More than $4.7M stolen in Uniswap fake token phishing attack

A sophisticated phishing campaign targeting liquidity providers (LPs) of the Uniswap v3 protocol has seen attackers make off with at least $4.7 million worth of Ethereum (ETH). However, the community is reporting the losses could be even greater. 

Metamask security researcher Harry Denley was one of the first to raise the alarm bells of the attack, telling his 13,000 Twitter followers on July 11 that 73,399 addresses had been sent malicious ERC-20 tokens to steal their assets.

At least $4.7 million in ETH has been lost in the attack, according to a Twitter post from Binance CEO Changpeng “CZ” Zhao. However, there are also reports amongst the crypto community that there may be more significant losses from the incursion.

Prominent crypto Twitter user 0xSisyphus noted on July 11 that a “large LP” with around 16,140 ETH, worth $17.5 million, may have also been phished.

How it works

According to Denley, the phishing attack works by sending unsuspecting users a “malicious token” called “UniswapLP” – made to appear as coming from the legitimate “Uniswap V3: Positions NFT” contract by manipulating the “From” field in the blockchain transaction explorer.

Users curious about their new tokens would be directed to a website purporting to allow them to swap their new tokens for Uniswap’s native token UNI, worth $5.34 each at the time of writing.

The website would instead send the users’ address and browser client info to the attackers’ command center, which would also attempt to drain cryptocurrency from their wallets.

A Reddit post also explaining the attack noted that the attackers had stolen native tokens (ETH), ERC20 tokens, and NFTs (namely Uniswap LP positions) from victims.

Not an exploit

Binance’s CEO Zhao created some waves in the crypto markets when he first sounded alarms about the attack, calling it a “potential exploit” of the Uniswap protocol on the ETH blockchain.

Related: Finance Redefined: Uniswap goes against the bearish trends, overtakes Ethereum

Zhao clarified soon after the post with another update, sharing a conversation with the Uniswap team, who noted the attack was part of a phishing attack rather than any issue with the protocol.

CZ’s initial alarming comments coincided with a sharp drop in the Uniswap price, which fell to a 24-hour low of $5.34. The price of UNI has since recovered following the clarification to $5.48 at the time of writing but is still down 11% in 24 hours and is 87.8% down from its all-time-high (ATH).

All Dutch and English crypto news!

Bitcoin whales copy classic bull market moves as BTC price eyes $72K

Bitcoin sets a positive tone into the U.S. holiday weekend as a Coinbase-induced BTC price dip fails to keep bulls back for long. Market Update Own this...

Bitget Announces Listing of ABBLE (ABBL): The Latest Meme Token on Solana

Victoria, Seychelles, March 28th, 2024, Chainwire Bitget, a world leading cryptocurrency exchange and Web3 company, is pleased to announce the listing of ABBLE (ABBL), the newest...

De dominantie van Solana groeit, dit is waarom

De opvallende stijging van Solana (SOL) met meer dan 850% in het afgelopen jaar heeft de Altcoin-markt op zijn kop gezet, waarbij de prestaties van...

Nansen integrates blockchain data from SportFi chain Chiliz and Ethereum rollup zkSync

The integration provides a high-level overview of both ecosystems, allowing cryptocurrency teams to run their own queries and get insights from the raw data. News Own this...

Beste exchanges

Koop je crypto bij Bitvavo