Thread by @hasufl

Yesterday a friend of mine got scammed for a pretty substantial amount in an OTC trade on Telegram. I had not seen this method before and thought others should be aware of it:

The typical workflow in an OTC trade is that you have two parties, A and B, who want to trade with each other but neither wants to send first. So they both send their funds to third-party escrow E, who will send A's funds to B and vice versa.

In this case, we also have these parties
- my friend (A)
- his counterparty (B)
- an escrow (E)

After the terms had been agreed on, B made a Telegram channel with A and E. Then E posted the deposit address into the channel, A sent a test which E confirmed, then A sent the rest.

Or so you think!

What actually happened was that B made *two* channels, one with A where they controlled B and E. And one with E where they controlled A and B.

So in the first channel, B pretended to be E and sent their own address, A sent the funds, and B ran away.

The second channel was only used so E wouldn't get suspicious and tip-off A that something foul was going on. Both got tricked.

OFC this man-in-the-middle attack could have been prevented using some pretty easy techniques, such as
- double-checking everyone's TG account
- only accepting addresses via direct message
- confirm using phone or videocall that the address is correct

But my friend was an experienced trader who has done a lot of OTC transactions in his life and they still fell for it this time. I think primarily because he was good friends with E and so felt too safe in the transaction.

So keep in mind that it can happen to you as well and always stay vigilant!