Casey Wagner

Around $775,000 of stablecoin USDT was allegedly stolen in a phishing scheme on the Tron network, according to an investigation by risk assessment firm Global Ledger.



Global Ledger claims the funds were laundered via the TRX staking mechanism. Staking on Tron involves delegating TRX tokens to one of 27 Super Representatives, the network’s version of a validator node.



Global Ledger said the fraudsters used the SunSwap exchange to get <a href="https://blockworks.co/price/usdt" target="_blank" rel="noreferrer noopener">USDT</a> for Tron in a certain wallet. They then used <a href="https://blockworks.co/price/trx" target="_blank" rel="noreferrer noopener">TRX</a> for staking to verify their transactions and cover transaction fees, Global Ledger said.&nbsp;



The staking volume enabled the thieves to elect a specific Tron validator called “metaverse home,” a representative from Global Ledger told Blockworks. “Together with the wallet that collects the profit, approximately 100 phishing wallets participate in voting to help ‘metaverse home’ be chosen as a validator.”



With “metaverse home” selected, the validator receives the opportunity to create transaction blocks and receive a reward of 16 TRX for each block, the representative added.



“Proceeds were not cashed out through exchanges, in which case they can be traced and seized by law enforcement,” a representative from Global Ledger told Blockworks. “They were used to vote for the validator, [to] earn the cleanest money possible, [freshly] mined coins.”



The use of USDT is incidental and “metaverse home” is not linked to <a href="https://blockworks.co/tag/tether" target="_blank" rel="noreferrer noopener">Tether</a>, Global Ledger said, but its status and ability to earn money validating the blocks is certainly based on funds received from phishing USDT.



The nature of the scam shows how automated voting for a super representative can in ways permit this type of scheme, Global Ledger said.&nbsp;



“This is the first time we see such a laundering scheme,” a representative from Global Ledger said, noting that the scheme’s scale and sophistication indicates a business-like venture.



“These guys may have Slack, Jira and daily stand-ups like any other startup,” they said.



Updated Feb. 27, 2023 at 2:56 pm ET: An earlier version of this story misstated the total amount of stolen USDT.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Tracking a Novel Scheme to Launder Tether on Tron Blockchain

Bessie Liu

A report making the rounds among crypto traders this week claims 97.7% of tokens launched on decentralized exchange Uniswap V2 are rug pulls.&nbsp;



But the researcher behind it said the paper’s intention has been widely misinterpreted. 



Rug pulls are when developers or promoters hype up emerging tokens without any plans to actually execute on their promises. The often-sophisticated scams absconded with <a href="https://www.statista.com/chart/27775/biggest-rug-pulls-by-estimated-cryptocurrency-usd-value-stolen/" target="_blank" rel="noreferrer noopener">$7.7 billion</a> in 2021, according to Statista. 



In an interview with Blockworks, Bruno Mazorra — a Ph.D. candidate studying blockchain, cybersecurity and cryptography at the University of Pompeu Fabra — said that his research which is making its way through <a href="https://twitter.com/DrNickA/status/1587060596234747907?s=20&amp;t=_iz2jxswArearV8528dK_A" target="_blank" rel="noreferrer noopener">crypto Twitter</a> was intended to show how artificial intelligence (AI) technology could be used to detect scam tokens, rendering regulation unnecessary. 



“I’m quite afraid that [the paper is being] misused,” he said.



Despite Mazorra’s intentions, users are concerned that the research could be co-opted by governments to dole out regulation.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><a href="https://twitter.com/Bitboy_Crypto?ref_src=twsrc%5Etfw">@Bitboy_Crypto</a> has our back ! He’s taking arrows to protect Defi ! But in all seriousness US gov will use this to strongly regulate decentralized exchanges.&mdash; BJ (@buc_eescrypto) <a href="https://twitter.com/buc_eescrypto/status/1587069785287938050?ref_src=twsrc%5Etfw">October 31, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The paper caught the attention of the likes of Scott Lewis, co-founder of analytics protocol DeFi Pulse, who criticized the researchers for misusing the term “rug.”



“Most of [the tokens] on Uniswap were low effort/low revenue phishing style scams, where the token tried to look like an established token. Same scammer could launch thousands of these,” he tweeted. “‘Rug’ is an exit scam and was not 97.7% of tokens on Uniswap.”



