Connect with us
DAPA Banner

Crypto World

Ethereum address poisoning spike, ‘wallets aren’t ready’ says researcher

Published

on

Ethereum address poisoning spike, ‘wallets aren’t ready’ says researcher

On December 3, the Ethereum network executed the Fusaka upgrade which had one focus: “scaling without compromise.”

Gas fees, once a major impediment to Ethereum’s usability for all but those with the deepest of pockets, plummeted sharply, with transfers and swaps costing just a few cents per transaction.

Cheap transactions don’t just benefit regular users, however. 

Indeed, the increased affordability of long-running address poisoning campaigns has seen losses, as well as activity, skyrocket since Fusaka.

Advertisement

Protos spoke to Andrey Sergeenkov, an independent researcher analysing address poisoning on Ethereum, who believes that “the wallets aren’t ready, and the protocol keeps scaling anyway.”

Cheap gas, a boon for users and scammers alike

In an article published last month, Sergeenkov identified a six-fold reduction in gas costs resulting in an almost identical increase in the volume of address poisoning, from an average of 30,000 to 167,000 per day (5.6x).

Increased affordability has seen losses, as well as activity, skyrocket since Fusaka.

The surge in transactions has, unsurprisingly, been accompanied by increased losses.

Sergeenkov tracked dust transactions of 101 tokens and identified “confirmed payoffs” over 73-day windows before and after Fusaka.

The value of funds stolen increased from $4.9 million pre-Fukasa to $63.3 million in the period after the upgrade.

Advertisement

He also observed a “2.6-fold increase in [the number of] successful payoff events.”

Even subtracting the largest post-Fusaka loss, a $50 million outlier just before Christmas, the total is “still $13.3M, a 2.7-fold increase over the pre-Fusaka rate.”

Sergeenkov told Protos that, since the end of the dataset used in his most recent article, there have been a number of significant losses. The top three of these were a $600,000 loss on February 17, a $157,000 loss the following day, a $30,000 loss on February 28.

In all, he identified almost $900,000 in losses from 91 victims between those discussed in his article and his response to Protos on March 9.

Advertisement

Adjusting for the recent losses, and ignoring the outlier, brings the average amount stolen per day to 2.1x that of the pre-Fusaka rate. 

“The attack volume hasn’t slowed either,” he says, and is still picking up “200,000–350,000 poisoning transactions per day.”

While the individual transactions themselves may be cheap, the potential rewards justify splashing large sums on casting as wide a net as possible.

Read more: Copy, Paste, Rekt: Ethereum address poisoning strikes again

Advertisement

‘Scaling without compromise’

Ethereum’s efforts to reduce gas costs have been overwhelmingly successful.

First, demand was pushed onto cheaper, faster Layer Two (L2) networks, lowering activity on mainnet.

Though the advances in scaling (which don’t look to be slowing down) mean, in the words of Vitalik Buterin, that the “original vision of L2s and their role in Ethereum no longer makes sense.”

Later, the introductions of blobs (which did away with the ETH’s deflationary, “ultra sound” narrative) and the Fusaka upgrade, have seen the cost of gas mimic the chart of a classic DeFi slow-rug project.

Advertisement

Read more: Your L2 transaction fees are higher because of MEV spam, report

Sergeenkov notes that, despite a known link between low fees and attack volume, the upgrade “went ahead anyway.”

He says the “Ethereum Foundation has not proposed or implemented any protocol-level countermeasure” and Buterin “places user protection entirely at the wallet and UX layer.”

However, Sergeenkov points to research which claims that, of 53 wallets studied, only three “throw an explicit warning message” to users before transferring to address poisoning addresses.

Advertisement

According to Namefi CEO, Z. Victor Zhou, one potential solution is using leading zeros, making lookalike addresses much more costly and time-consuming for attackers to generate.

“One minute of your laptop’s GPU time creates an address that would cost an attacker 32 years to fake,” he claims. “The asymmetry is staggering.”

Emergent threats

Address poisoning isn’t the only attack vector which benefits from low gas costs.

Security researcher Daniel Von Fange notes that cheap gas makes for complex attack transactions which render “only the tiniest smidge of money” profitable.

Advertisement

“Spectacularly wasteful” MEV activity was seen to offset scaling improvements on L2 networks, negating any gas savings for regular users while looking to profit off their activity.

Other malicious behaviours can also be borne out of well-meaning upgrades.

