This Crypto Trader Lost $35 Million in Minutes — Here's How

Blockchain security platform Scam Sniffer recently revealed a crypto trader who lost $35 million in minutes. This trader is said to have lost this sum

A crypto trader has lost a staggering sum of $35 million in just minutes, falling victim to a social-engineered crypto scam. This incident serves as a stark reminder of the prevalence and sophistication of such scams within the crypto domain.

According to a recent X post by blockchain security platform Scam Sniffer, the crypto trader lost a total of 15,079 fwDETH ($35 million) after signing a “permit” phishing signature. These funds were then promptly sold off by the scammers, causing the price of dETH to experience a rapid decline.

This scam is also said to have led to attacks on protocols like PAC Finance and Orbit Finance. The ‘Permit’ feature was introduced on the Ethereum network via the Ethereum Improvement Proposal (EIP) 2612 to help address the inconvenience of having to pay gas fees multiple times.

This permit function enables traders to sign an approval message off-chain, essentially allowing them to carry out gasless transactions. However, as evident in this incident where a crypto trader lost $35 million, one downside to these Permit signatures is that they are more vulnerable to social-engineered scams, unlike when conducting onchain approvals.

Scammers can easily trick users into granting approvals by making it seem like they are simply signing into a website when in reality, they are granting approval for their funds to be moved out of their wallets. Additionally, unlike warning signs that are displayed when signing an onchain approval, there are none for Permit signatures.

Phishing Scams Remain The Common Form of Attack In Crypto

Phishing scams continue to be one of the most prevalent social-engineered attacks in the crypto space, and Scam Sniffer drew the community’s attention to how the KOR Protocol’s X account was recently compromised and used to post phishing tweets. They noted that these phishing tweets from notable X accounts are often the result of social engineering attacks that authorize malicious apps.

According to Scam Sniffer’s September Phishing Report, approximately 10,000 victims lost nearly $46 million to crypto phishing scams. At the same time, the third quarter of this year saw up to $127 million in phishing losses, with an average of 11,000 victims each month. Two victims are said to have accounted for $87 million of these losses.

Interestingly, one of the victims lost $32 million by signing a permit signature, similar to this crypto trader, who lost $35 million. Another trader lost $1 million by copying the wrong address from a “contaminated transfer history.” Scam Sniffer revealed that most of the phishing attacks were procured by clicking on phishing links from fake accounts on the X platform and Google phishing ads.

The platform recently gave an example of a Google phishing ad. They highlighted a ‘Chainlist’ ad on the search engine. This ad leads traders to connect their wallets, and their wallets get drained after they sign the phishing signature.