Maya Zehavi, CEO of Stealthy Venture Labs, also picked apart the report. She said that claiming 97% of Uniswap tokens were rugpulls was equivalent to “saying 97% of Twitter accounts are fake, but none were active during the last year.”



<blockquote class="wp-block-quote">The original intention of the paper, according to Mazorra, was to show how you can use machine learning tools to detect scam tokens.</blockquote>



“This was not [a reason] for there to be more regulation in the crypto space, that is not the purpose of the paper at all,” Mazorra said. “We wanted to show how you could have the same impact without regulation.”



Mazorra also pointed out the paper — circulated by Nick Almond, the protocol leader of FactoryDAO — was a non-peer-reviewed version of the report that had been published in a bull market. An updated, peer reviewed version of <a href="https://www.mdpi.com/2227-7390/10/6/949" target="_blank" rel="noreferrer noopener">the study</a> can be found on the Multidisciplinary Digital Publishing Institute.



“It was much easier to do rug pulls in the bull market,” he said. “If we redo this paper in the bear market, I think our hypothesis or conjecture will change completely — how a scam would be deployed would be very different.”



Uniswap V2 is not the only decentralized exchange that allows users to launch tokens with very little value, Mazorra noted. In a hackathon at ETH Amsterdam, Mazorra and his research partner found similar results on Polygon and Uniswap V3.



Ultimately, Mazorra hopes his research and the machine learning tools he has developed can be a gateway for people to understand cryptocurrency tokens and make better investment decisions.



“We are just purely analyzing and understanding — we are not pushing for regulation,” he said.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Are 97% of Tokens on Uniswap Really Rug Pulls?

Sebastian Sinclair

<div id="highlights-block_62e3359f241e1" class="highlights">
 <ul>
 <li>Google and Apple are being pressed on how they police crypto-related fraud in mobile applications hosted on their app stores</li>
 <li>Letters issued to the tech giants&#8217; CEOs are part of Sen. Brown&#8217;s wider probe into crypto scams</li>
 </ul>
 
</div>



The heads of Google and Apple are staring down requests for&nbsp;information from the US government about how the tech giants implement safeguards and monitor for crypto fraud in&nbsp;mobile applications hosted on their app stores. 



Chairman&nbsp;of the Senate Committee on Banking, Housing and Urban Affairs, Sen. Sherrod Brown (D-OH), sent <a href="https://www.banking.senate.gov/imo/media/doc/letter_to_alphabet_sundar_pichai_07272022.pdf" target="_blank" rel="noreferrer noopener">two</a> near-identical <a href="https://www.banking.senate.gov/imo/media/doc/chairman_brown_letter_to_apple_tim_cook_07272022.pdf" target="_blank" rel="noreferrer noopener">letters</a> Thursday to Google&#8217;s Sundar Pichai and Apple&#8217;s Tim Cook.



Brown, the committee&#8217;s chair since February, is requesting the companies describe their review processes for apps that make it onto their stores, as well as how they go about policing certain apps that circumvent their store policies.



The requests come as the senator ratchets up efforts to understand the scope of crypto-related scams. Also on Thursday, Brown chaired a <a href="https://www.banking.senate.gov/hearings/protecting-investors-and-savers-understanding-scams-and-risks-in-crypto-and-securities-markets" target="_blank" rel="noreferrer noopener">hearing</a> on “Protecting Investors and Savers: Understanding Scams and Risks in Crypto and Securities Markets.”



In it, the committee heard about how bad actors use marketing as a means to promote scams including through the use of apps hosted on Google&#8217;s and Apple&#8217;s stores.



Melanie Senter Lubin, president of the North American Securities Administrators Association and Gerri Walsh, senior vice president of investor education at the Financial Industry Regulatory Authority, both offered their insights during the hearing.



In his letters, the senator has sought information on the systems and processes the companies have in place for people to report fraudulent, apps as well as actions taken to alert users to fraudulent crypto app activity.



&#8220;While firms that offer crypto investment and other related services should take the necessary steps to prevent fraudulent activity, including warning investors about the uptick in scams, it is likewise imperative that app stores have the proper safeguards in place to prevent against fraudulent mobile application activity,&#8221; the senator wrote.