“The system produces new attack vectors structurally, with each change to the protocol,” Sergeenkov says.

One example is EIP-7702, which brought wallet delegation capability. Wintermute research later found that 80% of addresses using the code were linked to malicious activity.

Advertisement

Does Sergeenkov have an antidote?

In terms of staying safe, Sergeenkov says “never copy addresses from your transaction history or a block explorer.” He also advises against making transfers if suffering from “lack of sleep, illness or anything else.”

But he has little faith that advice or educating users will be able to keep up with such “numerous and easily adaptable” attack vectors.

“What’s needed is a fundamentally different environment where users don’t have to learn how to avoid losing all their money from a single mistake. Where the risk-reward of an attack rules it out by itself.”

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on XBluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Bitcoin rangebound as altcoins rally while derivatives signal downside risk: Crypto Markets Today

Published

on

Bitcoin rangebound as altcoins rally while derivatives signal downside risk: Crypto Markets Today

The crypto market continued to exhibit signs of choppiness on Friday, with bitcoin trading at $67,000 in the middle of a trading range that spans back to early February.

A selection of altcoins picked up during the lower liquidity Asia hours, prompting the likes of ALGO and RENDER to post double-digit gains over the past 24 hours.

But the wider picture remains the same; the crypto market is trading in a macro downtrend dating back to October, characterized by a series of lower highs nad lower lows.

U.S. equities trade flat on Friday as volatility continues to cool since Donald Trump’s comments about a potential end to the war in Iran on Monday.

Advertisement

Brent crude oil is trading at $109 a barrel, indicating that an end to the war is perhaps not as close as some analysts are predicting.

Derivatives Positioning

  • Futures markets for Bitcoin and Ethereum remained subdued, with the extended holiday weekend keeping trading volumes thin. Open interest in both assets was largely unchanged over the past 24 hours.
  • Open interest in Solana futures has climbed to over 65 million SOL, its highest level since Feb. 7. The increase, combined with negative funding rates and an OI-adjusted cumulative volume delta, suggests traders are increasingly positioning for downside, with short sellers showing greater conviction.
  • Similar bearish market dynamics are present TRX and BCH.
  • OI in Privacy-focused Zcash (ZEC) futures have steadied near 1.70 million ZEC for the third straight day. ZEC’s CVD is also the highest among majors. This combination suggests sustained positioning with strong directional conviction, likely driven by aggressive buying pressure.
  • Bitcoin’s 30-day implied volatility index has declined to 51.28%, the lowest since Feb. The market shows no signs of panic whatsoever despite geopolitical concerns and energy market volatility.
  • Ether’s volatility index has slipped to 72.55%, the lowest since Feb. 26.
  • On Deribit, bitcoin and ether puts continue to trade pricier than calls, indicating a bias for downside protection.
  • Glassnode said that the dealer gamma exposure below $68,000, all the way down to $50,000 is negative. This means that dealers could sell in a falling market to hedge their exposure, adding to downside volatility.

Token talk

  • The altcoin market has been relatively resilient to crypto’s choppy behavior this week, certain portions of the market have outperformed bitcoin and crypto majors, particularly DeFi and AI tokens.
  • The DeFi Select Index (DFX) is up by 1.3% since midnight UTC, while the CoinDesk Computing Select Index (CPUS) rose by 1.5%, beating the bitcoin-heavy benchmarks likes the CoinDesk 20 (CD20), which is up by just 0.16% on Friday.
  • The outperformance of certain altcoins is symptomatic of a consolidating market. When bitcoin and the majors trade flat, traders often speculate on lower liquidity altcoins. That speculation typically grinds to a halt when bitcoin is back deciding the next major market move.

Source link

Continue Reading

Crypto World

Pyth soars 9% following Polymarket integration. Will it rally higher?

Published

on

Pyth soars 9% following Polymarket integration. Will it rally higher?

Key takeaways

  • PYTH is up 9% in the last 24 hours, outperforming other major cryptocurrencies.
  • The rally comes following Pyth Network’s integration with Polymarket.

PYTH, the native coin of the Pyth Network, is one of the best performers in the crypto market over the past 24 hours. It could rally higher in the near term as the broader market recovers from Thursday’s slump.

PYTH rallies on Polymarket integration

On Thursday, Pyth Network revealed in a blog post that Polymarket, the world’s largest prediction market platform, has integrated Pyth Pro as its data source for a new suite of traditional asset contracts.

