A phishing scammer has returned nearly $9.3 million to a victim after stealing $24 million in a phishing attack last September. According to Scam Sniffer on July 13, the scammer used the Dai (DAI) stablecoin for the returns. The first transfer of $5.23 million was made on July 8, followed by another $4.04 million on July 13 at 12:06 pm UTC, as per Etherscan data.
Ten months after falling victim to a $24.2 million phishing scam on September 6, 2023, the victim has received a $9.3 million refund. They lost 9,579 Lido Staked Ether (stETH) and 4,850 Rocket Pool (rETH) tokens after enabling token approvals through “Increase Allowance” transactions, as reported by Scam Sniffer. This feature allows a third party to spend tokens belonging to the owner.
The loophole, flagged by CoinMarketCap and others, highlights risks from anonymous developers deploying malicious smart contracts to scam users. The recent refund equals a 38.4% return based on September 6 prices, though the staked-Ether, now worth $47.5 million, was originally 14,429 tokens.
Onchain data reveals the Dai came from an address associated with Railgun Relay, a privacy protocol intermediary, before reaching the victim.
Scam Sniffer directed Cointelegraph to an onchain message where the hacker contacted the victim using a different wallet address on July 6.
“Hello, I am the person who took your money,” they stated. “I want to return it.”
According to Etherscan data, the scammer’s wallet address currently holds slightly over $3 million in funds following the $9 million transfer. Nearly 99% of these funds consist of the METAGALAXY LAND (MEGALAND) token from the BNB Chain.
According to Scam Sniffer’s 2023 Wallet Drainers Report, phishing scammers pilfered nearly $300 million worth of crypto from 324,000 victims last year.
In 2023, Inferno Drainer and MS Drainer emerged as the top two notorious scammers, siphoning $81 million and $59 million, respectively.
Pink Drainer also gained notoriety this year, amassing over $85 million in stolen funds before its shutdown in May.