Experts in blockchain security have discovered a mobile app which stole wallet data and over $1.8M worth of cryptocurrency from the devices of users.
According to SlowMist, OKX Web3 Security and OKX Web3 Security, a fake BOM app stole more than $1.82M in cryptocurrency by accessing secretly users’ private key and mnemonic phrase. A Feb. 27 research reportSlowMist reports that on February 14, the first unauthorised transactions were detected with the app.
In-chain analysis revealed main leaks. Further investigation showed that BOM is not a scam App that lures victims into granting file access. App scans device storage and takes wallet information, which is then sent to remote server.
Apps like this one, which asks for unnecessarily permissions such as photos or media access, are what experts call a “highly suspicious” behavior.
“On iOS, the app first requests permissions, deceiving users with a message claiming the access is necessary for normal operation. This behavior is highly suspicious — as a blockchain-related application, it has no legitimate reason to require access to the photo gallery.”
SlowMist
SlowMist tracked stolen funds across multiple blockchains, estimating that the main hacker address (0x49aDd3E…) stole assets from at least 13,000 victims and transferred the funds through BNB Chain, Ethereum, Polygon, Arbitrum, and Coinbase’s Base.
Tether was among the stolen cryptocurrency.USDTEthereumETHWrapped BitcoinWBTCDogecoin is a cryptocurrency (DOGE).
SlowMist analysts have noted that although it is not clear who’s behind this scheme, they did note that during the analysis the backend of the application was offline, suggesting that attackers may be trying to conceal their tracks. Many funds were traded on decentralized platforms, such as PancakeSwap, OKX DEX and OKX.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: crypto.news