The initial offerings include gold, silver, and major equity index ETFs. Polymarket now relies on Pyth Pro’s data to power its daily up/down and daily close markets, with live price charts updated every second to ensure full transparency.

The integration has seen PYTH rally by 9% in the last 24 hours and now trades at $0.0420 per coin. 

Advertisement

Pyth Pro provides real-time price data through WebSocket, which Polymarket samples every second to display as a live “price to beat” chart. This allows traders to monitor the market’s status relative to their position in real-time.

The selected assets span a wide range of traditional finance, including major equity indices, commodities like gold, silver, WTI crude, and natural gas, along with over a dozen high-profile U.S. equities such as TSLA, COIN, and PLTR.

Polymarket has integrated this real-time data as a key component of its perpetual futures trading platform. Pyth Pro delivers institutional-grade market data directly from top firms, ensuring it is accurate, transparent, and affordable across all asset classes and regions.

To enhance this, Pyth has partnered with industry leaders and government agencies like Cboe, Jane Street, Revolut, and the U.S. Department of Commerce. This collaboration has helped establish a new model to make market data more accessible, accurate, and transparent.

Advertisement

PYTH eyes $0.050 as bulls step in

The PYTH/USD 4-hour chart is bearish and efficient despite the coin adding 9% to its value in the last 24 hours.

The technical indicators have flipped bullish, indicating that the bulls are now in control of the market. The RSI of 63 is well above the neutral 50 and would enter the overbought territory if the rally persists.

PYTH/USDT 4H Chart

The MACD lines are also within the positive region, indicating a strong bullish bias. If the rally continues, PYTH could retest the $0.050 psychological level for the first time since March 17.

However, if the bears regain control, PYTH could retest the Thursday low of $0.038 over the next few hours or days.

Advertisement

 

Source link

Advertisement
Continue Reading

Crypto World

Drift Seeks Contact With The Hacker After $280M Exploit

Published

on

Drift Seeks Contact With The Hacker After $280M Exploit

Drift Protocol, a Solana-based decentralized exchange (DEX), said Friday it had opened onchain contact with wallets tied to funds stolen in the exploit that outside firms have estimated at roughly $280 million to $286 million.

Drift said on X that it had initiated onchain contact with wallets holding the stolen Ether (ETH), seeking to open a line of communication.

The team sent onchain messages from its Ethereum address (0x0934faC) to four wallets linked to the exploiter at the time of publication, urging the attacker to reach out via Blockscan chat. “We are ready to speak,” Drift said.

Onchain messaging has become a common tactic in exploit response, allowing protocols to communicate directly with attackers while preserving anonymity. In past cases, such as the Euler Finance hack, similar outreach led to the partial recovery of funds.

Advertisement
Drift’s onchain message to the Drift Exploiter on Friday. Source: Etherscan

Anonymous sender tries to pressure the attacker

Drift’s communication came hours after an unknown sender using the ENS name readnow.eth also reached out to wallets linked to the attacker on Thursday via onchain messages.

The sender claimed to know the identities behind the attack and demanded a payment of 1,000 ETH in exchange for withholding information.

Source: Etherscan

The claims could not be independently verified and may represent an attempt to mislead or pressure the wallet holder. The incident highlights how, alongside official communications, unverified messages can circulate onchain after crypto exploits.

Solana fallout keeps spreading

According to SolanaFloor, Drift’s exploit has so far affected at least 20 Solana protocols, including the decentralized finance (DeFi) platform Gauntlet, which was estimated to be impacted to the scale of $6.4 million.

Blockchain security platform Cyvers said the impact was still expanding as of Friday morning, with no funds being recovered 48 hours past the attack.

Cyvers said that the attack was likely a “weeks-long, staged operation,” noting that the attacker set up durable nonces, a Solana feature allowing users to pre-sign transactions for future execution, days before the exploit.

Advertisement

Related: Crypto hackers steal $169M from 34 DeFi protocols in Q1: DefiLlama

“This closely mirrors the Bybit hack, different technique, same root issue: signers unknowingly approving malicious transactions,” Cyvers added.

Some industry observers, including Ledger chief technology officer Charles Guillemet, suggested the exploit may involve North Korea-linked actors, though details remain unconfirmed.

Magazine: Nobody knows if quantum secure cryptography will even work

Advertisement