- Scammer created a fake address similar to one of the United States Marshals Service
- DEA sent $55,000 to the address without checking it
The US Drug Enforcement Agency (DEA) fell for an ingenious cryptocurrency scam, losing over $50,000 in funds seized over the course of a three-year investigation into the use of digital assets to launder money from drug sales, Forbes Magazine reported.
In May 2023, the DEA seized Tether worth more than half a million dollars from two Binance accounts it suspected criminals were using to funnel drug proceeds. Agents placed the funds in accounts the DEA controlled.
Variation on the airdrop scam
A scammer vigilantly observing the blockchain noticed the DEA sending a small test amount to the United States Marshals Service, which is part of standard forfeiture procedure. He created a cryptocurrency address with the same first five and last four characters of the Marshals account.
He then sent a token to the DEA account so it would resemble a test payment. This tricked agents into thinking the Marshals’ address was the same as the scammer’s address. Crypto addresses are very long and few users take the time to check them, opting to copy and paste instead.
Money disappeared at the speed of light
In a single transaction, the agency sent the scammer over $55,000. The US Marshals caught wind of the error and alerted the DEA, who contacted Tether to freeze the fake account, but the money was gone. A similar NFT scam occurred via Twitter last year.
Large shifts of ether: a cause for concern?
The DEA and the FBI found the scammer had converted the funds into ether and moved them to a new wallet. According to Etherscan data, the scammer has been moving large amounts of ether in recent months. His wallet contained almost $40,000 in ether at the time of writing, and $425,000 in ether has been transferred to it since June. He moved more than $300,000 of that to seven different wallets in less than a month.
The large shifts are part of a broader trend. A record $123 million ether redemption took place on July 24.
The hack was successful because it took advantage of the DEA’s reliance on checking only the first and last characters of the crypto account number.
