spams victims with numerous transactions hoping the victim will copy and paste the wrong address.

Below is exactly how this scam worked

• Fake Address - 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 - 68M wBTC Scammer MAIN
• Intended Address - 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 - VICTIM's intended destination

Above is a look inside the most recent txns of 0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5 - 68M wBTC VICTIM MAIN.

In between these two outgoing txns, the scammer sent .64 in ETH to 0xd9A1C3788D81257612E2581A6ea0aDa244853a91. The txn was too small for my tools to pick up but Etherscan did.

Here is the Etherscan transaction in between the two transactions above - 0x87c6e5d56fea35315ba283de8b6422ad390b6b9d8d399d9b93a9051a3e11bf73

The scam transaction happened 4 minutes after the victim sent .05 ETH to its intended address. In this instance, the victim mistakenly copied and pasted the fake address of 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 and sent 68.5M to the scammer.

I'd say this looks like a targeted attack. Scammers are watching movements from whales and will try and squeeze in these small txns to make it look like the victim has the correct wallet address. As you can see, the potential for scoring a big payday requires very little investment. In this case less than one dollar.

How to Prevent Address Poisoning

If you're in this forum I'm expecting one day we'll all be crypto whales. It may be wishful thinking for some, but there are a few steps you can take to avoid scammers from tricking you.

1. Use EXTREME Caution - The more funds you're moving, the more careful you need to be.
2. Avoid sending txns when you're tired, after a wild night of partying with Jim Beam, or when you're not in a good state of mind to move funds. Overcheck to make sure you are sending to the correct wallet
3. Whitelist - Most wallets allow you to whitelist to avoid this exact scenario.
4. Avoid being Predictable - A strategy you can use is implementing fresh wallets for moving large funds. The victim took an hour and a half between txns giving the scammer plenty of time to squeeze in a small transaction. Implement a fresh wallet for a small test txn and then go!
5. Track dust - Use blockchain tracing tools like Etherscan to verify all of your on-chain txns. Before sending any large funds make sure there isn't any address poisoning attempts on your own wallet.

Stay safe out there and I do hope the victim gets his funds back.

UPDATE 1

A victim has been found. All funds are still sitting in decentralized wallets. If I were the hacker I'd take the offer of 10% and walk away with 7 MILLION! Here's the proof - https://twitter.com/somaxbt/status/1786699612302004580