$71M WBTC Stolen: Scammer Returns Some Funds, Seeks Victim on Telegram

In a recent high-profile cryptocurrency theft, a scammer who orchestrated a poisoning attack stole $71 million worth of Wrapped Bitcoin (WBTC) and subsequently made an unusual attempt to contact the victim directly through the Ethereum blockchain.

The scammer initiated contact with the victim, requesting their Telegram contact details before transferring over 51 Ethereum (ETH), which was approximately valued at $151,600. 

Elaborate Poisoning Attack Nets Scammer $71 Million

The theft occurred on May 3rd, when the scammer transferred 1,155 Wrapped Bitcoin (WBTC), valued at approximately $71.1 million, to a fraudulent address. This incident, revealed through on-chain transfers visible on the Etherscan blockchain explorer, resulted from a deceptive tactic where the hacker created a wallet address closely resembling the victim’s.

The attacker utilized vanity address services or address mining to produce a similar-looking wallet and bombarded the victim with multiple transactions. This spamming strategy is designed to confuse the victim, leading them to mistakenly copy the hacker’s fake address instead of their own, effectively redirecting their funds to the attacker.

Following the realization of the theft, the victim demanded on May 5 that 90% of the stolen funds be returned, emphasizing the traceability of the stolen WBTC and the futility of attempting to launder such a large sum. In response, the scammer transferred 51 Ethereum (ETH), equivalent to about $151,600, back to the victim, which represented only 4.2% of the demanded amount. This return was accompanied by a request for direct communication, where the scammer asked the victim to provide contact details on Telegram for a follow-up discussion, promising to call the next day.

#PeckShieldAlert The scammer took ~$71 million worth of WBTC through a poisoning scam and has now sent 51 ETH to the victim, along with a message pic.twitter.com/GL1I6eubWf

— PeckShieldAlert (@PeckShieldAlert) May 9, 2024

Deadline Set, Traceability Underlined

The victim, aware of the complications involved in tracking and recovering the stolen funds, set a deadline for the scammer, giving them until 10:00 am UTC on May 6, 2024, to comply with the demand. The victim firmly stated that there was no possibility of reversing the theft or cleansing the tainted funds, underlining the inevitable traceability of the blockchain.

Wrapped Bitcoin, the asset central to this scam, is an ERC-20 token pegged to the price of Bitcoin. Despite the turmoil, WBTC maintained a market value of $62,410, marking a slight increase of 0.26% over the past 24 hours from the time of the report.

This interaction marks a rare instance of a scammer engaging in direct communication and partial fund return in a case involving such a significant amount of stolen cryptocurrency. The reasons behind the scammer’s actions—whether it indicates a willingness to negotiate or an acknowledgment of the challenges in utilizing the stolen assets—are still not entirely clear. Meanwhile, the crypto community continues to monitor the situation, as this type of scam and the subsequent interactions are not commonly observed in the realm of digital asset theft.