A few days ago, I deposited some Tether into my favorite trading platform. I checked Etherscan
to make sure my transaction went through. But something weird was going on. Three minutes after
my transfer, zero tokens were mysteriously transferred out of my wallet. And then,
it happened again, and again, and again. Well, that’s weird. Why is someone repeatedly
transferring zero tokens? I didn’t think too much of it at the time but little did I know,
this was all a part of an elaborate scam that has stolen over 5 million dollars. It’s led
hundreds of users to lose all their money. And if I wasn’t careful, that could have been me next.
I first want to explain why I knew I didn’t actually get hacked. Yeah, it looked like I
was sending money to accounts I didn’t know of, but that doesn’t actually matter. Every token is
just a smart contract that stores numbers. When I send someone tokens, the contract just updates
some numbers. This works fine, but what if I want to do something more complex? If I go to Uniswap
in order to swap one token for another, it first asks me to approve the spend of my token on the
router. I trust Uniswap, so I confirm. This lets Uniswap transfer tokens on my behalf. So then,
when I swap, it transfers my tokens from my wallet and sends me the ones I bought. Every
token has this function transferFrom. But to actually use it, the token checks that the user’s
approval to you is greater that the number of tokens you’re transferring. By default,
all approvals are zero. So technically, this lets you transfer zero tokens out of anyone’s
wallet. But why is this even useful? This is what I didn’t understand. Maybe some people would see
these unknown token transfers and think they got hacked. But even then, they could just transfer
all their tokens to another wallet and feel safe again. And if they really did get hacked,
why would the hacker only send zero tokens? It just doesn’t make sense. I did a bit more digging
into the addresses transferring these tokens. Sometimes, the scammers directly transferred
the tokens using the transferFrom function. But most of the time, they use smart contracts
that do these transfers in bulk. The actual code of the smart contracts is unverified,
but by looking at the calldata, we can kinda see what it does. The function takes in three arrays
of length twenty. The first is a number where one means USDT and two means USDC. Then, these are
the user addresses. Finally, there are the wallets they send the tokens to. The smart contract loops
through the arrays and calls transferFrom on each of them. This lets them save money on transaction
fees. A normal transfer costs around $1, but by bundling multiple in a single transaction,
this smart contract can do twenty transfers for only $5. This adds up to a lot of money. So far,
they have spent over $50,000 on fees. They call the batch function around every minute, so this
means that on average, a person gets targeted every 3 seconds. This scam must be somewhat
profitable, or else why would they waste so much money on fees? So, I analyzed the addresses.
They’re all wallets that have recently sent or received a large amount of money. Suddenly, I
understood how the scam works. But it’s so weird, and I’ve never seen anything like it before.
Take a look at this address. Now look at this one. At first glance, they look pretty similar. Except,
this one is mine, and this one isn’t. And that’s exactly how the scam works. After I send tokens to
this wallet, they copy that address and generate their own wallet with the same first 3 characters
and last 5. They’re hoping that I’ll want to send tokens to that address later. Then, they’re
hoping I check my token transfer history to find that address because maybe I don’t have it saved
anywhere else. Then, they’re hoping I overlook the fact that zero tokens were transferred here and
copy the scam address, thinking it’s mine. Now, a lot needs to go right for this scam to work, but
it still manages to fool some people. This wallet has millions of dollars in stablecoins. One day,
they transfer half a million to their hot wallet to, I don’t know, farm in BabySwap? Right away,
they get targeted with zero transfers. Two days later, they send 300k to the same hot wallet,
or so they think. But this was only the second largest victim. Another user lost nearly a million
dollars. As of right now, 234 people have fallen victim to this scam, and over half a million
wallets have been targeted. It doesn’t matter if the vast majority of people don’t fall for
it. Because when it works, it works. The victim doesn’t even realize it until it’s too late.
This is because most people only memorize the beginning and end of an address. Also, a lot of
user interfaces abbreviate them down to the first and last four characters. So if these match up,
it seems good enough. However, not all addresses are generated by random characters. I’m guessing
the attackers are using profanity2. It’s a program that lets you generate custom Ethereum addresses.
Basically, it guesses random private keys over and over until it matches what you want. With
a typical graphics card, you can match eight characters in around 20 seconds, so it really
isn’t that difficult to generate a wallet with the same beginning and end. By the way,
the original version of profanity was vulnerable because it generated these random private keys in
a predictable manner. This led to hackers finding the private keys of hundreds of wallets. Most of
these were people who just wanted a cool-looking wallet address, but it’s led to some big losses.
