A few hours ago a single victim lost about 1.28 Million in USDC and USDT to a phishing scam.

Below are the wallets of interest

• Scammer Wallet 1 - 0xaBd75CD4117fa7BFaA096f581abceC69b8D68F50
• Scammer Wallet Intermediary - 0x623F1C5730667D1B48737127f1cBaBB5b87d0943 [most of the funds here!]
• Victim Wallet - 0xf8EBfaCb4768b4152dd38416c1EA5FD143F5F807

The total loss from combined victims is over 2 Million.

How did these Victims Get Phished?

The CREATE2 Function is getting exploited to bypass some security alerts.

I've seen a number of phishing scams use the 'increaseAllowance' function of late to drain wallets. Most of these can be attributed to known Scams as a Service wallet drainers like Inferno, Pink, Angel, and others.

The CREATE2 Function creates new wallet addresses for each malicious signature. According to Scamsniffer, after the victim signs the signature, the Drainer creates a contract at that address and transfers the user’s assets.

Where did the Funds Go?

Above is a look inside 0xaBd75CD4117fa7BFaA096f581abceC69b8D68F50. On the left are the victims with wallet 0xf8EBfaCb4768b4152dd38416c1EA5FD143F5F807 losing over 1.28M in 3 txns. Many of the victims lost funds in the 5 figures.

So far no exchanges or mixers have been used, which is interesting. I do see a few transactions going into what appear to be unidentified hot wallets, these could be gambling or giftcard services.

Almost 1.7M is sitting in one wallet 0x623F1C5730667D1B48737127f1cBaBB5b87d0943, Scammer Wallet Intermediary.

Above is the Etherscan transaction. over 1.6M in stolen funds went from 0xaBd75CD4117fa7BFaA096f581abceC69b8D68F50 to 0x623F1C5730667D1B48737127f1cBaBB5b87d0943.

I'm expecting the phishing scammer to have further movements with wallet 0x623F1C5730667D1B48737127f1cBaBB5b87d0943 in the coming hours.