Dangerous crypto exchange: we reveal a new scheme for stealing cryptocurrencies

What seems like a simple transaction — exchanging cryptocurrency for fiat currency — can result in the loss of assets. Scammers have devised a new sophisticated scheme to steal digital assets from the wallets of unsuspecting users. GetBlock AML Research spoke directly with the fraudsters to uncover the details of their scheme.

Face-to-face meeting

On one of the aggregators, we found several ads from users offering face-to-face exchanges of USDT stablecoins for Russian rubles. The author of the ad indicates that they are willing to travel to any address in the region to conduct the transaction in person and transfer cash.

Conversation with the scammer

We contacted the author of the ad and began discussing the transaction details. He confirmed that he was willing to travel to the specified address. Then we fixed the exchange rate. After that, the first suspicious moment occurred. For some reason, the cryptocurrency buyer did not want to accept assets from the Bybit exchange wallet and requested that we transfer the coins to Trust Wallet. We transferred USDT to Trust Wallet.

The culmination of the scam

A few hours before the meeting, the scammer began the active phase of the scam. He said that before leaving for the deal, he had to check the purity (legality) of the cryptocurrency. The scammer shared a video tutorial on how to check coins for purity. In this tutorial, he connects an unknown decentralized application (dApp) to his Trust Wallet, which supposedly checks coins for legality.

The process of connecting a dangerous application from the scammer’s video tutorial

When you try to connect to the dangerous app, Trust Wallet warns you that you’re doing it at your own risk. This means there’s a high chance you’ll lose your assets. The scam works as follows: once you connect your wallet to the malicious app, it transfers all the cryptocurrency stored in it to the scammer’s address.

Trust Wallet warning when attempting to connect to a dangerous application

One of the scammer’s tricks is that they “give” us 30 TRX (about $9) to pay for the coin purity verification fee. When we try to “skip” the verification and make a transaction without it, the scammer starts to “pressure” us by saying that without this procedure, they cannot make the exchange.

On-chain analysis

The scammer’s address on the Tron network (TFq8GqCTiJA1PAnCJjtqDMHTRAsZgKNaYk) shows that he was most active in 2023. The attacker used a large number of intermediate addresses to distribute cryptocurrency and hide its source. The address is also linked to the Gate and Bitmart exchanges.

Graph of the scammer’s address connections. Visualization: MistTrack