{"id":58733,"date":"2023-09-25T11:41:04","date_gmt":"2023-09-25T03:41:04","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=58733"},"modified":"2023-09-25T11:41:06","modified_gmt":"2023-09-25T03:41:06","slug":"scammers-use-fake-cryptocurrency-trading-pools-to-steal-over-1m-sophos","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2023\/09\/25\/scammers-use-fake-cryptocurrency-trading-pools-to-steal-over-1m-sophos\/","title":{"rendered":"Scammers use fake cryptocurrency trading pools to steal over $1M – Sophos"},"content":{"rendered":"\n

Sophos, a global player in innovating and delivering cybersecurity as a service, recently released findings on a major sh\u0101 zh\u016b p\u00e1n (pig butchering) operation utilizing fake trading pools of cryptocurrency (liquidity pools) to steal more than $1 million. <\/strong><\/p>\n\n\n\n

The report, \u201cLatest Evolution of \u2018Pig Butchering\u2019 Scam Lures Victim in Fake Mining Schem<\/a>e,\u201d details the story of one of the scammed victims in the pools, named *Frank, and how he lost $22,000 in one week after \u201csomeone\u201d pretending to be \u201cVivian\u201d on the dating app MeetMe contacted him.<\/p>\n\n\n\n

After Sophos X-Ops investigated Frank\u2019s story, the team uncovered a total of 14 domains associated with the scam operation, as well as dozens of nearly identical fraud sites that, together, netted this one \u201cring\u201d of pig butcherers more than $1 million in three months.<\/p>\n\n\n\n

This scam takes advantage of the largely unregulated world of decentralized finance (DeFI) cryptocurrency trading applications. Such applications create \u201cliquidity pools\u201d of various types of cryptocurrencies that users can then access to make trades from one cryptocurrency to another. Those who participate in the pool receive a percentage of any fee paid when a trade is made, creating an enticing return on investment. To join a pool, participants first have to sign an online smart contract\u2014a contract that gives another account (typically the operators of the pool) permission to access participants\u2019 wallets to facilitate trades. Fake pools, which pig butcherers are increasingly utilizing to siphon funds from targets, operate in much the same way. However, unlike legitimate pools, at some point these scammers \u201cpull the rug\u201d and empty the entire liquidity pool for themselves.<\/p>\n\n\n\n

\u201cWhen we first discovered these fake liquidity pools, it was rather primitive and still developing. Now, we\u2019re seeing sha zhu pan scammers taking this particular brand of cryptocurrency fraud and seamlessly integrating it into their existing set of tactics, such as luring targets over dating apps. Very few understand how legitimate cryptocurrency trading works, so it’s easy for these scammers to con their targets. There are even toolkits now for this sort of scam, making it simple for different pig butchering operations to add this type of crypto fraud to their arsenal. While last year, Sophos tracked dozens of these fraudulent \u2018liquidity pool\u2019 sites, now we\u2019re seeing more than 500,\u201d said Sean Gallagher, principal threat researcher, Sophos.<\/p>\n\n\n\n

Sophos X-Ops first learned of this liquidity mining operation from a victim named Frank. Frank had connected on the dating app MeetMe with a scammer hiding behind the persona of Vivian, a German woman supposedly living in Washington, D.C. for work. For weeks, Frank chatted with Vivian, who mixed her romantic promises with persistent attempts to convince Frank to invest in crypto.<\/p>\n\n\n\n

Eventually, Frank opened a Trust Wallet account (a legitimate app for converting dollars to cryptocurrency) and connected to the link to the liquidity pool site Vivian recommended. In reality, the pool site was a fraud site utilizing the brand of Allnodes, an established decentralized finance platform provider, as a cover. Between May 31 and June 5, Frank invested $22,000 in the scheme. Just three days later, the scammers emptied Frank\u2019s digital wallet. Frank, looking to recover his money, turned to Vivan, who claimed he needed to invest even more in the pool to recover his funds and reap the \u201crewards.\u201d While waiting for his bank to authorize a money transfer to Coinbase, Frank started researching what was going on and came across an article on liquidity mining from Sophos. At this point, Frank reached out to Gallagher for help.<\/p>\n\n\n\n

Even after Gallagher instructed Frank to block Vivian, she eventually found him on Telegram and continued her attempts to entice him into \u201ccontinuing their investment,\u201d going so far as to send a lengthy, emotional letter that was very likely created by a generative AI app.<\/p>\n\n\n\n

\u201cWhat makes these sorts of scams particularly tricky is that they don\u2019t require any malware to be installed on a victim\u2019s device. They don\u2019t even involve a fake app, like some of those we\u2019ve encountered in other CryptoRom scams. This entire fake liquidity pool was run through the legitimate Trust Wallet app. At one point, Frank even tried to contact Trust Wallet\u2019s support to recover his money, but he connected with a fake support contact from the fraudulent liquidity pool site. There is no regulation of these pools, legitimate or otherwise, on these crypto apps. These scams succeed solely through social engineering, and the scammers are persistent. Vivian continued trying to contact Frank for weeks after he blocked her on WhatsApp.<\/p>\n\n\n\n

\u201cThe only way to stay safe from these scams is to be vigilant and know that they exist and how they operate. That is why Frank wanted to share his story. Users need be wary of anyone they have no connection with reaching out to them suddenly via any dating app or social media platform, particularly if the \u2018person\u2019 reaching out wants to move the conversation to a platform like WhatsApp and then discusses investing in cryptocurrency,\u201d said Gallagher.<\/p>\n\n\n\n

Sophos has shared its data on this case with Chainalysis and Coinbase, as well as other threat intelligence professionals in the cryptocurrency space, all of whom continue to investigate. People who believe they may be a victim of pig butchering or liquidity mining fraud are free to reach out to Sophos. They should also reach out to their local law enforcement for assistance.<\/p>\n\n\n\n

For more about the rise of liquidity mining scams in \u201cLatest Evolution of \u2018Pig Butchering\u2019 Scam Lures Victim in Fake Mining Scheme<\/a>,\u201d go to Sophos.com.<\/p>\n","protected":false},"excerpt":{"rendered":"

After Sophos X-Ops investigated Frank\u2019s story, the team uncovered a total of 14 domains associated with the scam operation, as well as dozens of nearly identical fraud sites that, together, netted this one \u201cring\u201d of pig butcherers more than $1 million in three months.<\/p>\n","protected":false},"author":6,"featured_media":46775,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[286,54,2103,206],"class_list":["post-58733","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-white-papers","tag-it-security","tag-security","tag-security-breach","tag-sophos"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/58733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=58733"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/58733\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/46775"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=58733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=58733"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=58733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}