Scammers steal $4 million in crypto during face-to-face meeting Ahad Shams, the co-founder of Web3 metaverse gaming engine startup Webaverse, discovered in late November 2022 that someone had stolen $4 million of his cryptocurrency – during a real world interaction. Stolen crypto isn't unusual: billions of digi-dollars were stolen last year, some by crime gangs or nations like North Korea …
You want proof of funds ? I can provide you with a printout of my bank account balance.
I can even give you my IBAN number, for all the good it will do you.
If that is not enough, I can point you to my bank, where you can phone and ask questions yourself. But you won't be getting a cent either before, during or after the meeting. Not unless I actually transfer money to you, and why would I do that ?
Only in the funny-money universe can you feel obliged to actually give someone you don't know your own money just to prove that you have it.
Didn't need to be Escrow as *no funds were apparently moved beyond the control of the owner*.
The question is only how the scammers gained control of the wallet. It seems that everything was done correctly but the scammers were always one step ahead ... which, to be honest, is the sign of a very good scammer.
Probably luring the victim to Rome, to a certain hotel, cloning his/her hotel room key, or the rfid, or bribing the cleaning lady...
Then, using old-fashioned spying micro cameras or malware, they got the images of the seed phrases necessary to make the transfer of funds to happen.
Better to have camera detectors before conducting cryptocurrency transactions, plus a fresh and clean PC / Macbook.
Probably luring the victim to Rome, to a certain hotel, cloning his/her hotel room key, or the rfid, or bribing the cleaning lady...
Then, using old-fashioned spying micro cameras or malware, they got the images of the seed phrases necessary to make the transfer of funds to happen.
Better to have camera detectors before conducting cryptocurrency transactions, plus a fresh and clean PC / Macbook.
according to the article, Shams created the new Trust Wallet while still *at home* before the meeting using a "device that Webaverse didn't typically use"... my understanding is also that the hotel lobby was just a convenient public place to meet... Shams wasn't staying there...
the article does not say what the "device that Webaverse didn't typically use" was... that makes me wonder if the device was maybe intercepted in-transit and replaced with a modified one before Shams received it... i also wonder about possible wifi traffic interception to/from the device where the thieves recorded and decoded the traffic and/or maybe stole some session token(s)...
granted, there's not a lot of detail given which is also understandable... we (TINW) don't really want the thieves knowing that their process has been cracked before they are run down... hopefully Shams or someone with him had the wherewithal to get some video/pics and voice recordings of the people they met with...
anyway, those are my initial thoughts during 1st c0ffee of the day...
I suggest a key part of this is having the wallet open . Would not be surprised if there was a NFC/Bluetooth exploit. The other out-of-band exploit would be to assume the local cell had been compromised and the bringing together of the two phones into close proximity facilitated identification etc..
The other interesting thing is the request to use a Trust Wallet ie. a specific wallet, so there might be an insider involved...
Plenty of people fall prey to fiat scams involving them logging into their bank accounts while a scammer watches, most commonly in the refund scam. In fact, it would be easier to provide secure proof of funds with a blockchain currency because you can simply give your address and transfer a tiny amount from that wallet into a designated one (absolutely no need to transfer the entire balance) in a way that's far harder to fake than a balance sheet. The balance is publicly viewable and the small transfer demonstrates control.
I have been involved in a number of startups, three with successful exits (1 IPO, 2 acquisitions). While raising funds, I have never had a prospective investor ask for proof I already had money. Never. For B & later rounds, any new investors could talk to the existing investors (& often needed to be approved by the existing investors). For A-round investors, the whole point of getting investing is because you don't have the resources to boot strap the company. (Although in one case, we did boot strap the company and never needed outside investment.) If some prospective investor wanted to see our bank account, we'd have told them to take a hike.
WTF? For what sane, non-scam reason would a potential investor be required to show "proof of funds"?
If a potential investor says, "I will deposit one meeelyun Euros into your fund", and does not do so, then that potential investor will not receive interest on that (non-existant) investment, and everything is fine and fair.
It wasn't the investor that was showing proof of funds, but the investee?
How did that conversation go? "Yes, I want to invest in your company! But before I do, show me your company has $4 million in crypto by transferring it all to a new wallet and then showing me the balance?"
Like WTF? Honestly, they deserved to get scammed, by going along with something so insane and dodgy sounding.
The part where they had to prove crypto was a bit weird, but proof of funds in general is less weird. Startups aren't filing public statements about internal information, and they're things that need more diligence when you're going to invest in them, because scams are a lot easier and failure much more likely. As such, if a company claims to have a bunch of money available but it also wants yours, it's reasonable to check that they have the money, for the same reason that it's reasonable to check that they have the level of technology they claim to have. Doing that by showing a crypto wallet on a screen, a UI that is easy to fake, is the weird part of this.