Apple and Google are being urged to respond to the senator&#8217;s request for information by no later than August 10, 2022.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Google, Apple Asked to Review Protections Against Crypto App Fraud

Shalini Nagarajan

<div id="highlights-block_629ddabf61cad" class="highlights">
 <ul>
 <li>Scammers used fake investment opportunities and romance-linked fraud to trick people into crypto transfers</li>
 <li>Nearly half of the victims were targeted on Instagram, Facebook, WhatsApp and Telegram</li>
 </ul>
 
</div>



Smart contract <a href="https://cms.blockworks.co/?s=exploit" target="_blank" rel="noreferrer noopener">exploits</a> and rug pulls may be exotic, but unsuspecting crypto users are at risk of more run-of-the-mill fraud too. Since 2021, investment-related fraud and romance scams were the top two methods of defrauding individuals on social media, according to a new <a href="https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/06/reports-show-scammers-cashing-crypto-craze#crypto1" target="_blank" rel="noreferrer noopener">report</a> by the Federal Trade Commission.



More than 46,000 people have collectively reported more than $1 billion in losses in crypto-related scams between the start of 2021 and the first quarter of 2022. That’s more than any other payment method — and nearly 60 times the crypto losses reported in 2018, according to the regulator.



The losses are not the result of any failure of cryptography or errant smart contracts, but old-fashioned social engineering that’s not unique to crypto. Last year, 59 million people in the US alone lost nearly $30 billion <a href="https://www.cnbc.com/2021/06/29/americans-lost-billions-of-dollars-to-phone-scams-over-the-past-year.html" target="_blank" rel="noreferrer noopener">to phone scams</a>.



The regulatory agency warned that using a social media platform while holding cryptocurrencies can be a particularly explosive mix.



<blockquote class="wp-block-quote">“Nearly half the people who reported losing crypto to a scam since 2021 said it started with an ad, post, or message on a social media platform,” the report said.</blockquote>



The top social media platforms identified in these online deceptions were Instagram (32%), Facebook (26%), WhatsApp (9%) and Telegram (7%).



An investment opportunity or offer that seems too good to be true usually is, and more than half of the losses reported to the FTC — $575 million — were related to <a href="https://consumer.ftc.gov/jobs-and-making-money/money-making-opportunities-and-investments" target="_blank" rel="noreferrer noopener">fake investment opportunities</a>.



“Investment scammers claim they can quickly and easily get huge returns for investors,” the report said. “But those crypto ‘investments’ go straight to a scammer’s wallet.”



Some people get convinced about the legitimacy of these schemes as they’re initially able to track the performance of their cryptocurrency and are able to make a small “test” withdrawal.


<div class="wp-block-image">
<figure class="aligncenter size-large"><img decoding="async" loading="lazy" width="1024" height="487" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png" alt="" class="wp-image-22473" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/06/2022-06-06-fraud-1024x487.png?w=1480 1480w" sizes="(max-width: 1024px) 100vw, 1024px" /><figcaption>Figures based on fraud reports to the FTC&#8217;s Consumer Sentinel Network indicating cryptocurrency as the payment method. The investment related fraud category includes subcategories for art, gems and rare coin investments, investment seminars and advice, stocks and commodity futures trading and miscellaneous investments. Source: <a href="https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/06/reports-show-scammers-cashing-crypto-craze#crypto1" target="_blank" rel="noreferrer noopener">FTC</a></figcaption></figure></div>


According to the FTC, <a href="https://consumer.ftc.gov/articles/what-you-need-know-about-romance-scams" target="_blank" rel="noreferrer noopener">romance scams</a> are the next most common type of crypto-related fraud. Nearly one in every three dollars of the reported losses, or $185 million, was lost to such a scam since 2021.



The regulator said sophisticated “keyboard Casanovas” allegedly entice people by laying claims to made-up wealth. They seem to offer spontaneous tips on how to get started in crypto investing before trapping the victim into sending money to a scam account.



Victims of romance scams reported a median individual loss of $10,000, the report found.



If a victim parts with cryptocurrency on fraudulent exchange platforms, imposter websites, or peer-to-peer transfers, recovery is likely to prove difficult, because transactions cannot be reversed.



