970K Lost in Ledger NFT Scam
5 min read
A victim here on Reddit recently lost 80K across Ethereum, Solana, and Cardano. There’s a post he made a couple of weeks ago outlining the hack/scam.
I didn’t see any useful comments in the original post and he reached out to me looking for help.
I focused on the Ethereum network as this appears to be where most of the activity takes place. I’m showing about 970K lost in stolen funds with numerous victims getting caught up in this scam.
Below is my attempt to outline where the funds went as well as how the scam happened.
Ethereum Wallets
Below are the main wallets associated from the victim who lost 80K and the main scammer wallets. The wallet labeled Reddit Sweeper was used to clean out about $25 in ETH.
If it is in fact a sweeper wallet, that would mean a seed phrase compromise. Otherwise the victim may of never revoked access and the scammer could of just gone back and cleaned up a bit of leftovers a day after the scam.
0xA40731DceAE46A6bD893cebf97176a87403a26FC – 80K victim Reddit 0xcf3BA5a31A376D01EbdcCad2b84Eb40D89EEdBA7 – 80k Scammer Reddit 0xAC66519D0650Bd5163fa4a93737E660a780ACDae – 80K Scammer Reddit Sweeper?
Additional Wallets
0xcf3BA5a31A376D01EbdcCad2b84Eb40D89EEdBA7 – 80k Scammer Reddit
I marked off the below wallets as outgoing txns from the 80k Scammer wallet. Interestingly, almost all of the funds (about $950,000) are still sitting in these wallets.
There’s a strong chance of recovery if law enforcement is actively monitoring the movements of the below addresses.
0x1e2a7127A3D0Cfa1374A26523C0d4a78c5443080 – 80k Scammer Reddit 2 [590K here] 0x92d3ADaf98610454f67eD48b0c8a367677DC63B6 – 80k Scammer Reddit 3 -0x2c6F334CE794e0BA277FDd6838c27050ab19d862 – 80k Scammer Reddit 3 1 [124K here] 0xEa30e14960f3A3f996cADc1cDa2895859A430210 – 80k Scammer Reddit 4 [236K here]
Wallet of Interest
0x418f6d0EE7aDF31Eaa757105980fa446a3D66a37
0x418f6d0EE7aDF31Eaa757105980fa446a3D66a37 funded 0xAC66519D0650Bd5163fa4a93737E660a780ACDae – 80K Scammer Reddit Sweeper?
It’s possible 0x418f6d0EE7aDF31Eaa757105980fa446a3D66a37 might also be a victim. If I had more time, I’d do a deeper dive to find out who this entity is. This wallet has a user name associated with their OpenSea profile.
HitBTC Deposit Addresses
0x997Ae443C97Ad0b8A391D8F0Fa6F739C20512621 0xa2ec859DcF2a47AD1BB8Fd91e497eC489c74C4CE 0x90cBC9dd3FAbEFF9F36FF1Ca78aD00e4EB43e4Ab
These deposit addresses don’t look like they belong to 0x418f6d0EE7aDF31Eaa757105980fa446a3D66a37. It looks like he was paying for some service. Possibly accounts or gift cards as the wallets in the deposit address appear to have no relation to each other.
Wallet of Interest 2
0x1C1700B0dE3850AbA5ACfd38c3446b9b054e0715 – 80k Scammer Reddit 5
After further investigation, 0x1C1700B0dE3850AbA5ACfd38c3446b9b054e0715 – 80k Scammer Reddit 5 also appears to be a scammer wallet. I almost missed this one as this was the last incoming txn to 0xcf3BA5a31A376D01EbdcCad2b84Eb40D89EEdBA7 – 80k Scammer Reddit.
Below is a user on Twitter reporting the wallet belonging to a hacker/scammer. Interestingly this victim also mention funds getting removed from his Ledger device.
Movement of Funds
It seems the scammer took the following route to move all the stolen funds
80k Scammer Reddit 5 → 80k Scammer Reddit [154.042 ETH] 80k Scammer Reddit → 80k Scammer Reddit 2 [174.142 ETH] 80k Scammer Reddit → 80k Scammer Reddit 3 [38.674 ETH] 80k Scammer Reddit → 80k Scammer Reddit 4 [73.994 ETH]
Additional Wallets
0x04d554f7f7163226A2CdFAcf127b7d5385576E79
0x1C1700B0dE3850AbA5ACfd38c3446b9b054e0715 – 80k Scammer Reddit 5 sent 2.5K to 0x04d554f7f7163226A2CdFAcf127b7d5385576E79. There’s a number of eXch Deposit addresses.
0x211172b638F73c1bd998E9f57f82E74A10FD0ed4
0x1C1700B0dE3850AbA5ACfd38c3446b9b054e0715 – 80k Scammer Reddit 5 sent 2K to 0x211172b638F73c1bd998E9f57f82E74A10FD0ed4.
More Movement
The below can really open up the Rabbit Hole to find other hacks and deposit addresses.
How the Scam Happened
Looking at the original Reddit post from the victim and the twitter user’s post, it appears a bad actor is airdropping malicious NFTs to ledger users.
I’m not sure the exact scenario that played out, but the victims could of received an unsolicited NFT that appeared to be a voucher promising “free money”.
The voucher could say something along the lines of “You WON 5000 USDC or USDT!”
The voucher lures the victim to a website requiring you to approve the transaction. Once you sign the contract, your assets now belong to the scammer.
How to Avoid Malicious NFT Airdrops
Unfortunately, it’s very hard to avoid someone sending you unsolicited NFTs. However, there are actions you can take to avoid engaging with any of these malicious NFTs.
DO NOT ENGAGE WITH ANY AIRDROPPED NFT NEVER EVER ENTER YOUR SEED PHRASE ANYWHERE To avoid seeing the NFTs in your wallet, right click on the NFT and select Hide NFT Collection Avoid any links or websites associated with an NFT
Stay safe out there!
submitted by /u/jbtravel84
[link] [comments]