I can see it, because a new investor would want to make sure he wasn't the only one investing money. If I was a scammer going after an investor, I'd talk about how we have X investors and Y money, but we still need Z money to start production. Investor deposits Z money, I retire to a nice tropical island because Z money is now ME money, matey. Arrr, arrr, arrr.
Cryptocurrency has just become criminal financing in recent years - I thought it was a great idea when cryptocurrency first appeared but it seems that a huge amount of criminals also thought the same thing. I've quit cryptocurrency 100% now to avoid the risks that this story describes - returning to checks, bank-transfers and credit cards is depressing but much safer and nowhere near are expensive as $4 million these days.
returning to checks, bank-transfers and credit cards is depressing
Is anyone still writing (sic)checks? I last saw my cheque book many years ago when I burnt it along with other old documents in a bonfire. I think in the 40 years that I've had a bank account I've only ever written a dozen cheques and none in the last 30 years.
That's great - 1980 had everyone worshiping David Bowie so some great memories of the days back then!
Money with excited criminals has been around for more than a thousand years now, but originally it was not as common as the events that we see these days. Highwaymen have not been seen since the late 19th century but now emailwaymen are back in the world.
Worse, I parked at a university last year and they ONLY have pay by phone and pay by app. BOTH have a surcharge so it's actually impossible to pay the advertised parking charge without paying one or other (different!) surcharges. I'm sure they must be breaking some law or other with that.
I think I did that when I was a student or in my first job or something at the end of the month. I had no money in my account so couldn't pay with my debit card, but the cheque guarantee card (the same physical thing as the debit card) guaranteed the cheque, but as they took five working days to clear you knew you'd have the money in your account by then.
Is anyone still writing (sic)checks?
Not if it can be avoided, but sometimes it can't. In our US state, some local taxing authorities still only take payments by paper check -- and if we want it credited properly (which we do), we also have to include the tear-off coupon from the bottom of the paper bill when we send our payment by snail mail. (This also means we still have to have postage stamps...)
Wait, there's more. Seemingly every criminal in the US has keys to the postal drop boxes now, so we also have to drive to the post office and physically carry the envelope inside the building to mail it if we don't want to risk having the payment stolen (which we don't). Note: the linked article is from three years ago; the problem has gotten worse since then.
The above is not satire. This is something that we still have to do in the year of our Lord 2023, in {Jeremy Clarkson voice, although he would never say this about the US} "the greatest country...in the woooorld" -- at least for certain agencies that remain deeply stuck in the 1970s.
Also, many of the small contractors that we've hired to do work on our house don't take credit cards because of the transaction fees; nor do they use Venmo and its ilk, I suppose out of concern for being scammed or ripped off. So, checks for them as well.
Not if it can be avoided, but sometimes it can't. In our US state, some local taxing authorities
JFC...
Have they not heard of Direct Debit (or whatever you guys call it). I think the only bill I've ever paid differently was my Credit Card back in the day when I'd sometimes settle that at the bank. But once I got a decent salary and savings built up even that switched to DD. Admittedly that's perhaps a little unusual but even if I wasn't paying it off in full every month I'd be paying by DD.
The idea of actually having to do something to settle a bill is weird.
Local traders here provide an invoice and you settle with online banking. Although some (eg; my physiotherapist and taxi drivers) also have card readers you can settle that way instead.
If it sounds sensible giving someone your bank details and authority to charge an account in which you routinely keep money, then knock yourself out. I used them for a decade or so before realising that the beneficiaries were either dead easy to hack or took actual liberties.
"Seemingly every criminal in the US has keys to the postal drop boxes now, so we also have to drive to the post office and physically carry the envelope inside the building to mail it"
No problem there for me. I have all mail and shipments go to the post office. I'm at the post office a couple of times a week as nothing goes to the house. Too many two-legged rats around and I still do some journalism work time and again. I don't want anything at the house if I'm going to be gone for a couple of days on short notice. My SatNav has most of the post offices in the area programmed in. I saved them since the software also shows postal buildings with no public service. If I've sold something on eBay and I'm also going to be out for the day doing field service work, I might drop the package off in another town. It's really a matter of having a system to combine trips and make sure things get done. For things like property tax, I go in-person and combine that with some shopping since I'm rarely in that city. I want to leave the window with an official receipt of payment and be able to make sure it has been credited to my property. To do it online is a bizarre back and forth between websites as the government outsources everything. I worry that the process will get corrupted somewhere and I'll be delivered a notice that I owe 6-7x the value of the property in penalties and fees that I need to pay within 14 days or they'll seize and auction the house. Could I fight? Sure, just post the money they say is owed and be patient for a couple of years. These things take time.
