Bitcoin scammers impersonate police, Sunray Finance $2.7M drain: Crypto-Sec

Callers impersonated police in Colorado Bitcoin scam

As a seasoned crypto investor with over a decade of experience under my belt, I’ve seen it all – from meteoric rises to heart-wrenching crashes, and everything in between. Reading these reports is always a reminder of the wild and unpredictable nature of this space.


People living in the U.S. state of Colorado have unfortunately become victims of a fresh police impersonation fraud.

Based on an October 31 report from the local news site Summit Daily, it appears that someone posing as a representative of the local government contacted residents, claiming they owed a $10,000 fine for failing to serve on jury duty. The catch? This payment was supposedly to be made in Bitcoin.

Consequently, the victim sent over $6,000 worth of Bitcoin, but genuine law enforcement officials intervened to prevent further transfers, thus safeguarding the remaining $4,000 from the assailant.

As per the report, it’s not just this instance where BitCoin (BTC) phone scams have occurred locally. In a separate occurrence, the culprit was able to fake the phone number of the local sheriff’s office.

In this situation, multiple people received phone calls allegedly from someone identifying as “Sergeant Schilling,” who falsely stated they were due in court and threatened them with a warrant for their arrest. However, unlike in the previous instance, none of these individuals complied by sending money or disclosing personal details to the imposter.

The Sheriff’s department has stated through their report that they will not request users to transfer Bitcoin during phone conversations.

It’s essential for cryptocurrency users to understand that once a transaction on the blockchain is processed, it cannot be reversed. This means that any crypto sent to an address is non-refundable. As a precaution, when sending funds, users should verify the identity of the recipient thoroughly to avoid potential mistakes or fraud.

Sunray Finance hit with $2.7 million attack

On October 30th, the decentralized finance protocol Sunray Finance on Arbitrum was exploited for approximately $2.7 million. An attacker successfully upgraded the protocol’s contract and produced an overwhelming amount of SUN tokens (two-hundred sextillion or 200,000,000,000 trillion) as stated in a report from blockchain security firm TenArmor.

Following the attack, the intruder exchanged approximately half of the tokens for a total value of $2.1 million in Tether (USDT), which ultimately led to a significant drop in SUN’s value.

It seems the perpetrator failed to consider that there was an additional SUN liquidity reserve. Immediately following the block, an arbitrage bot bought nearly 90 sextillion SUN from the pool where the attacker had offloaded coins, and then resold these into the second pool at a profit of around $560,000 in Ether (ETH). This move caused a drop in the price within the second pool too.

Sunray publicly announced an unexpected incident involving X, referring to it as “an abrupt release of Sunray Treasury Asset Tokens.” They are actively trying to retrieve all the data and ask for user patience as they conduct a thorough investigation.

Due to the attacker carrying out an update on the contract, TenAmor proposed that the attack might have stemmed from a compromised private key.

As a savvy crypto investor, it’s crucial to understand that certain protocols come equipped with upgradable smart contracts. These sophisticated contracts are essentially split into two components: a proxy contract, which manages balances, and an implementation contract, which houses the actual code.

The person managing the system (developer or admin) has the ability to modify the underlying contract at any given moment, simply by redirecting the proxy towards a new implementation. This action might lead to adjustments in how the system’s operations are carried out.

When a protocol incorporates contracts that can be updated, it often implies that administrators hold the power to withdraw funds at their discretion. Therefore, users are advised to engage with such updateable contracts only if they possess a strong level of confidence in the developer’s integrity.

Even though the developer might be reliable, upgradable contracts could potentially be compromised if a hacker manages to steal the developer’s private key. This is the suspected scenario that occurred here.

Ramses Exchange falls victim to reward exploit

On October 24th, as reported by Blocksec Phalcon, another Arbitrum-based decentralized exchange named Ramses suffered an exploit totaling $93,000. Unlike previous instances where a contract upgrade led to losses, this time the issue stemmed from a coding flaw that enabled the attacker to empty the vulnerable contract.

According to Blocksec, the Ramses team was informed of the attack and took action to stop it.

On October 25, SolidityScan, a blockchain security company, published a post-mortem report detailing an exploit that occurred. The hacker exploited a loophole by continuously claiming rewards from a single non-fungible token, without needing to wait for the end of a new reward cycle. This repeated, unintended claim of rewards depleted the reward pool, leading to losses valued at approximately $93,000.

In 2023, Ramses underwent a review by the security company, Yearn Academy. It wasn’t clear from SolidityScan if the potential vulnerability (exploit) existed in the reviewed version or if it was introduced afterwards.

Based on the information from the report, the Ramses group admits the occurrence of the attack but assures users that their account balances remain unchanged.

Indian police say crypto scammer stole $297K

Investigators in Dhone, India are looking into allegations that a cryptocurrency fraudster swindled money from around 320 individuals spread across various regions of the nation, amassing over 23 million Indian rupees ($297,000) from the victims, according to reports from Deccan Chronicle.

It’s been claimed that Ramanjaneyulu, who is suspected of being a fraudster, supposedly assured investors that they would receive approximately 10,000 rupees ($119) each month if they invested their cryptocurrency with him. Critics assert that he boasted about having the support of well-known exchanges like Binance and OKX and also representing a herbal company specializing in organic products.

Police are still investigating the allegations, and no formal case has been registered.

Read More

2024-11-04 16:45