A group of cryptocurrency scammers has successfully defrauded over 42,000 victims, raking in more than $32 million since April 2023, using a unique and deceptive method, according to a blockchain security firm called Blockfence. The scammers employed a strategy that involved faking the maximum token supply by utilizing minting and burning, as well as employing code bait-and-switch tactics to fool detection systems. Pablo Sabbatella, the director of security research at Blockfence, detailed in a report that scammers would initiate the process by sending 10-20 Ethereum to externally owned accounts, and then utilize those funds to create fake tokens.
Similar to many cryptocurrency scams, the scammers injected fake liquidity into the fraudulent project, creating the appearance of a legitimate amount of liquidity pools (LPs) on Ethereum-based decentralized exchanges like Uniswap. Sabbatella explained that the scammers would implement a lock() function on the LP tokens, giving the illusion that investors would not be deceived. After artificially inflating the price of the fake token through a wash trade, the scammer would call the setUserBalance function, updating the victim's token balance to "1" and technically burning the token. Despite this, the token would remain visible in the victim's wallet, further deceiving them.
Ultimately, the scammers would remove liquidity from the LPs, causing the token value to plummet to almost zero. Notably, the scammers would return 5-20 ETH from each scam to "avoid attracting too much attention." Sabbatella also highlighted that scammers would relinquish ownership of token contracts, bypassing certain detection tools. Blockfence identified around 1,300 similar incidents on Ethereum, with scammers even creating a "Blockfence token" to exploit these sophisticated techniques. Other tokens impersonated by scammers include Wisealth, RabbitRun, DreamFi, as well as coins with names resembling popular memecoins such as AIPEPE, Purple Pepe, Pepe Chain, Pepe Race, and Baby Pepe.
According to Immunefi, a blockchain security platform, clearly identifiable fraud schemes like carpet pulling resulted in approximately $103 million in losses in 2023.