Wintermute, a crypto market maker, had their wallet hacked for 160 million dollars. As long
as there is money in crypto, there will also be people trying to steal it. This scam surprised
me in how it generated custom addresses for every single target, and also just how many people they
have targeted. This scam has only existed for a few weeks, and they’ve already sent over a
million transactions. They’ve sent the most on the BNB chain because it’s cheaper, but the attacks
on Ethereum are far more profitable. They’ve also tried Polygon but with little success.
However, this idea of using Etherscan’s token detection feature isn’t new. I’m sure
you’ve probably seen the thousands of spam tokens everywhere. Some of them are legitimate airdrops,
but most of these are scams. They try to get you to open a phishing website so you connect
your wallet and sign a dangerous transaction that drains your funds. There’s a trick they
can use to make it seem more legitimate. They send the token from an Etherscan-labeled wallet,
so you think some official organization sent you these tokens. But remember that a token is just
a smart contract, so if you make the token, you can also choose who sends it. For example, 73000
wallets received this token from the official Uniswap address. Of course, Uniswap had nothing
to do with it. But once the user visited the website and connected their wallet, they would be
prompted with a transaction to, you know, “claim their airdrop”. 8 million dollars were stolen.
There’s another type of token scam that I think is actually pretty funny. Instead of making the token
lead to some fishy website, they make the token look real and add liquidity behind it. So, you
might think you got an airdrop and try to sell it. Except, when you approve the spend of that token,
it actually just uses up your transaction fees to mint a ton of gas tokens. The way gas tokens
work is you pay fees to mint gas tokens, which you can later redeem for a refund. This works
because of storage refunds. It costs a lot of gas to store data on the network, but you only have to
pay once for the nodes to store this forever. To incentivize users to get rid of unnecessary data,
Ethereum will refund half of the gas you originally paid if you erase it. You can think
of this like a battery. The scammer tricks you into charging the battery, and then they sell it.
So how profitable is this scam? It’s really not. Usually, an approval only costs 10 cents. However,
this approval costs 2 dollars. It creates 31 gas tokens, which the scammers can sell for… 28 cents.
Yeah, these scams barely make any money, but I just find it funny that some people keep trying
to approve like five times and have no idea that their transaction fees are being drained. It’s
a creative idea for a scam, but it’s really inefficient compared to other scams which can
drain your entire net worth. In the end, it’s important to understand how tokens work so you
can protect yourself against these attacks. Just because it came from somewhere doesn't mean that
wallet actually sent it. And even if it says a token is worth some amount of money doesn't
mean you can actually sell it. If you’re worried about a suspicious token, just ignore it. I mean,
if you do choose to interact with it, the worst it can do is drain your gas. Interacting with one
token can’t affect your other tokens. Actually, this technically isn’t true. There have been
a few scams where they airdrop tokens to RUNE holders. The users then go to approve the spend
of that token, and now all their RUNE is gone. This is because the RUNE token uses transaction
origin in its code, something the Solidity docs literally say you should never use. This means
that when you interact with the scam token, the transaction origin is your own wallet,
which the scam token passes on to steal your RUNE. But don’t worry about this too
much. Basically every other token avoids this. I guess, just be cautious when dealing with unknown
tokens. Same thing goes with NFTs. Overall, you can protect yourself against these scams
by being a bit more careful and thoroughly checking the addresses you send money to.
But in my opinion, the actual infrastructure behind crypto needs to change to protect its
users. Etherscan is good at marking addresses as phishing, but it often comes too late. They
should just block any token with a URL in it. They could also add a note next to an official
token transfer if it didn’t actually come from that account. They should also just hide any
token token transfer with a zero value. On the other hand, MetaMask is pretty bad at preventing
scams. It took them months to add basic scam protections, like a warning before you approve the
spend of an NFT. Other wallets have much better security features, like phishing site detection,
dangerous signature warnings, and previewed token balance changes. Instead of adding these,
MetaMask actually decided to embed a scam into the wallet itself: I’m talking about MetaMask
Swap. It charges a really high fee and also uses more gas. You can do this all for free
anyways. But what’s really ironic is that the same people running the zero token transfer
scam are also using MetaMask swap. They’ve literally paid MetaMask thousands of dollars
in fees for the privilege of clicking a button. At this point, they’re the ones getting scammed.
As I was making this video, Etherscan published an update that grayed out these zero token transfers,
which is really good. But even after this, it seems like the attackers aren’t stopping. If
anything, they’re scamming even more people. I’ve had to update some numbers in this video
because they just keep going up. Remember that this scam has only existed for six weeks. I’m
guessing that even though Etherscan fixed it, there are other wallets that haven’t. It's
clear that scams in crypto are far from over, and it's up to us to be aware and protect ourselves.