在复杂的网络钓鱼攻击后，黑客从以“e57”结尾的钱包中盗走 3200 万美元的 spWETH

9 月 27 日，一个以“e57”结尾的钱包遭受了复杂的网络钓鱼攻击，导致钱包中的 12,083 个 Spark Wrapped 以太坊被耗尽

On Sept. 27, a concerning phishing attack targeted a hardware wallet. According to blockchain security firm CertiK, a wallet ending in "e57" fell victim to the attack, resulting in the loss of 12,083 Spark Wrapped Ethereum (spWETH) tokens. At the time of the incident, these tokens were valued at approximately $32 million.

9 月 27 日，一场针对硬件钱包的网络钓鱼攻击令人担忧。据区块链安全公司 CertiK 称，一个以“e57”结尾的钱包成为攻击的受害者，导致 12,083 个 Spark Wrapped Ethereum (spWETH) 代币丢失。事件发生时，这些代币的价值约为 3200 万美元。

CertiK's analysis of on-chain data revealed that 10,000 spWETH tokens, valued at roughly $26 million, were initially transferred from the compromised hardware wallet to another wallet beginning with the characters "0x471c." Subsequently, a portion of these funds was further moved across four additional wallets.

CertiK 对链上数据的分析显示，价值约 2600 万美元的 10,000 个 spWETH 代币最初从受感染的硬件钱包转移到另一个以字符“0x471c”开头的钱包。随后，这些资金的一部分进一步转移到另外四个钱包中。

According to CertiK, a total of 1,750 Ether ( ETH ) (valued at approximately $2,662,130 at the time) was transferred to a new wallet starting with "0x105c." Additionally, 2,613 ETH was transferred to a wallet beginning with "0x278d," followed by another transfer of 3,730 ETH to an address starting with "0x408d." Finally, around 1,865 ETH was moved to an address beginning with "0xfaf2."

据 CertiK 称，共有 1,750 个以太币 (ETH)（当时价值约 2,662,130 美元）被转移到以“0x105c”开头的新钱包中。此外，2,613 ETH 被转移到以“0x278d”开头的钱包，随后又将 3,730 ETH 转移到以“0x408d”开头的地址。最后，大约 1,865 ETH 被转移到以“0xfaf2”开头的地址。

CertiK Alert revealed the concerning details of the hardware wallet phishing attack on Sept. 27. Source: CertiK Alert.

CertiK Alert 于 9 月 27 日披露了硬件钱包网络钓鱼攻击的相关细节。来源：CertiK Alert。

Meanwhile, data from Arkham Intelligence suggested that the compromised hardware wallet might belong to F2Pool founder Shixing Mao; however, this information is yet to be independently verified.

与此同时，Arkham Intelligence 的数据显示，被入侵的硬件钱包可能属于 F2Pool 创始人毛世兴；然而，这一信息尚未得到独立核实。

Related: Decentraland X account hacked, phishing scam targets MANA airdropPhishing attacks on the rise in August 2024

相关：Decentraland X 账户被黑，钓鱼诈骗瞄准 MANA 空投2024 年 8 月钓鱼攻击呈上升趋势

In other crypto-related developments, phishing attacks saw a sharp increase during August 2024, rising by 215%, according to a report by Scam Sniffer. The security firm's August phishing report also highlighted total losses from these malicious attacks, which amounted to over $66 million. Notably, Scam Sniffer identified one wallet that lost a staggering $55 million in a single phishing attack targeting the victim's proxy ownership.

根据 Scam Sniffer 的一份报告，在其他与加密货币相关的发展中，网络钓鱼攻击在 2024 年 8 月急剧增加，增长了 215%。该安全公司 8 月份的网络钓鱼报告还强调了这些恶意攻击造成的总损失超过 6600 万美元。值得注意的是，Scam Sniffer 发现一个钱包在一次针对受害者代理所有权的网络钓鱼攻击中损失了 5500 万美元。

In a separate development, a September 2024 report by Blockaid revealed that the infamous Angel Drainer — malicious phishing software targeting cryptocurrency users — was upgraded to the newer AngelX. According to the report, the newly upgraded phishing software managed to deploy more than 300 phishing decentralized applications (DApps) within just four days.

在另一项开发中，Blockaid 2024 年 9 月的一份报告显示，臭名昭著的 Angel Drainer（针对加密货币用户的恶意网络钓鱼软件）已升级到较新的 AngelX。报告称，新升级的网络钓鱼软件在短短四天内就成功部署了 300 多个网络钓鱼去中心化应用程序（DApp）。

At the time, a Blockaid spokesperson raised concerns about the upgraded AngelX phishing suite targeting "newer" blockchain networks such as The Open Network ( TON ) and Tron ( TRX ). One of the most alarming features of AngelX was a newly upgraded control panel, which provided malicious actors with unparalleled ability to create customized and increasingly sophisticated phishing scams.

当时，Blockaid 发言人对升级后的 AngelX 网络钓鱼套件提出了担忧，该套件针对的是开放网络 (TON) 和 Tron (TRX) 等“较新”的区块链网络。 AngelX 最令人震惊的功能之一是新升级的控制面板，它为恶意行为者提供了无与伦比的能力来创建定制且日益复杂的网络钓鱼诈骗。

A snapshot of Blockaid's analysis of AngelX phishing DApp deployments on different blockchain networks. Source: Blockaid

Blockaid 对不同区块链网络上 AngelX 网络钓鱼 DApp 部署的分析快照。资料来源：封锁援助

Search engines unknowingly feature malicious phishing linksA Sept. 11 report from Scam Sniffer also brought to light the presence of fraudulent Etherscan sites being displayed in search results on the DuckDuckGo search engine. The security firm warned that these malicious links prompted users to connect MetaMask wallets, and once connected, hackers were able to access the funds within the wallets.

搜索引擎在不知不觉中带有恶意网络钓鱼链接 Scam Sniffer 9 月 11 日的报告还揭露了 DuckDuckGo 搜索引擎的搜索结果中显示的欺诈性 Etherscan 网站的存在。该安全公司警告称，这些恶意链接促使用户连接 MetaMask 钱包，一旦连接，黑客就能够访问钱包内的资金。

Magazine: Bankroll Network DeFi hacked, $50M phisher moves crypto on CoW: Crypto-Sec

杂志：Bankroll Network DeFi 遭到黑客攻击，网络钓鱼者在 CoW 上转移加密货币，价值 5000 万美元：Crypto-Sec