Web3 is Going Just Great

March 16, 2024

Remilia Collective reports multi-million dollar hack

An anime style illustration of a person with green hair wearing a cat ears headband and light blue blouse with a peter pan style collar. At the bottom of the illustration are defense and attack points bars like in a card game.

"Charlotte Fang", the leader of the controversial Remilia project (known for its Milady NFTs), claimed he was hacked and drained of ETH and NFTs potentially worth several million dollars. Although the project's treasury used a multi-signature model, the private keys were stored in one password manager, which Fang says was compromised.

The attacker stole around 490 ETH (~$1.8 million) and $58,000 USDC, along with more than 130 Milady NFTs, 320 Remilio NFTs, and hundreds of derivative tokens issued on the NFTX platform. Based on floor prices, the assets are valued at north of $6 million.

The mechanism of the attack is still uncertain, though Fang has said he suspects malware that could have intercepted credentials to his Bitwarden password manager. Some have expressed skepticism around the "hack", suggesting it could have been inside job. The Remilia group had suffered a separate $1 million loss in September 2023 — blamed on a rogue developer — and failed to implement many security safeguards after that incident.

March 15, 2024

NFPrompt discloses hack

(attribution)

A Binance-incubated platform called NFPrompt claims to be "the first Prompt Artist Platform in Web3" — with "prompt artist" referring to people who come up with prompts to feed into large language models. More succinctly, it's a platform to sell the NFTs you've made out of AI-generated images.

The platform announced on March 15 that it had suffered a "critical security incident" that it attributed to "a group of hackers" who were able to gain access to funds belonging both to the project's users and the project itself. They did not disclose how much was taken.

The project announced that it was working with the FBI, and had contacted centralized exchanges to ask them to freeze stolen funds.

Tweet by NFPrompt [archive]

March 15, 2024

Mozaic exploited for $2 million, recovers 90%

(attribution)

The "AI-optimized" defi project Mozaic Fi was exploited by an attacker who drained around $2 million in funds from the project.

According to MozaicFi, the theft had been perpetrated by a rogue developer who was able to gain access to a private key held by a core team member. They also claimed that a simultaneous large sale of the Mozaic token resulted in cascading liquidations.

In good news for the project, the attacker moved around 90% of the stolen funds to MEXC, a centralized cryptocurrency exchange that was able to freeze the thief's access to the funds.

March 13, 2024

Massachusetts prosecutors seek to seize $2.3 million from crypto romance scam

The U.S. Attorney's Office in the District of Massachusetts announced that they had filed a civil forfeiture action to seize cryptocurrency priced at around $2.3 million from two Binance accounts. Those accounts had received cryptocurrency of various kinds from at least 37 American victims, one of whom was based in Massachusetts and who lost $400,000 in crypto assets to the scammers.

"United States Files Forfeiture Action to Recover Cryptocurrency Traceable to Pig Butchering Romance Scam", United States Attorney's Office, District of Massachusetts [archive]

March 13, 2024

Phishing attack drains $2 million from one victim

An Ethereum holder who had been staking their ETH through a liquid restaking protocol called Ether.fi suffered a 501 ETH (~$2.025 million) loss when they fell victim to a phishing scam. They inadvertently signed a malicious transaction that granted the attacker "increase allowance" permissions, enabling them to siphon almost the entire sum of funds from the wallet. The individual was left with less than $1,500 in the wallet.

Tweet thread by ScamSniffer [archive]

March 11, 2024

Incognito Market drug marketplace pulls multi-million dollar double scam

(attribution)

Since March 5, those who used the Incognito Market darkweb narcotics marketplace have found themselves unable to withdraw the Bitcoin and Monero they had on the platform. It appeared the platform had exit scammed for somewhere between $10 and $30 million.

Making matters worse, on March 10 the website posted a message reading, "Yes, this is an extortion !!" They wrote that, although the platform promised to "auto-encrypt" messages between buyers and sellers, and auto-delete after an expiry date, messages were not encrypted or deleted. They demanded that users pay an additional $100 to $20,000 to have their information removed from the dataset, which they promised to release at the end of May. "Whether or not you and your customers' info is on that list is totally up to you."

The tactic is reminiscent of that of ransomware groups, which often demand double fees: one from victims of hacks first to regain access to their systems, and another in exchange for a promise to destroy stolen data.

Incognito Darknet Market Mass-Extorts Buyers, Sellers, Krebs on Security [archive]

March 10, 2024

Twitter phishers steal over $46 million from 57,000 victims in February

Scam Sniffer's February 2024 report describes 57,000 victims who collectively lost almost $47 million thanks to various phishing schemes on the Twitter platform. Many of the losses came from accounts designed to impersonate various popular cryptocurrency projects, who diverted users to scam websites resembling the real ones.

The largest individual loss was the phishing attack against kirilm.eth, who had over 180 million $BEAM tokens notionally worth over $5 million drained from their crypto wallet. The attacker sold the tokens for around $4.5 million.

The total amount stolen is down slightly from January, in which $55 million was taken. Altogether, scammers have stolen over $100 million via Twitter phishing alone in the first two months of 2024.

February 2024 Scam Sniffer Phishing Report, Dune dashboard [archive]
Tweet thread by Scam Sniffer [archive]

March 9, 2024

Crypto4Winners investment firm claims funds were stolen

(attribution)

A investment firm called Crypto4Winners announced in their Telegram channel that "Our investigations lead us to suspect an individual of committing fraudulent acts that may have compromised the integrity of assets. It is also possible that the current and historical data at our disposal has been tampered with, with a high degree of sophistication."

The company had paused withdrawals the previous day, and has not re-enabled them. They also have not disclosed the amount that was allegedly stolen.

Crypto4Winners claims it has earned 377% returns on customer investments since 2019, producing 3–20% monthly returns.

The company is co-owned by Luc Schiltz, who was sentenced to six years in prison in 2017 for defrauding victims of over $1.5 million through various investment frauds. He was released after two years, and quickly started the Crypto4Winners project after.

March 8, 2024

Unizen platform hacked for $2.1 million

(attribution)

The Unizen defi platform lost around $2.1 million in the Tether stablecoin in an attack that took advantage of a vulnerability an external call from the project smart contract.

The project team sent on-chain messages to the attacker, offering a 20% "bounty" for the return of the remaining funds.

March 5, 2024

WOOFi hacked for $8.75 million

(attribution)

An attacker was able to use a flash loan attack to manipulate an oracle on the WooFi DEX implementation on the Arbitrum network. By manipulating the price of $WOO, they were able to steal around $8.5 million.

Blockchain security firms detected the attack quickly, and the project team paused the project's smart contract within fifteen minutes, but not before the millions were stolen. They contacted the attacker via an on-chain message to offer a 10% "bounty", later threatening that they had a "strong lead that we think will soon reveal the identity of the exploiter".

Woofi, Rekt [archive]
"WOOFi sPMM exploit post-mortem", WOOFi [archive]