Fraudulent Transactions Exploit Wallet Vulnerability, Could Have Stolen More than $3 Million in TRX

CoinsDo, a Singaporean blockchain asset security company, has uncovered a sophisticated scam involving fake transactions and multiple smart contracts targeting major centralized cryptocurrency exchanges. While only a single successful instance of this scam has been confirmed, further analysis of the smart contracts in question revealed that the perpetrators initiated hundreds of these fake transactions, potentially defrauding exchanges, payment gateways, and centralized wallet companies of more than $3 million USD worth of TRX. 

It is highly possible that both firms who built their own wallet infrastructure as well as major wallet solution providers like Fireblocks are not adequately prepared to detect this type of fraudulent transfers. This presents a major operational loophole to be exploited by malicious actors.

The scam began with the perpetrator initiating a fraudulent TRX transfer to their deposit address on a centralized exchange. Through the use of multiple smart contracts, they were able to trick the exchange’s wallet infrastructure into validating the fraudulent transaction. This led the exchange to credit the equivalent amount of cryptocurrency to the perpetrator’s account, which they promptly liquidated for cash. 

The transaction looks just like a regular, successful transfer via smart contract.

The perpetrator had mass-triggered a smart contract (Smart Contract A) to initiate multiple transfers via a proxy smart contract (Smart Contract B) to roughly 100 end-user deposit addresses on various centralized exchanges

Smart Contract A was programmed to interact with Smart Contract B to initiate transfers as internal transactions, a sophisticated technique allowing the perpetrator to make fraudulent transactions appear legitimate. 

Graphical illustration on how the fraudulent transaction was made

What was so insidious about this fraudulent transaction was the fact that it could only be identified by a single parameter in the transaction data – “rejected”: true.

A tell-tale sign of a fraudulent transaction.

Malicious actors are getting more creative in their ways of stealing funds, targeting previously overlooked loopholes and vulnerabilities instead of private keys. Just look at the recent WazirX and Lmnl case, which resulted in losses over $230 million. This raises the question of whether wallet providers are overly focused on encryption technologies and algorithms, potentially at the expense of more practical security measures.

To better protect yourself from scams like the one mentioned, it is recommended that all wallet solution providers take extra care to verify transaction details, both internal and external, especially when smart contracts are involved. 

Source: https://www.coinsdo.com/en/blog/new-scam-alert-tron

Sastanaqqam, a pioneering Polygon-based Web3 ecosystem, is excited to announce a series of groundbreaking initiatives aimed at expanding its global footprint. These initiatives include a $1,000,000 airdrop campaign, strategic launchpad listings, and

successful private sales. Designed to reward its loyal community and attract new members, these efforts underscore Sastanaqqam’s commitment to creating a valuable and engaging ecosystem.

Campaign Overview Total Airdrop Value:

• $1,000,000 in $Bloo tokens
• $10,000 in USDT

Airdrop Structure:

1. Community Acquisition Airdrop: A one-time airdrop to welcome new members.
2. Daily Airdrop for Community Retention: Daily rewards for continued engagement.
3. Monthly Airdrop for Best Community Members: Monthly recognition and rewards for top members.
4. Final Airdrop: Special rewards for members who achieve 5000 points.

Points System:

• Earn Points: Engage with the platform, participate in daily tasks, and accumulate points.
• Leaderboard: Points will determine leaderboard positions, influencing monthly and final airdrop rewards.
• Daily Tasks: Exciting daily tasks designed to keep the community engaged and motivated.

Reward Distribution:

• General Campaign: $500,000 worth of $Bloo tokens will be distributed between July 5th and September 15th, accessible to everyone.
• Final Airdrop: Another $500,000 in $Bloo tokens reserved for final rewards to top members.
• USDT Rewards: $10,000 in USDT to be distributed throughout the campaign.

Participation Instructions:

1. Join the Community: Connect with Sastanaqqam on various platforms.
2. Engage and Earn Points: Complete daily tasks, interact with content, and earn points.
3. Climb the Leaderboard: Accumulate points to enhance chances of winning in monthly and final airdrops.

Why Participate?

• Exclusive Rewards: Early access to $Bloo tokens and USDT.
• Engagement and Fun: Participate in engaging tasks with daily surprises.
• Community Building: Connect with like-minded individuals and contribute to a thriving community.

About Sastanaqqam: Sastanaqqam is an ecosystem where art, DeFi, education, and gaming intersect, powered by its native $Bloo token. It aims to bring the advantages of Web3 and blockchain technology to users with a familiar, user-friendly interface. Key projects under Sastanaqqam include:

• Artiziri: A curated NFT marketplace democratizing digital art for creators and collectors.
• Sastanawallet: A non-custodial wallet supporting all Sastanaqqam platforms.
• WalletJR: An educational financial platform for young users to learn about DeFi and Web3.
• SastaPlay: A skill-based “Rank to Earn” gaming platform.

Partnerships: Sastanaqqam has established strategic partnerships with NOWPayments, Simplex, Mercuryo, BrightNode, Unicsoft, CDN, Ǫubstudio, Luna, Muse, Boosty, and Zex PR to bolster its ecosystem and ensure a seamless user experience.

Social Media Growth: Sastanaqqam has experienced rapid growth across its social media platforms, reflecting the strong community interest and engagement. Our Twitter followers have surged to 26,400, Telegram followers have reached 29,300, and our

Discord community now boasts 4,000 members. This explosive growth demonstrates the increasing interest and trust in the Sastanaqqam ecosystem.

Listing and Private Sales: The journey to listing $Bloo tokens has been meticulously planned to maximize value and accessibility. Our private sales have garnered significant interest from early investors, further solidifying the confidence in our project. The upcoming listings on major launchpads such as Kommunitas and GemPad are highly anticipated, setting the stage for a successful entry into the market. Subsequent listings on prominent exchanges like MEXC and Coinstore will provide liquidity and accessibility to a broader audience.

Community Metrics:

• Twitter Followers: 26,400
• Telegram Followers: 29,300
• Discord Followers: 4,000

Useful Links:

• Website
• Whitepaper
• Pitch Deck
• Twitter
• Telegram
• Discord
• Instagram
• LinkedIn
• Press Release

With this comprehensive airdrop campaign, Sastanaqqam continues to demonstrate its commitment to creating a valuable and engaging ecosystem for its community. Join us today and be a part of the future of art, DeFi, and gaming!