{"id":19063,"date":"2022-05-17T05:20:57","date_gmt":"2022-05-17T13:20:57","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/05\/17\/news-12796\/"},"modified":"2022-05-17T05:20:57","modified_gmt":"2022-05-17T13:20:57","slug":"news-12796","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/05\/17\/news-12796\/","title":{"rendered":"Liquidity mining scams add another layer to cryptocurrency crime"},"content":{"rendered":"

Credit to Author: gallagherseanm| Date: Tue, 17 May 2022 11:52:33 +0000<\/strong><\/p>\n

\n

The ongoing hype about cryptocurrency trading and the vast sums of digital wealth some have made (and lost) in crypto markets is a strong lure for some would-be investors. But the complexity of cryptocurrency and decentralized finance (DeFi) schemes based on it have also created an environment where criminals can draw victims in, using the complexity as camouflage for fake apps, malicious contracts, and other schemes that make the victims think they\u2019re on the road to wealth while getting them to turn over more and more currency.<\/p>\n

We\u2019ve already reported on one type of scheme, which we\u2019ve labeled CryptoRom\u00ad\u2013in which potential targets are approached on mobile dating applications and lured into messaging with someone posing as a romantic interest, and then brought into a fake cryptocurrency investment scheme bolstered by fake trading applications and websites. But while we were investigating that scheme, another practically dropped into my lap: a Twitter direct message invited me to join in \u201cliquidity mining research\u201d.<\/p>\n

\"\"<\/a><\/p>\n

This interaction led to an investigation uncovering a number of fraud rings based on \u201cliquidity mining,\u201d a form of cryptocurrency-based decentralized finance (DeFi) that even in its legitimate form is a highly complex endeavor. The mechanics of liquidity mining in its legitimate form provide the perfect cover for old fashioned swindles re-minted for the cryptocurrency age.<\/p>\n

Criminals have used the complexity of the real thing to provide cover for a variety of scams, luring victims with the promise of extraordinary returns on investment. We found a number of these rings, operating primarily from China and using a mixture of fraudulent blockchain contracts, websites and applications to raid victims\u2019 crypto wallets while making them believe they were making daily profits. Like the other crypto scams we follow, these have evolved from being focused on Asia into a global phenomenon. As we were researching one scam, the Washington Post reported<\/a> about the victim of another liquidity mining scam that closely followed the pattern of the CryptoRom<\/a> sha zhu pan scams we\u2019ve reported about in the past.<\/p>\n

What is Liquidity Mining?<\/h3>\n

Legitimate liquidity mining exists to make it possible for decentralized finance (DeFi) networks to automatically process digital currency trades. DeFi is an emerging financial technology that uses a blockchain-based distributed ledger similar to that used by cryptocurrencies to adjudicate trades between different types of crypto\u2014governed by trading protocols built into the ledger itself.<\/p>\n

Centralized cryptocurrency exchanges act as \u201cmarket makers\u201d for trades out of their deposits. Coinbase and other exchanges often reward larger investors (with reduced trading fees and other benefits) for allowing portions of their deposits to be used to guarantee the exchange has enough of popularly-traded pairs of cryptocurrency to assure trades can be handled. For example, if someone wants to cash out of Ethereum and exchange it for a \u201cstablecoin\u201d such as Tether (USDT), the exchange needs to have enough USDT available in reserves to make that trade and fulfill the transaction. The same is true in the other direction.<\/p>\n

DeFi exchanges do trades differently\u2014they\u2019re executed by a protocol built into their networks known as Automated Market Makers (AMMs). Smart contracts built into the DeFi network have to rapidly determine the relative value of the currencies being exchanged and execute the trade. Since there is no centralized pool of crypto for these distributed exchanges to pull from to complete trades, they rely on crowdsourcing to provide the pool of cryptocurrency capital required to complete a trade\u2014a liquidity pool.<\/p>\n

To create the liquidity pool\u2014which usually handles transactions between a single pair of cryptocurrencies\u2014investors commit equal values of both cryptocurrencies to the pool, tying them on the blockchain to the smart contract. \u00a0\u00a0In exchange for lending that crypto to the pool, the contributors get a reward based on a percentage of the trading fees associated with the DeFi protocol. \u00a0The \u201cmining\u201d part comes from liquidity pool tokens (LP tokens)\u2014a representation of the share of the liquidity pool contributed by the investor.<\/p>\n

