Address Poisoner in $68M Crypto Extortion Case Returns Partial Funds, Opens Negotiations

An alleged address-poisoning attacker has returned $153,000 worth of Ether (ETH) to a victim who lost $68 million in Wrapped Bitcoin (WBTC) in a transaction facilitated through an address poisoning attack. The attacker sent a message indicating a willingness to negotiate and requested the victim's Telegram username for contact. The returned amount represents only 0.225% of the total funds allegedly stolen.

Attacker in $68 Million Address Poisoning Extortion Case Makes Partial Restitution and Initiates Negotiations

A malicious actor responsible for an address poisoning attack that resulted in the theft of $68 million worth of Wrapped Bitcoin (WBTC) has initiated negotiations with the victim by sending back a substantial portion of the stolen funds.

Alleged Extortion and Theft

On May 3, the attacker allegedly exploited an address poisoning vulnerability to trick the victim into sending 1,155 WBTC (worth approximately $68 million at the time) to their account. Address poisoning attacks involve bombarding victims with transactions that appear to originate from their own accounts, creating confusion and potentially leading to unintended transfers.

Partial Restitution and Communication

In an apparent gesture of good faith, the attacker has now sent back approximately $153,000 worth of Ether (ETH) to the victim's account. The transfer was accompanied by a communication expressing willingness to negotiate and requesting the victim's Telegram username for further contact.

Negotiation Attempt

Blockchain records indicate that the victim had previously attempted to negotiate with the attacker, offering to pay a 10% bounty for the return of the stolen funds. In response, the attacker sent 51 ETH (approximately $153,000) and conveyed a message through an Ethereum transaction, stating: "Please leave your Telegram and I will contact you."

Address Poisoning Modus Operandi

The attacker's alleged address poisoning technique involved using a custom-designed token with a malicious contract. By transferring a small amount of this token from the victim's account to their own, the attacker exploited a loophole that allowed them to subsequently withdraw a significant amount of WBTC without the victim's consent.

Security Recommendations

To safeguard against address poisoning attacks, security experts emphasize the importance of meticulously verifying the sending address in any transaction. By being vigilant and scrutinizing transactions, users can minimize the risk of falling victim to these malicious tactics.

Ongoing Negotiations

The negotiations between the victim and the attacker are ongoing, with the latest developments indicating a willingness from both parties to reach a resolution. The outcome of these negotiations and the fate of the remaining stolen funds remain uncertain.