The good phisher: How a USDT holder lost and recovered $129m within hours

As a seasoned researcher with years of experience delving into the intricacies of digital finance, I must admit that this particular incident left me both astounded and slightly amused. The return of the stolen funds is an anomaly within the ever-growing landscape of crypto phishing scams.


A crypto investor lost a substantial amount of USDT tokens to a phishing address but eventually witnessed a return of the funds hours later. 

According to information from Tronscan, it appears that a user with the wallet address “TGr…XAE” made an error and sent approximately $129 million worth of USDT to a fraudulent address on the TRON blockchain, which is believed to be a phishing site.

The suspicious email address, “THc…bu8,” deceived by adopting similar initial and final characters to the genuine one, “TMS…bu8.

The victim had initially tested the transaction with 100 USDT before sending the massive sum but failed to notice the discrepancy in addresses when transferring the $129 million.

Significantly, an incorrect transaction happened at 09:05 UTC. Shortly after that, the fraudulent email account transferred the pilfered resources to a fresh wallet identified as “TKt…f6m.” At that moment, it appeared as though the stolen funds had vanished permanently.

In an unanticipated action, the owner of “TKt…f6m” returned a large portion (approximately 90%) of the stolen funds, which totaled 116.7 million USDT, to the original address at 09:58 UTC. About four and a half hours afterwards, an additional amount of 12.96 million USDT was also returned to the same victim.

Upon the investors acquiring their assets from me, I swiftly transferred the associated funds to the original designated location, “TMS…bu8.” Ever since then, those tokens have been securely held there.

It’s not entirely certain what prompted this unexpected act of returning stolen goods. Some theories suggest it might have been an exceptional demonstration of kindness from the hackers, while others point to various other reasons that could have influenced their choice.

This case is an anomaly in the growing trend of crypto-related phishing scams. Last month, an address tied to a prominent crypto venture capital firm lost $36 million in a similar attack. 

During the months of August and September, there were significant losses reported among investors due to phishing scams. In August alone, a whale (a large investor) lost approximately $55 million when they fell victim to a phishing scheme involving DAI stablecoin. As per reports from crypto.news, these incidents resulted in further losses of around $63 million in August and an additional $43 million in September.

Read More

2024-11-20 13:05