The LP tokens themselves are in essence another cryptocurrency, \u00a0pegged to the value of the percentage of the pool they\u2019re associated with.<\/p>\n

Holding the tokens usually comes with benefits: a percentage of trading fees, and other rewards. There is also risk of loss\u2014for example, the value of the pool of crypto may fall, and therefore the cashout value of the tokens could drop below the initial buy-in cost. \u00a0But as long as the people behind the tokens don\u2019t take the assets in the pool and run, there is at least a way for investors to get off the merry-go-round.<\/p>\n

Unfortunately, there are several ways things can go awry if the people behind the liquidity pool are unethical\u2014or flat-out criminal. There is no regulation of DeFi exchanges, and the only thing guaranteeing they\u2019re on the up-and-up is the smart contract code built into the DeFi network\u2019s (usually Ethereum-based) blockchain. But if the tokens get cancelled\u2014or there was never really a pool backing them at all\u2014that all goes out the window. There is ample opportunity for digital Ponzi schemes, fraudulent tokens, and flat-out theft.<\/p>\n

Building a bank of falsehoods<\/h3>\n

Unfortunately for the crypto-curious, there are plenty of unethical and criminal \u201cliquidity mining\u201d schemes out there. Like the CryptoRom rings we\u2019ve tracked, they use a variety of social media and messaging tools to approach potential victims (as well as spam emails). In some cases, they also use fake mobile applications and websites that emulate or fake connections to better-known organizations in blockchain-based trading.<\/p>\n

\"\"<\/a>
One of many spam messages in a campaign promoting a liquidity mining scam site.<\/figcaption><\/figure>\n

But the pitches we\u2019ve seen have not leaned heavily on the romance angle\u2014though they do in some cases use manufactured profiles with young women to strengthen an emotional appeal.<\/p>\n

For example, there is the constructed profile used in the unsolicited offer I received.<\/p>\n

The person behind this Twitter account claimed to be a young woman in \u201cAmerica\u201d:<\/p>\n

\"\"<\/a>
“Catherina”, now “Linna” , one of many identical accounts used to lure victims in a liquidity mining scam.<\/figcaption><\/figure>\n

The account was set up just a few weeks before the initial direct messages I received. The timeline of the profile is packed with selfies and videos of the woman, who based on the content of some of the images and posts is in Russia. The images of the woman are used on multiple Twitter accounts with identical content.<\/p>\n

\"\"<\/a><\/p>\n

Further interaction with \u201cCatherina\u201d led to an invitation to continue the conversation on WhatsApp or Telegram:<\/p>\n

\"\"<\/a><\/p>\n

Over the course of conversation on Telegram, the fraudster tried to guide me to set up a Coinbase wallet and deposit Tether (USDT), a \u201cstablecoin\u201d allegedly backed by securities that roughly follows the value of the US dollar.<\/p>\n

\"\"<\/a><\/p>\n

The Binance app store screen shot sent by the criminals showed artifacts of automatic translation and showed Chinese versions of the app. No link was provided, so this appears to be the legitimate Binance app in this case.<\/p>\n

\"\"<\/a><\/p>\n

The screenshot of the CoinBase Wallet (another legitimate app) from the Google Play store was in Turkish:<\/p>\n

\"\"<\/a><\/p>\n

During the course of our interaction, I managed to get \u201cCatherine\u201d to open a canary link\u2014a URL tied to a server I had set up. Logs showed the person\u2019s IP address was in Hong Kong.<\/p>\n

Eventually, \u201cCatherine\u201d pointed me to a Telegram channel called \u201cUS Coinbase Investment Trading\u201d for more details on connecting to the \u201cpool.\u201d The same Telegram channel was promoted in a Twitter direct message group called \u201cLiquidity mining part time exchange group\u201d:<\/p>\n

\"\"<\/a><\/p>\n

The Telegram channel shares \u201cnews\u201d of big rewards being shared, as well as admonishments not to believe any direct messages from other forum members because of the risk of fraud. In messages purporting to be from a CoinBase administrator (@Coinbase_CarlM), the scam group directs potential victims to a URL to register their wallets on the \u201cofficial block\u201d:<\/p>\n

