Blockchain security service PeckShieldAlert has revealed a recent incident in which a scammer managed to steal a whopping 20 million USDT from an unsuspecting victim using a zero-transfer attack.
The cryptocurrency community was quick to respond, with Tether proactively freezing the stolen assets by blacklisting the scammer’s addresses within just one hour of the incident.
The victim, identified as 0x407e, had earlier received 10 million USDT from Binance (BNB) and had subsequently attempted to transfer the coins to an intended alternate address.
It was during this transfer that the fraudster executed a zero-value token transfer from the victim’s address to their own phishing address.
The intricate workings of a zero-value transfer scam involve manipulating users into executing a transaction with a value of $0 to a phishing address that bears a striking resemblance to the intended recipient’s address.
Scammers often exploit the common practice of users only glancing at the beginning and end of a wallet address, disregarding the middle part.
By creating a phishing address that closely mimics the original one, scammers trick users into believing they are sending funds to the correct address.
Since zero-value transfers don’t involve any actual funds, they don’t require the victim’s private key for execution. While this initial transfer doesn’t result in a direct loss of funds, it sets the stage for future deceptions.
Users who rely on transaction histories to validate addresses may fall victim to this type of attack, as they might unknowingly send actual funds to a phishing address in the future.
In the case at hand, the scammer’s zero-value transfer tactic led the victim to mistakenly send $0 USDT to the phishing address.
Subsequently, when the victim initiated a legitimate transaction, they were deceived into using the phishing address, leading to the loss of a substantial amount of cryptocurrency.
One notable aspect of this incident was the swift response from Tether. The company’s rapid action in blacklisting the scammer’s addresses within an hour of the attack showcases the industry’s commitment to tackling such threats.