Yes.
Pay a few things via post using cheques (generally invoices which are sporadic & variable amount & need me to double check* them before payment and so not really suitable for direct debit being set up) as I don't do online / phone banking & all the bank branches are shut down near me so difficult to go in and arrange a transfer (and banks don't like opening at weekends either so screwed when working Mon - Fri)
* pun intended
Is anyone still writing (sic)checks? Yes. I write at least two every month to utilities and receive them from customers. My bank does not charge me to process them or write them, there is no transaction fee going to a third party like with a debit or credit card. There is a risk accepting a check that the funds will not be sufficient, but in thirty years of business, I have only been stiffed once.
Every time I deal with the government, who wants to charge a 3 percent convenience fee to use a card. I also use a check when paying medical bills, because I don't trust them to not slap on thousands rather than deal with my medical insurance provider. Any time I want to send money to the kids. The written check may not be what it once was, but there are still valid uses for it.
"Is anyone still writing (sic)checks? "
It's not a bad practice to sit down with paper bills and write out paper checks. It burns into the mind where all of the money is going. It's too easy to kill your bank account by a thousand cuts if you just whip out the plastic for lots of little things. I also give myself a budget when I'm out and about by putting cash in my pocket so when it's gone, that's it for the day. I have to stop and think if buying a packet of crisps is going to leave me short to go out for lunch even if I only have water to drink. Obviously, I wasn't making my house payments with cash when I had them. I needed to always make sure I had a good paper trail for that. Same for utilities.
And most people remained skeptical about the whole crypto business from day one, simply because it was obvious it would be used by crooks hiding their money transfers, and since it had so much secrecy involved how would any little guy know who to trust ? So while I had always been fascinated by the whole thing, it screamed ILLEGALITY to me !
I missed that. Thanks for pointing it out.
A man in-the-middle ploy might still be able to intercept the current security token, which combined with the picture, might get them access. The location could have been chosen (whose chose it?) for its bad cell reception and the ability to setup a rogue hot spot. Obviously not a good idea to rely on restaurant WiFi but there was a security failure somewhere.
I don't know if NFC or Bluetooth are more likely but the criminals risked meeting in person so proximity and/or location were key.
It could also be a red herring. For a target worth 4 million, it would be worthwhile breaking into his house and office to load a keylogger and remote terminal access, then set up a meeting where you take a picture and the money's gone. Now you have the whole world trying to figure out how someone stole 4 million with a photograph while you remote into his computers and remove the keyloggers.
"It could also be a red herring. For a target worth 4 million, it would be worthwhile breaking into his house and office to load a keylogger and remote terminal access,"
It would be worth a pretty good investment to return 4mn. One could employ all sorts of tactics and experts. Some of the biggest heists have been pulled off by syndicates that have the resources to put into them.
Shirley nobody is foolish enough to carry out any form on financial transaction on public wifi?
Meanwhile in the real world - Yes of course they would, possibly through a VPN but then you are just transferring trust to an additional player which is no problem, until it is.
Seeing as the raison-d'etre of crypto-currency is to avoid regulatory oversight (or in plain English - money laundering & tax evasion) expecting people involved in crypto-currency to be honest and trustworthy is, to use a technical term, "fucking idiocy".
There's always the chance that they didn't, using instead their mobile data, only the attacker had a stingray that captured their traffic. However, there's a healthy chance that people are just unaware of security and do stupid things and this guy could have been one of them. Things that we know not to do aren't as common knowledge as they should be.
"Shirley nobody is foolish enough to carry out any form on financial transaction on public wifi?"
With such frequency that we should all be leeching money from them daily instead of working for a living.
There was a news story recently where a 6yo used daddy's phone to order up all sorts of posh snack food to be delivered. Dad was stupid enough to hand his phone to the kid as a toy and even less bright to have apps that require no authentication to place orders for things. Lucky the kid didn't take the phone down to the local car vending machine and buy that fast looking red model on the 6th floor to see the machinery go. The kid was found out when the deliveries started showing up. Dad was still stuck with the bill since they don't often let you slide for prepared food.
Since the funds were transferred out so fast, seems they already had access to the account. I expect his home PC or phone was already compromised. 99% likely once they had access to the account, they removed any spyware to hide their tracks - before transferring the funds. NFC,, could be but, that means a huge can of worms is about to burst open on NFC vulnerabilities to wallet apps, which they should have discovered by now if that was the case.