\"\"<\/a> \"\"<\/a><\/p>\n

That link, coinbase-udt[.]cc, presents a mobile format website and pops up a QR code containing a link formatted specifically for crypto wallets compatible with the WalletConnect protocol. If a browser wallet extension such as MetaMask is present, it will automatically ask the user if they want to connect their wallet.<\/p>\n

The site claims to have generated over 2 billion USDT \u00a0(roughly equivalent to $2 billion US) in \u201cuser revenue,\u201d with 2,300 \u201cvalid\u201d wallet \u201cnodes\u201d in the pool. The site is hosted on Alibaba Cloud in the US, but much of its text away from the front page is in Chinese.<\/p>\n

Once a wallet is linked, the site promises, users can invite other people to receive additional rewards. But to join, users must pay a \u201cblockchain miner\u2019s fee\u201d to receive a \u201cblockchain certificate\u201d for their wallet to be configured as a node. Once registered, however, the user\u2019s wallet contents can be withdrawn by the scammers at any time. The user is encouraged to deposit more and more into the wallet to increase returns, but will eventually find that they can neither withdraw their crypto nor actually cash out any alleged rewards.<\/p>\n

An examination of domain records found a host of similar domain names pointing to the same server:<\/p>\n

Wwv[.]trxusdt.vip<\/span><\/p>\n

eth-usdt[.]group\u00a0<\/span><\/p>\n

trxusdt[.]vip\u00a0<\/span><\/p>\n

coinbase-usdt[.]cc\u00a0<\/span><\/p>\n

ercusdt[.]vip\u00a0<\/span><\/p>\n

cyth-usdt[.]com\u00a0<\/span><\/p>\n

We have shared details of this particular scam with Coinbase and other organizations. But this is hardly the only liquidity mining scam out there. \u00a0We are continuing to collect information on other scams, including several we\u2019ve identified that use fake mobile applications on both Android and iOS to offer a more convincing front to their fraud.<\/p>\n

Protecting potential victims<\/h3>\n

Success has bred copycats in the crypto scam world, and each new variant of the schemes developed by those trying to expand on the CryptoRom\/ sha zhu pan playbook tries to expand the pool of potential victims in different ways.<\/p>\n

A lack of protections, regulation, reliable information on cryptocurrency investment and international cooperation by law enforcement in ending these schemes has created the perfect cover for well-run scams. With much of the world relying on social networking sites, WhatsApp and Telegram as a source for information, the scammers have turned to these platforms to lure victims and keep them engaged until as much money as possible is extracted from them\u2014particularly targeting more vulnerable people who use these services in search of friends and companionship as well as ways to extend their wealth.<\/p>\n

To prevent even more widespread fraud, user education is vital. People need to be made aware that these scams exist, and how to spot them. \u00a0Cryptocurrency exchanges, wallet providers, and others can move to rapidly block domains and wallets associated with scams.<\/p>\n

Unfortunately, while law enforcement can take action in some cases, it is highly unlikely that these international scams can be shut down or interdicted by law enforcement alone. International cooperation, including cooperation with the nations where these rings operate from (such as China) would be required to significantly disrupt them, and others will undoubtedly spring up to replace any that are caught. And with entire ecosystems of web and app developers available to aid criminals\u2019 entry into these scams, the only thing that will eventually lead to their end is better defenses and education.<\/p>\n<\/p><\/div>\n

http:\/\/feeds.feedburner.com\/sophos\/dgdY<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: gallagherseanm| Date: Tue, 17 May 2022 11:52:33 +0000<\/strong><\/p>\n

Organized rings use fake apps, malicious smart contracts, and lure of big returns to swindle victims out of their savings.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10377],"tags":[11052,129,26164,10574,18513,16771],"class_list":["post-19063","post","type-post","status-publish","format-standard","hentry","category-security","category-sophos","tag-cryptocurrency","tag-featured","tag-liquidity-mining","tag-scams","tag-sophoslabs-uncut","tag-threat-research"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19063","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=19063"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19063\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=19063"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=19063"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=19063"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}