Another day, another victim loses 350K in Phishing Scam. Funds can still be returned!
3 min read
Victim
0x7453275ad8cacf3a44d19bd10e5b6a2832b05fc3
Hacker wallets
0x1a42605d92c210e4be47a6363046c591659ab444 – Scammer 1 0x000000093E55f433Fb57a32AA5d5Fe717B3f7AB1 – Scammer 2 0x50c47a3b581bf242e908335eec081f0fe6ceeaa9 – Scammer 3 0x76cf09ab182c6bd47b980f7d6dacbda1d6705f37 [Intermediary Wallet]
This hack happened hours ago. I noticed Scam Sniffer tweeted about it so I decided to do a quick investigation.
Looking at the interactions of 0x1A42605D92C210E4bE47A6363046c591659ab444 – Scammer 1 I can see a few outgoing txns to – 0x075e8370eAdA21803b909b73D5438c07197abA8a
That wallet was funded by 0x43b1c949123b3FD644Fc39Ff04F0624826D64E16 which was funded by 0x009515EfabCcdBAfA485f3919d94C85Ff23Ba75D. Below is a better visual.
– 0x075e8370eAdA21803b909b73D5438c07197abA8a — 0x43b1c949123b3FD644Fc39Ff04F0624826D64E16 [funded above]
—0x009515EfabCcdBAfA485f3919d94C85Ff23Ba75D [funded above]
0x009515EfabCcdBAfA485f3919d94C85Ff23Ba75D is a known hacker/scammer wallet connected to this hack. The below scam literally took place two days ago.
Arkham has a label of Lazarus Group, but I think that needs more investigation to confirm
I did notice a COBO deposit address connected to the hacker group 0x9EC6f0a0265d015453a334EE07F0f4E2dC199268 with 543K in assets sitting in it. I HOPE this deposit address is already frozen, there’s a chance these assets can be recovered!
0x000000093E55f433Fb57a32AA5d5Fe717B3f7AB1 – Scammer 2 has mutliple interactions with a couple of TradeOgre Deposit address.
0x674d4fcBEE75d9D64F30d23D27F9238aCd22E3Ac 0x7c6c95578D7DAFc9e2E0C8AbC9a669E51e064768
0x76cf09ab182c6bd47b980f7d6dacbda1d6705f37 [Intermediary Wallet] was funded by 0x53BD30522DDF7D565e81F1f1a5d821Dc2c9Ce011 3 months ago.
0x53BD30522DDF7D565e81F1f1a5d821Dc2c9Ce011 is showing 8 deposits to a Kraken Deposit address of 0xE7b2D82b4007eDe7CAFA4D0d0f58812362778402
I’ll update as more information comes in but this is one of those rare cases where funds can still be frozen at the exchange level as I write this.
submitted by /u/jbtravel84
[link] [comments]
