揭開一宗巧妙的加密錢包竊取詐騙案

探究竊取行動的方法與對加密社群的影響

最近，一宗巨大的加密錢包竊取行動曝光了，該詐騙案自 2022 年 12 月以來一直針對有經驗的加密貨幣用戶和行業內部人士。
透過 11 個以上的區塊鏈，竊取了超過 5,000 個以太幣 (ETH) 和未知數量的代幣、不可替代性代幣 (NFT) 和貨幣。這宗詐騙案讓社群一片茫然。

For the past 48hrs I've been unwinding a massive wallet draining operation 😳😭

I don't know how big it is but since Dec 2022 it's drained 5000+ ETH and ??? in tokens / NFTs / coins across 11+ chains.

Its rekt my friends & OGs who are reasonably secure.

No one knows how. pic.twitter.com/MafntG7RkP
— Tay 💖 (@tayvano_) April 18, 2023

根據分析，攻擊者從超過一年前獲得的數據庫中有系統地竊取了私鑰，並表現出明顯的竊取模式和在區塊鏈上的資產移動模式，經常在多個受害者地址之間移動資產。
攻擊者在 2022 年 12 月時使用 RenBridge 進行大量的竊取行動，最終將竊取的資產轉移到比特幣 (BTC) 上。
攻擊者利用像 FixedFloat、SimpleSwap、SideShift、ChangeNOW 和 LetsExchange 這樣的中心化交易所進行資金洗錢，然後將它們轉移到 Coinomize、Wasabi 和 CryptoMixer 這樣的隱私聚合區塊鏈。

6. "Out" is always a centralized swapper such as:
FixedFloat
SimpleSwap
SideShift
ChangeNOW
LetsExchange
Unknown swapper @ 0xca60
Other unlabeled swappers nested at Binance

Large Dec'22 thefts used RenBridge

Final desty is always Bitcoin

LTC, XRP, XMR, etc also moves to BTC.
— Tay 💖 (@tayvano_) April 18, 2023

令人驚訝的是，受害者之間有許多共同點，例如創建密鑰的時間在 2014 年至 2022 年之間，比大多數人更加熟悉加密貨幣的使用（例如擁有多個地址和在該領域工作）。

Afaik, no one has determined the source of their compromise.

Multiple devices have been forensic'd. Nothing.

The only known commonalities are:
– Keys were created btwn 2014-2022
– Folks are those who are more crypto native than most (e.g. multiple addresses, work in space, etc)
— Tay 💖 (@tayvano_) April 18, 2023

這個詐騙案並未影響到任何新手，而是特別針對只有單一秘密恢復短語或私鑰的有經驗用戶。
為了防止這樣的詐騙，加密貨幣社群必須優先考慮教育和意識。
用戶應該避免將所有資產都存放在單一的秘鑰或秘密短語中，並應該遷移到硬體錢包上。

I'm tired af but I'll lay out some details of the attacker below.

Really the ONLY thing you need to read is this:

PLEASE DON'T KEEP ALL YOUR ASSETS IN A SINGLE KEY OR SECRET PHRASE FOR YEARS. THE END.

Split up your assets. Get a hw wallet. Migrate. Now.
— Tay 💖 (@tayvano_) April 18, 2023

且錢包竊取行動在竊取的時間模式上表現出奇特的模式。
許多竊取似乎發生在週末，特別是在週日發生的重大事件。

9. Dust remaining in original drained address and/or from other keys under the same seed have been stolen 80+ days after first address was drained.

Known large dust collections from already drained accounts occured on:
Feb 15
Feb 17
Feb 22
Mar 23
Mar 26
Apr 6
— Tay 💖 (@tayvano_) April 18, 2023

大規模的竊取似乎是腳本撰寫的，而在最初的被竊地址中剩餘的「dust」已經在第一個地址被竊取後 80 天以上被盜。
攻擊者的 IP 和用戶代理 (UAs) 非常多樣化，經常使用 VPN、代理和其他方法來掩蓋他們的真實身份。

2. Secondary thefts and "dust" collecting occurs anytime but usually 4pm-10pm UTC.

Follow-up drains (for assets missed on the initial sweep) usually occur ~4hrs after the initial theft or at ~7am UTC the following day.

Sometimes accounts are re-swept weeks or months later.
— Tay 💖 (@tayvano_) April 18, 2023

通過研究詐騙者的方法、受害者之間的共同點、時間模式以及了解預防措施的重要性，社群可以更好地保護其資產。合作、教育和警惕在減輕風險和恢復對數位資產安全性的信心方面至關重要。

文章出處&參考

文章觀看次數: 150