1\ In preparation for the @Hope_fin#exit scam, a fake router was deployed in txn 0xf188.
The SwapHelper was then updated to use this fake router in txn 0xc9ee. This txn was approved by all 3 owners of Hope’s multisig 0x8ebd.
@Hope_fin 2\ In txn 0x1b47, ` _swapExactTokenForTokens` variable was set to wallet address, 0x957D.
When `GenesisRewardPool.openTrade()` is called to borrow USDC, GenesisRewardPool transfers WETH to TradingHelper to convert to USDC.
Instead of swapping, USDC was sent to 0x957D.
@Hope_fin 3\ As the `_uSDC` address was deliberately left empty, the receiving address (0x957D) was passed to v2 and the `swapExactTokensForTokens()` transferred 477 WETH to 0x957D.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
What we know so far regarding the @fRiENDSiES_Ai exit scam:
On 20 Feb, fRiENDSiES Ai posted on their twitter that they were pausing the project due to market volatility.
Let’s see what went down 🧵 👇
@fRiENDSiES_Ai 1/ In March 2022, the fRiENDSiES #NFT project conducted a Dutch-style auction which raised ~1,530.78 $ETH.
@fRiENDSiES_Ai 2/ According to the roadmap, which has been deleted, the team promised 1.25% of the royalties to be given back to token holders. However, investors have not received anything.
We are seeing multiple community reports that @BurstRoyale_NFT is a scam project that drains NFT wallets after downloading the game. Several individuals have reported that they fell victim to this phishing site over the past month.
Please stay safe!
@BurstRoyale_NFT 1/ Burst Royale appears to have a consistent modus operandi where a “team member” contacts their targets on Twitter offering them a job for the project and asking them to download their game, which is a proxy malware that drains wallets.
@BurstRoyale_NFT 2/ The malware is reportedly called RedLine Stealer which connects to a server to exfiltrate data. It can be found on underground forums for sale for ~$150.
1/ We are seeing a fake @Coinbase email scam. Here’s how it works 👇👀
The scammer targets individuals who are selling items online and promise to pay a large sum of BTC through Coinbase.
@coinbase 2/ They’ll then ask for the email address associated with the victim's Coinbase account.
Coinbase allows users to send crypto to an email address.
They then pretend to send you BTC and provide a fake screenshot of the confirmation.
@coinbase 3/ The scammer will then send an email pretending to be from Coinbase that will ask you to purchase BTC and send it to your 'activation address' in the email subject line. This is in order to ‘activate the encrypted fund’.
1/ Let's break down the recent FTX Wallet Drainer activity.
The BSC wallet holds ~$1.6m DAI after converting ~44,232 BNB to ~$4m USDC, ~$3.5m USDT and $3.4m Binance Peg ETH.
The assets were then bridged over to ETH and sent back to FTX Accounts Drainer.
2/ Once the FTX Wallet Drainer amassed ~250k ETH, they began bridging funds to the Bitcoin Blockchain
On 20 Nov, 50k ETH was transferred to 0x866E which swapped ETH for renBTC.
Those assets were then bridged to the following addresses
Bc1qv…gpedg
Bc1qa…n0702
3/ BTC Bc1qv…gpedg began a peel chain.
This is a money laundering technique whereby BTC is sent through a series of transactions in which smaller amounts of BTC are transferred to a new address.