$55 Million In Dai Tokens Stolen in Sophisticated Phishing Attack

• Dai Tokens Worth $55 Million Stolen in High-Tech Phishing Operation

Amid the ongoing crypto market volatility and midterm uncertainty, a Web3 user has fallen victim to a phishing attack, resulting in more than $55 million loss. 

According to an on-chain data analysis conducted by Certik Alert, the attacker, alias Fake_Phishing187019, minted 55,473,618 Dai tokens and immediately began laundering them through different channels.

#CertiKStatsAlert 🚨

Combining all the incidents in July we’ve confirmed ~$270.9m lost to exploits, hacks and scams after ~$7.8m was returned.

The amount is the second highest monthly loss so far in 2024.

Exit scams: ~$3m
Flash loans: ~$265.8m
Exploits: ~$9.8m

More details… pic.twitter.com/FCXNe4sGiu

— CertiK Alert (@CertiKAlert) July 31, 2024

Reportedly, the attacker managed to drain the $55 million crypto assets by accessing externally owned accounts (EOAs), which operate more or less like normal bank accounts. Furthermore, the owner of EOAs possesses a public key paired with a private key not known to other parties. 

Further analysis of the attacker’s address reveals a high determination to conceal and launder as many funds as possible in different amounts. For instance, the attacker sent around $36 million to a single address and then sent $17.5 million to CoW Protocol earlier today. 

Meanwhile, the attacker had already begun swapping the assets to Wrapped ETH and BTC  by depositing the funds to Uniswap V3.

Rising Web3 Attacks Via Phishing Scams

The Web3 industry has suffered from its extensive success in the past few years. Sophisticated tech has been used to compromise weak security designs for different Web3 platforms. 

According to Certik Alert, more than $270 million was lost from different web3 projects in hacks, exploits, and scams, while the attackers only returned $7.8 million in July. 

#CertiKInsight 🚨

Inferno Drainer (Fake_Phishing187019) set the owner address of a Maker vault to 0x5d4b2a02c59197eb2cae95a6df9fe27af60459d4 and minted 55,473,618 Dai tokens (~$55M) to it.

Stay Vigilant! pic.twitter.com/q4Q91CP1lR

— CertiK Alert (@CertiKAlert) August 21, 2024

The WazirX hack, which resulted in the loss of over $230 million, left more retail investors devastated after the attacker deposited the funds into Tornado Cash.

Earlier this week, 4,064 Bitcoins, worth about $238 million, were stolen from a victim and quickly transferred to THORChain, eXch, KuCoin, ChangeNow, Railgun, and Avalanche Bridge.