Crypto Project Florence Finance Loses $1.45 Million to Address Poisoning Phishing Attack

Crypto Project Florence Finance Loses $1.45 Million to Address Poisoning Phishing Attack

Crypto News – Cybersecurity has become a paramount concern in the crypto space, as the real-world asset (RWA) lending project Florence Finance recently fell victim to a cunning attack that resulted in the theft of approximately $1.45 million worth of USDC stablecoins.

The malicious scheme, which unfolded via a technique known as address poisoning, was dissected by the Web3 security platform Cyvers, who provided insights into the incident. According to Cyvers, Florence Finance inadvertently transferred a substantial sum of 1,456,162 USDC to a phisher’s wallet address labeled 0xB087.

Address poisoning is a prevalent phishing technique within the crypto realm, as Meir Dolev, the co-founder and CTO of Cyvers, explained. This method revolves around the creation of wallet addresses that closely mimic legitimate ones frequently used by users. The attackers achieve this by making slight alterations to a few characters of the original address.

The deception primarily relies on human error, particularly when individuals rely on autofill features or quick glances at their address books during cryptocurrency transactions. Unfortunately, this can lead to the accidental selection of the fraudulent, look-alike address, causing funds to be redirected to the attacker’s wallet instead of the intended recipient’s.

The Florence Finance address poisoning attack unfolded in three stages:

1. The victim engaged in a standard transaction by sending USDC to a legitimate address.
2. Scammers initiated address poisoning by sending counterfeit tokens from the victim’s address, with the same amount, to a strikingly similar destination address (the hash of the scammer’s address), closely resembling the genuine one.
3. The victim unintentionally copied the scammer’s address and transferred genuine tokens like USDT or USDC.

The ill-gotten funds were subsequently funneled through a series of transactions. The phishing wallet, 0xB087, forwarded the stolen assets to another wallet, 0x18d8, which further transmitted the funds to 0x88E2. As of the latest information available, 0x88E2 has been converting and transferring the assets to THORChain, with the eventual conversion to Ethereum (ETH).

Despite these suspicious transactions occurring, Florence Finance has not yet made any official announcements on platforms like Twitter to inform the community about the incident.

Deddy Lavid, co-founder, and CEO at Cyvers, emphasized the pressing need for more robust security measures in the digital finance sector. He underscored that their investigation had revealed the attack to be a well-orchestrated phishing scheme, shedding light on the importance of heightened vigilance and advanced security protocols.

Furthermore, Cyvers is actively collaborating with Florence Finance to bolster their security measures and shield them against future phishing attempts.

These events underscore the escalating necessity for heightened security measures within the Web3 industry, as multi-million-dollar attacks continue to pose a substantial threat. In a recent case, the decentralized exchange (DEX) aggregator KyberSwap suffered losses exceeding $45 million due to hackers. Additionally, hackers absconded with over $100 million from Justin Sun’s HECO chain and the cryptocurrency exchange HTX in separate incidents.