By: Liz, slow fog

background

Recently, CYBER RESCUE fished the victim under the guise of “can help recover/recover stolen funds” under the guise of “helping recover/recovering stolen funds” under the guise of “it’s possible to get rid of the stolen funds.”In response to this situation, the Slow Fog Security Team reversely phished the scam and disclosed its fraud process, hoping that the majority of users would be vigilant and avoid being deceived.

The fraud process

As a victim, we contacted CYBER RESCUE, who claimed to be able to recover stolen funds 100%. The following is the fraud process of the fraudster:

1. CYBER RESCUE first asks the victim about the time of the stolen, the wallet used and the reasons for the stolen, and then says that the stolen funds can be recovered 100%. The method is to process the transaction through USDT under the BNB smart chain network and the stolen funds will be processed.Redirect to the victim’s wallet.The victim needs to download MathWallet, which the scammer explained was to guide the victim to transfer the user settings and redirect the funds to the victim’s wallet.

2. The scammer then asked the victim to click “Add Custom Asset” on the homepage to guide the user to enter the USDT contract 0x55d398326f99059ff775485246999027b3197955 (the contract address is correct). At this time, MathWallet will automatically recognize that the token has an accuracy of 18.

At this point, the scammer emphasized: when pasting the contract address, change Decimals from 18 to 0.Thus the victim added a USDT token with correct contract but incorrect precision.Here we explain what Decimals is (decimals). In tokens, Decimals represents the number of minimum scatterable units of the token, which determines the accuracy of the token in transactions and calculations.The higher the value of Decimals, the higher the accuracy of the token.

After the victim did as he did, the scammer said that this would be fine. He wanted to freeze the stolen funds and return them to the victim’s account. Now the victim needs to provide a metamask wallet (MetaMask wallet).Because the translation software translated the MetaMask wallet into a metamask wallet, this confused the victim and the scammer was shocked. You don’t have a MetaMask wallet?

3. At this point, the scammer began his magical operation of “retrieving” the stolen funds:

After the scammer checked the stolen transactions we provided to him, he said that he could only recover $89,589 of the stolen funds. The reason he gave was that the remaining funds had entered the foreign exchange market and were converted into local currency.

The scammer then asked the victim to send a screenshot of the MathWallet Account and reminded the victim: Please stay online, success or failure will be the first to do so.This sentence is somewhat confusing. The victim has lost money. The scammer’s supervision at this time will make the victim think about seizing this opportunity to recover the money. How could he realize that he was about to fall into another trap?.

The scammer asked the victim to click on the Export Private Key in Manage Wallet to guide the victim to copy the private key to him.The scam’s explanation of the need for a private key is to connect the app to redirect transactions to the victim’s wallet.If the scammer’s previous operations did not arouse you, but now he cares about your private key, run away!

The victim sent the private key to the scammer.Soon, the scammer said that the operation was done and he could check his wallet.The victim looked at the wallet and found that the number of USDTs did turn into 89589 that the scammer just promised to recover. What’s going on?

Query on the block browser and found that the number of money transferred by the scammer to the victim was 0.00000000000000089589 USDT.This is because the victim previously changed the Decimals of the custom token in the wallet from 18 to 0 under the guidance of the scammer. Therefore, although the number of transfers by the scammer to the victim is 0.00000000000000000089589 USDT, the victim’s wallet will show that 89589 USDT is received.

(https://bscscan.com/tx/0x00901c40073dc1ec64041a3aee689874406fdb1bf7b112a6c380ec3839d6a8e5)

The scammer has already cheated on his private key. How do he make a profit next?He told the victim that he needed to have enough BNB available balance to execute transactions to other accounts, which should be 10% of the initial balance in the BNB smart chain network.If the victim believes it, transfer the BNB worth about $8968 into the wallet as required, and it will be stolen by the liar.

We used a block browser to view the scammer’s address (0xe27126d1c17B42Eb42783655D339a782f779BABA) and found that the address was frequently transferred to other addresses in small amounts, which means that the scammer continued to use this fraud to commit crimes.

(https://bscscan.com/txs?a=0xe27126d1c17B42Eb42783655D339a782f779BABA&p=1)

Use MistTrack(https://misttrack.io/) to query the address, and you can see that the source of the handling fee for this address is Binance.MistTrack has blocked the relevant addresses and will continue to monitor abnormal funds.

MathWallet Update

After receiving feedback from the case, MathWallet immediately fixed and released a new version, banning users’ manual modification of precision.Users who have already installed MathWallet should upgrade in the App Store or Google Play.

Summarize

There are endless scams in the dark forest of blockchain. The scammers in this article even pretend to be on-chain tracking experts and phish the stolen victims. During the fraud process, it can be said that they teach the victims how to give the private key step by step.The Slow Fog Security Team hereby reminds users to be vigilant. No matter what identity the other party is approaching you, do not give a private key and beware of being stolen.If your cryptocurrency is unfortunately stolen, we will provide free community assistance services for case assessment, only if you submit your form in accordance with the classification guidelines (stolen funds/scam/scam ransomware).At the same time, the hacker address you submitted will also be synchronized to the InMist Threat Intelligence Cooperation Network for risk control.(Note: Submit the Chinese form to https://aml.slowmist.com/cn/recovery-funds.html, and submit the English form to https://aml.slowmist.com/recovery-funds.html)