Webaverse’s co-founder claimed that their cryptocurrency was stolen from their Trust Wallet at a meeting with two persons purporting to be investors.
After meeting with fraudsters acting as investors in a hotel lobby in Rome, the co-founder of Web3 metaverse gaming engine “Webaverse” stated they were victims of a $4 million coin heist.
According to co-founder Ahad Shams, the particular component of the incident is that the cryptocurrency was taken from a recently established Trust Wallet and that the theft occurred during the meeting.
He argues that the burglars could not have seen the private key because he was not linked to a public WiFi network.
According to Shams, the hackers gained access while photographing the wallet’s balance.
The letter, released on Twitter on Feb. 7, includes comments from Webarverse and Shams, who explain that they met with a guy named “Mr. Safra” on Nov. 26 following many weeks of negotiations about future finance.
“We communicated with “Mr. Safra” via email and video chats, and he expressed a desire to invest in interesting Web3 startups,” Shams stated.
“He said that others had previously cheated him in the crypto space, so he obtained our IDs for KYC and established as a necessity that we travel into Rome to see him since it was vital to meet IRL to ‘get comfortable’ with who we were individually doing business with,” he continued.
Despite his initial “skepticism,” Sham consented to see “Mr. Safra” and his “banker” in person in a hotel lobby in Rome, where he would subsequently demonstrate “proof of funding” for the project “— which Mr. Safra said was required for him to start the “paperwork.”
“Although we reluctantly agreed to the Trust Wallet’proof,’ we opened a new Trust Wallet account at home on a device we didn’t use to connect with them. We reasoned that without our secret keys or seed phrases, the monies would be safe in any case, “Shams said.
Sham, on the other hand, was utterly wrong:
“When we met, we sat across from these three men and transferred 4m USDC into the Trust Wallet. “Mr. Safra,” asked to see the balances on the Trust Wallet app and took out his phone to “take some pictures.”
Shams claimed it was OK because “Mr. Safra” received no secret keys or seed phrases.
However, when “Mr. Safra” took a photo and left the meeting room to talk with his banking colleagues, the team departed, and Shams discovered the monies had been taken off.
“He was never seen again. The money was gone from the wallet minutes later.”
Almost immediately, Shams reported the theft to a local police station in Rome. A few days later, he submitted an Internet Crime Complaint (IC3) form to the U.S. Federal Bureau of Investigation (FBI).
“The interim report from the current investigations is that we are still unable to pinpoint the attack vector accurately,” Shams stated. The investigators have analyzed the available material and conducted lengthy interviews with the relevant individuals, but more technical information is required for them to reach confident judgments.”
“Specifically, we require further evidence from Trust Wallet detailing activities on the wallet that was depleted to draw a technical judgment, and we are currently pursuing them for their records. This will most likely give us a clearer understanding of what happened,” he continued.
Shams verified to Cointelegraph that he was not connected to the hotel lobby’s WiFi when he showed the monies on his Trust Wallet.
On July 21, 2021, the Webaverse co-founder believed the vulnerability was similar to an NFT fraud scenario given by NFT entrepreneur Jacob Riglin.
Riglin said he met with possible business partners in Barcelona, demonstrated that he had adequate cash on his laptop, and drained the funds within 30-40 minutes.
Shams has subsequently published the Ethereum-based transaction that abused his Trust Wallet, stating that the cash was promptly “divided into six transactions and delivered to six new addresses, none of which had any prior activity.”
Using 1 inch’s swap address function, the $4 million in USDC was nearly totally changed into Ether (ETH), wrapped-Bitcoin (BTC), and Tether (USDT).
Shams stated that “the occurrence bothers me to this day” and that the $4 million hack is “unquestionably a setback” for Webaverse.
He did, however, emphasize that the $4 million exploit and ongoing investigation will not affect the company’s short-term commitments and plans:
“We have sufficient runway of 12-16 months based on our current forecasts and we are well underway to deliver on our plans.”
Cointelegraph has also contacted Trust Wallet for comment.
