Address Poisoning Attack: A New Way for Scammers to Steal Crypto Tokens
A new form of crypto scamming has emerged, known as an “address poisoning attack,” in which an attacker exploits vulnerabilities in the protocol to redirect crypto transfers to a different wallet address, leading to significant losses for the victim.
Recently, an attacker was able to execute an address poisoning attack on the Arbitrum network, leading to a loss of $1.3 million in Arb tokens. This is one of the largest attacks of its kind to date, and it has raised concerns about the security of decentralized finance (DeFi) platforms.
The attacker was able to execute the attack by creating a fake liquidity pool on the SushiSwap decentralized exchange (DEX) and then manipulating the token address of the Arb token to redirect transfers to a different wallet address under their control. This allowed the attacker to steal $1.3 million in Arb tokens from the victim’s wallet.
The attack was successful because of the way in which the Arb token address was generated. Instead of using a traditional address-generating algorithm, the Arbitrum network uses a unique technique called “address encoding,” which encodes the destination address with extra data to increase its security.
However, this extra layer of security proved to be a vulnerability in this case, as the attacker was able to manipulate the encoded address to redirect transfers to a different wallet address.
This incident highlights the need for greater security measures in DeFi platforms and the importance of user vigilance when interacting with these platforms. It is important for users to always verify the destination address when making transfers and to exercise caution when interacting with unknown liquidity pools or DEXs.
The Arb team has since patched the vulnerability and urged users to be cautious when interacting with unverified contracts or liquidity pools. This incident has also spurred a broader conversation about the security of DeFi platforms and the need for greater regulatory oversight in the space.
