区块链分析公司 Bitrace 警告说，扫描错误的二维码可能会耗尽你的钱包

Bitrace 警告称，存在一种新型加密货币诈骗，“通过支付二维码转账测试进行盗窃，本质上是欺骗用户授权钱包。”

A new crypto scam is targeting users with a payment QR code transfer test, deceiving them into authorizing their wallets and draining their funds, blockchain analysis firm Bitrace has warned.

区块链分析公司 Bitrace 警告称，一种新的加密货币骗局正在通过支付二维码转账测试来针对用户，欺骗他们授权钱包并耗尽他们的资金。

The scam unfolds in a specific sequence, according to Bitrace. The scammer initiates the interaction by proposing to swap tokens over-the-counter — via a wallet-to-wallet transfer instead of an exchange — offering an exchange rate that beats the market.

据 Bitrace 称，该骗局按照特定的顺序展开。诈骗者通过提议在场外交易代币（通过钱包到钱包的转账而不是交易所）来发起互动，并提供优于市场的汇率。

They also propose a fee for the transaction, denominated in Tron’s TRX token, in exchange for long-term cooperation. To gain the user’s trust, they even make a small payment of Tether (USDT).

他们还提出以 Tron 的 TRX 代币计价的交易费用，以换取长期合作。为了获得用户的信任，他们甚至支付了少量的 Tether（USDT）。

After the initial interaction, the scammer asks the user to participate in a “small repayment test,” which involves returning the USDT by scanning a QR code. However, the QR code leads to a third-party website that prompts the user to confirm the “test” transaction, and clicking “confirm” steals the user’s wallet authorization, according to Bitrace.

初次互动后，骗子会要求用户参与“小额还款测试”，即通过扫描二维码返还 USDT。然而，据 Bitrace 称，二维码会指向第三方网站，提示用户确认“测试”交易，点击“确认”会窃取用户的钱包授权。

At least 27 wallet holders appear to have fallen victim to the scam, collectively losing around $120,000 in USDT, according to Bitrace. The attacks occurred between July 11 and July 17, and the scammer used the same wallet in each instance.

据 Bitrace 称，至少 27 名钱包持有者似乎成为了该骗局的受害者，总共损失了约 12 万美元的 USDT。这些攻击发生在 7 月 11 日至 7 月 17 日期间，诈骗者每次都使用同一个钱包。

The funds were then moved through five intermediary addresses and into three accounts with Cambodian crypto exchange Huione for laundering, according to Bittrace.

据 Bittrace 称，这些资金随后通过五个中间地址转移到柬埔寨加密货币交易所 Huione 的三个账户中进行洗钱。

Cyberattacks have been on the rise in 2024. According to cybersecurity firm Cyvers, the total volume of stolen crypto funds this year is approaching $1.4 billion.

2024 年网络攻击呈上升趋势。根据网络安全公司 Cyvers 的数据，今年被盗的加密货币资金总额已接近 14 亿美元。

Access control breaches — often phishing attacks — accounted for the vast majority of stolen funds, with around $490 million pilfered in the second quarter alone.

访问控制违规（通常是网络钓鱼攻击）占被盗资金的绝大多数，仅第二季度就有约 4.9 亿美元被盗。

“A risk check on the counterparty’s address before the transaction is crucial,” Bitrace said, adding that the company is developing a “one-click risk check tool to help users identify potential risks associated with target addresses.”

Bitrace 表示：“交易前对交易对手地址进行风险检查至关重要。”并补充说，该公司正在开发“一键式风险检查工具，帮助用户识别与目标地址相关的潜在风险”。