People in their 30s were the most significant hit by fraud-related cryptocurrency losses. But older victims lost bigger sums, with the median amount for victims in their 70s being just under $12,000. Earlier this year, the UK’s Financial Conduct Authority <a href="https://cms.blockworks.co/fca-finds-increased-scam-reports-linked-to-crypto/" target="_blank" rel="noreferrer noopener">highlighted</a> about 3,000 reports of possible crypto-linked scams between April and September of 2021.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Frauds and Scams Top $1B Since 2021, FTC Says

<div id="highlights-block_629bdedad744f" class="highlights">
 <ul>
 <li>A malicious actor has made off with $359,000 worth of Bored Ape NFTs following a compromise to BAYC&#8217;s discord server</li>
 <li>The hack marks the third time in two months that BAYC&#8217;s NFTs have been compromised, raising questions over the project&#8217;s security</li>
 </ul>
 
</div>



A malicious actor has made off with 200 ether ($359,000) worth of Bored Ape NFTs after the Discord server belonging to the project was compromised on Saturday.



Bored Ape Yacht Club&#8217;s (BAYC) parent company, Yuga Labs, confirmed the amount in a <a href="https://twitter.com/BoredApeYC/status/1533181013815349248?s=20&amp;t=l0S14y3sVid1OW04PU6Ong" target="_blank" rel="noreferrer noopener">tweet</a> roughly 11 hours following the attack. The attacker was able to breach the security of the Discord account belonging to BAYC&#8217;s project manager Boris Vagner, according to on-chain analyst and Twitter user @NFTherder who first sounded the <a href="https://twitter.com/nftherder/status/1533037408144572417" target="_blank" rel="noreferrer noopener">alarm</a>.



<blockquote class="wp-block-quote">&#8220;Our Discord servers were briefly exploited today,&#8221; Yuga Labs tweeted via its BAYC Twitter handle. &#8220;The team caught and addressed it quickly. About 200 ETH worth of NFTs appear to have been impacted. We are still investigating.&#8221;</blockquote>



Following the successful breach, the actor was then able to post a phishing scam pretending to be Vagner that duped Bored Ape collectors into clicking a malicious link and sent their NFTs (non-fungible tokens) to the attacker&#8217;s address, NFTherder said.



Vagner was promoted to social and community manager in February, according to a <a href="https://twitter.com/BorisVagner/status/1488336821419270145?s=20&amp;t=DUcAvV7Cg4GwN-ru4d_E-g" target="_blank" rel="noreferrer noopener">tweet</a> in which he praised the founders of Bored Apes and Yuga Labs.



Questions have sprung up on social media as to how the Discord account was compromised, questioning the project&#8217;s security. Despite proper security measures by way of two-factor authentication, attackers, in this instance, may have circumvented security by obtaining a Discord ID token from a targeted victim.



One explanation for the method behind the attack was that Vagner&#8217;s Discord ID token — used to log in multiple times locally without verifying one&#8217;s identity — was also compromised. This could have allowed the actor to gain access to Vagner&#8217;s account.



The theft marks the third time BAYC has been hacked, including an instance on April 1 when a Mutant Ape Yacht Club NFT was stolen via a phishing link on Discord. Almost four weeks later, on April 25, <a href="https://cms.blockworks.co/bayc-instagram-hacked-for-more-than-10-million/" target="_blank" rel="noreferrer noopener">BAYC&#8217;s Discord and Instagram accounts</a> were also hacked when a link to a copycat website duped users into giving up NFTs worth millions of dollars.



Hundreds of users have taken to Twitter to vent their frustration at the repeated attacks and alleged lack of security.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">not getting a discord hacked is super easy. especially for projects WITH BILLIONS in revenue. honestly it&#39;s embarrassing.&mdash; UncleTravelingMatt.eth (@UncTravelinMatt) <a href="https://twitter.com/UncTravelinMatt/status/1533072701375528960?ref_src=twsrc%5Etfw">June 4, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



&#8220;They [BAYC] should consider investing a full-time security manager,&#8221; NFTherder tweeted in response to one user&#8217;s comment on BAYC&#8217;s security. &#8220;Surprised they haven&#8217;t already though.&#8221;



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">