I wonder if one of these guys was involved with the creation of this Trusted Wallet thing, and either knew of or added a backdoor for this type of theft.
But I'm still laughing at the fool who lost $4 million in play money. Once again showing why crypto is not, should never be, and never will be a replacement for fiat money.
Foolish people (and even some not so foolish) have always been and will always be susceptible to scams.
reminds me of The Wizard's First Rule: "People are stupid; given proper motivation, almost anyone will believe almost anything. Because people are stupid, they will believe a lie because they want to believe it's true, or because they are afraid it might be true. People's heads are full of knowledge, facts, and beliefs, and most of it is false, yet they think it all true. People are stupid; they can only rarely tell the difference between a lie and the truth, and yet they are confident they can, and so are all the easier to fool."
granted, it is from a fantasy novel series (yes, i've actually read the first 13 books in the series) but all of the Wizard;s Rules do actually fit in today's world and they make a lot of sense...
"reminds me of The Wizard's First Rule: "People are stupid; "
They are lazy too. Advertise convenience and the ability to get things they want with the least amount of effort and they'll beat a path to your door. They'll never cotton on to the fact that the more convenient a financial transaction, the more likely they've sacrificed a ton of security.
"Once again showing why crypto is not, should never be, and never will be a replacement for fiat money."
If you aren't trying to evade the tax man and treaties, what advantage does crypto give you? Most large purchases and transactions still have a ton of paperwork and tracking that goes along with them. Paying my utility bills with crypto doesn't help. Neither will paying a home or auto loan. Most governments won't take it for payment of taxes, fines and fees. If you are fleeing a country and worry about being stopped and searched for currency or your bank account might have a block on it for out of country transfers, you might want to put your money in crypto and extract it in usable currency someplace else. That sort of thing hasn't been a problem for me and I'm not expecting that I'll need that sort of dodge in the future. Besides, there are plenty of ways to do the same thing without crypto that don't require obvious software and electronics.
They actually suggest that the fake KYC PDF contained malware which compromised his computer/device. What that malware did, they don't explain though! As someone has said before, the physical meet-up must have be required to make this work.
Some ideas:
1. Camera somewhere around recording scammee entering wallet passcode.
2. PDF malware got the passcode from wallet app or by recording keyboard taps or screen recording.
3. Wifi MITM attack and the wallet app either just warns (scammers bug the scammee enough to tap through the warning) or waves through any old certificate without complaining and they get the passcode that way.
2 and 3 don't look very good for the app.
If they have $4m kicking about spare, why do they want more? Sounds sus to me.
Meanwhile, wouldn't wifi snooping etc catch the login dialogue?,
Quick bit of reprogramming and the encrypted strings can be inserted into a login dialogue from a different app.
It always seemed a fairly trivial task to me.
It would seem the majority do not fully understand how wireless networks work. the signal from the local tower does not target your device, it broadcasts everything in EVERY direction. All that was needed would have been the MAC Number of his phone and to obtain that was the reason for all the earlier contacts, that had been made during the run up to that face to face meeting . . . which were to establish for certain the relevant MAC and associated code numbers for the phone. From that point all they needed to do is create a clone, using the information already obtained and required to do that. From then onwards, EVERY aspect of the creation of the new webaverse wallet would have also been set up on their clone, and that clone would not have needed to be anywhere other than within reception of the local tower. As creating a clone is a simple thing to implement, using their team to ensure everything was correctly set up; creating the wallet in the clone was entirely under the full control of webaverse, and as such was as easy as it was for the eventually scammed. All they had to do is use the fully available facilities within the clone to immediately move the funds onward under their clones full control. It is the never admitted aspect of all mobile telecommunications; the only thing that differentiates your phone from all others are the MAC address and associated settings. Indeed, it is possible to do that for EVERY such device. ANYONE could do that at any time at their convenience. All they need is the MAC address and associated settings. Period!
Yep... I keep telling HSBC about this in HK that thier shitty SMS messages about all the bank transfers can be listened into...
they say it is for security of their customers...
more like they are providing a feed to the HK government...
but they insist phones are secure devices if they have not been rooted....
I’m sorry but you seem to know very little about how https’ encryption and authentication works. Spoofing the MAC address of a device doesn’t allow you to perform a MiM attack over wifi if the app uses https encryption and certificate authentication.
“Take a few photos” I.e. Screen shots
That would suggest use of NFC…
Although bringing the phones close together might be sufficient for the victims phone to try and switch to a different Wi-Fi AP.
As to the next step of the exploit… Although, I suspect it might involve causing the wallet app to resend credentials as part of keeping the session live, hence why the specific wallet was suggested.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
