SlowMist: Two Million Dollar Ethereum Wallet Trap(Released in 2018)
This article was originally created by Chen Wei, a member of the “SlowMist Zone” intelligence foundation.
This article has been authorized for publication by the “SlowMist Zone” official account.
Today, I’m sharing an Ethereum phishing wallet address. Both the private key and address are from the internet.
Account private key: 668a369e87c01da5bfca9851e6ee86d760e17ee7912d77b7dffe8e0cdf63bcb5,
Address: 0xA8015DF1F65E1f53D491dC1ED35013031AD25034
Before anything else, let’s check the wallet status which can be seen on etherscan.io as follows.
The wallet holds ICX worth $320,382 USD. It’s quite alluring, isn’t it? Let’s import the private key to your wallet and see what happens.
Let’s try transferring some ICX out of the wallet.
When you attempt to transfer, you will receive a prompt saying that your transaction fee balance is insufficient. This is expected, so let’s deposit some ETH into the wallet. After we make the deposit, we will find that the ETH inside the wallet will be transferred immediately. Some users have already conducted experiments on this, so we won’t test it here. (As shown below)
Furthermore, by observing the transaction records of the address, we can identify two commonalities:
- The time between the incoming and outgoing transactions is very short.
- The outgoing amount is around 1% of the incoming amount.
The first point is not difficult to explain. All actions are performed through a script, which monitors whether there is an incoming transaction to the address in newly generated blocks on the Ethereum mainnet. If there is, the script immediately transfers the ETH out of the wallet.
Regarding the second point, all outgoing amounts are very small. Why is that? By observing the transaction list, we can find that there is not just one outgoing address, which means that someone else wants to take a share of the ETH deposited by unsuspecting users. They set the transaction fee very high, sometimes up to around 99% of the total amount. On the Ethereum platform, miners prioritize transactions with higher fees when they add transactions to a block.
At this point, some may ask, why not just set a higher transaction fee and use a script to transfer the ICX Tokens out of the wallet? Now, let’s take a look at the ICX smart contract code. The contract address is: https://etherscan.io/address/0xb5a5f22694352c15b00323844ad545abb2b11028#code
Let’s take a look at the two transfer functions in the contract.
You will notice that both of these functions are accompanied by the “checkLock” modifier. Let’s take a look at what “checkLock” does.
These lines of code check if the address is in the “lockaddrss” list. If it is, then it throws an error and the transfer operation will not be executed. Let’s check whether this phishing wallet address is in the “lockaddress” list (since “lockaddress” is a public type, we can check it directly).
Without a doubt, the wallet address we saw earlier is in a locked state. Therefore, the phisher first locked the ICX Tokens in the wallet and intentionally leaked the private key. Then, they tempted people to transfer large amounts of ERC20 Tokens to the wallet address as transaction fees, and immediately transferred the ETH out of the wallet.
The above is my analysis of this ETH phishing wallet address for your reference!
About SlowMist
SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.
Website：
https://www.slowmist.com
Twitter：
https://twitter.com/SlowMist_Team
Github：
https://github.com/slowmist/
