Scammer Behind Stolen $71M Worth of WBTC Starts Returning Funds

The scammer behind the 1,155 $WBTC ($71 million) stolen via an address poisoning has finally opened a conversation with its victim and commenced a refunding process after going silent for six days.

Scammer Returns 51 ETH

According to the blockchain security platform PeckShield, the scammer sent 51 ETH to the victim, along with an on-chain message.

#PeckShieldAlert The scammer took ~$71 million worth of WBTC through a poisoning scam and has now sent 51 ETH to the victim, along with a message pic.twitter.com/GL1I6eubWf

— PeckShieldAlert (@PeckShieldAlert) May 9, 2024

The message reads:

“IDM: Please leave your telegram and I will contact you.”

This suggests that a negotiation is ongoing between the scammer and the victim. The deal is likely to include a bounty reward. Notably, the victim previously offered 10% of the stolen fund in return for the money.

Meanwhile, the 51 ETH returned represent a tiny fraction of what was stolen. With ETH currently hovering around $3,000, the 51 ETH equals just $153,000. However, more refunds are expected in the coming days.

This incident, which occurred over the weekend, attracted the attention of the crypto community and sparked a wave of reactions. Lookonchain first alerted it on X (Twitter). 

Address Poisoning 

According to a detailed analysis from Lookonchain, the victim created a new address and transferred 0.05 ETH to the address. Shortly after (approximately 3 minutes later), the scammer created a new address carrying the same starting and ending letters as the victim’s own. The attacker then transferred 0 ETH to the victim, so the transfer appears in the victim’s transaction history. Users usually copy the most recent transaction details from their wallet’s history, and the middle part of addresses are hidden to make the UI look better.

Unfortunately, when the victim wanted to transfer their WBTC to the newly-created address, they mistakenly copied the address created by the scammer because both addresses were similar. The victim transferred a whopping $71 million worth of WBTC to the scammer. This has been described as one the largest address poisoning scams in the industry’s history.