Binance develops ‘antidote’ to address poisoning scams after $68M exploit

Binance’s new algorithm has already helped detect over 13.4 million spoofed blockchain addresses on BNB and over 1.68 million on Ethereum.

Binance’s security experts developed an “antidote” against the growing instances of address poisoning scams, that trick investors into willingly sending funds to a fraudulent address.

The security team of the world’s largest cryptocurrency exchange developed an algorithm that detected millions of poisoned crypto addresses, according to a report shared with Cointelegraph:

“We have developed a unique method of identifying poisoned addresses, which helps us to alert users before they send money to criminals and was instrumental in identifying and flagging more than 13.4 million spoofed addresses on BNB Smart Chain and 1.68 million on Ethereum.”

Address poisoning, or address spoofing, is a deception trick where scammers send a small amount of digital assets to a wallet that closely resembles the potential victim’s address, to make it part of the wallet’s transaction history — hoping that the victim will accidentally copy and send funds to their address.

Binance’s algorithm detects spoofed addresses by first identifying suspicious transfers, such as those with near zero value or unknown tokens, pairing them with potential victim addresses, and timestamping malicious transactions to find the potential point of poisoning.

The spoofed addresses are registered in the database of Web3 security firm HashDit, Binance’s security partner, which will help protect the wider crypto industry from poisoning scams, according to Binance’s report.

“Many cryptocurrency service providers use HashDit’s API to boost their defenses against a variety of scams. One of them, for example, is Trust Wallet, which uses the database of poisoned addresses to alert users when they are about to transfer funds to a spoofed recipient.”

The algorithm will also help flag spoofed addresses on HashDit’s user-facing products, web browser extensions, and MetaMask Snaps.

Related: Post-FTX crypto industry needs education before regulation — Former Biden adviser

Address poisoning is a growing concern following $68 million scam

The necessity for a preventive algorithm became apparent two weeks ago, after an unknown trader lost $68 million to an address-poisoning scam. They accidentally sent $68 million worth of Wrapped Bitcoin (wBTC) in a single transaction to a spoofed address on May 3.

In a fortunate but mysterious turn of events, the thief returned the $68 million on May 13, after numerous on-chain investigators started shedding light on his potential Hong Kong-based IP addresses. This suggests that the scammer wasn’t a white hat hacker, but a thief that became scared of the public attention following the scam.

Address poisoning scams may seem easily avoidable, but most traders only verify the first and last digits of the wallet’s 42 alphanumeric characters, as most protocols only display the first and last digits.

Making matters more difficult, scammers rely on vanity address generators to customize their addresses to seem less random or more similar to a given address, according to Binance.

“An authentic Ethereum address like 0x19x30f…62657 could be spoofed using a similar-looking 0x19x30t…72657, which can be totally different in the middle while maintaining the first and last few characters.”

Related: Ether turns inflationary for the first time since the Merge