Secret Service, Canadian officials confuse $4.3 million Ethereum 'approved phishing' scam

Table of Contents

Forensic analysts at the US Secret Service are working with Canadian authorities to tackle $4.3 million in an “approved phishing” attack on Ethereum wallet holders.

Authorization phishing is when a malicious attacker signs a transaction that gives users permission to use or drain a token from a crypto wallet, for example, as part of a “pig slaughter” romance scam.

A collaborative operation called an avalanche operation (which has no relation to the Layer-1 network or its avax token) searched for a breached wallet on the Ethereum blockchain and contacted the affected wallet owner who lost or was at risk of doing so.

The initiative was led by the US Secret Service and the BC Securities Commission. There was also support from the Ontario Police Department, the Alberta Securities Commission, L’Autorité Des Marchés Financiers, the Ontario Securities Commission, the Delta Police Department, the Vancouver Police Department and the Royal Canadian Cavalry Police Department. Nameless crypto exchanges and third-party blockchain analysts are also said to be involved.

Matt McCool, a special agent in the Washington Field office of the US Secret Service, said his organization “will continue to work with Canadian law enforcement and financial partners to identify stolen assets and return to the victims.”

This is not the first time the Secret Service has announced major crypto enforcement measures in recent months.

In March, it claimed it was defeated the Russian crypto exchange Garantex website as part of another joint operation, and was approved by Russian banks, including cybercrime groups and darknet ransomware groups.

The world of authorized phishing and cryptography

Approved phishing is a consistently popular and damaging type of crypto fraud.

Chain Orisis’s blockchain detectives estimated that $2.7 billion was lost due to approved phishing between May 2021 and July 2024, adding that many cases were under the radar and had not been reported.

Approved phishing attacks can target organizations, such as in the case of the $120 million badger DAO hack in December 2021, but are often directed at wealthy individuals known to be active in the crypto or NFT space.

In December 2021, the well-known collector of the NFT space lost nearly $2 million (value at the time) boring apes worth nearly $2 million (value at the time) to a variant of “approved fishing,” known as “ice fishing.”