Blockchain security experts have discovered a malicious mobile app that steals sensitive wallet data from users’ devices and leads to theft of more than $1.8 million in cryptocurrency.
According to blockchain security companies Slowmist and OKX Web3 Security, a fake app called Bom stole over $1.82 million on Crypto by secretly accessing users’ private keys and mnemonic phrases. In its February 27th investigation report, Slowmist reported that the first fraudulent transaction with the app was noticed on February 14th.
Stolen Fund Analysis BOM Multiple DEXS Moves from Creators | Source: SlowMist
Analysis in the chain showed the major leaks identified, further revealing that BOM is in fact a scam app and tempting victims to provide file access. When allowed, the app scanned the device storage, retrieved the wallet data and sent it to a remote server.
The app sought unnecessary permissions, such as access to photos and media, what security experts called “very suspicious” behavior.
“On iOS, the app first requests permission and deceives the user with a message that claims that normal operations require access. This behavior is highly suspicious – as a blockchain-related application, there is no good reason to request access to the photo gallery.”
Slow mist
Slowmist tracked stolen funds on multiple blockchains and estimated that the main hacker address (0x49ADD3E…) had stole assets from at least 13,000 victims and transferred funds through bases on the BNB chain, Ethereum, Polygon, arbitrum, and Coinbase.
You might like it too: Fake Phantom Wallet Violates Apple’s App Store and Releases Cryptocurrency
Stolen codes included Tether (USDT), Ethereum (ETH), Wrap Bitcoin (WBTC), and Dogecoin (Doge).
It is unclear who is behind the scheme, but Slomast analysts point out that the app’s backend service is offline during the analysis, suggesting that the attacker is already trying to cover the track. Some funds have been exchanged for decentralized exchange platforms such as Pancakeswap and OKX-Dex.
read more: ledger wallet holder loses $800,000 to fake apps
Discover more from Earlybirds Invest
Subscribe to get the latest posts sent to your email.
