How a crypto scam pushed Ethereum transactions to an all-time high – DL News

A version of this article appeared in our Decentralized newsletter of January 20. Register here.

GM, Tim here,

Ethereum transactions are skyrocketing, but scams appear to be behind the increase.

On January 16, daily transactions reached an all-time high of more than 2.8 million, according to data from BitInfoCharts. On the same day, new Ethereum addresses created in the last 30 days surpassed 12.6 million, the highest rolling total ever, according to Etherscan.

However, the record increase in transactions was mainly caused by a massive address poisoning attack, according to research by Andrey Sergeenkov, an independent journalist. Blockchain security experts have reviewed the research.

“Massive address poisoning attacks are a persistent problem, and it’s getting worse,” Gonçalo Magalhães, head of security at Immunefi, a crypto security and bug bounty platform, told me.

Address poisoning attacks are a type of crypto scam in which attackers send small amounts of crypto from a similar address to a victim’s wallet.

The goal is to trick the victim into mistakenly sending funds to this address thinking it is legitimate. It relies on clunky user interfaces, lack of warnings, and negligence on the part of the victim.

Such attacks are like spam phishing emails: inexpensive and with a low success rate, but if only one or two of the thousands of targeted people fall for the spell, it’s worth it for the attacker.

The losses inflicted by address poisoning attacks can be enormous. Last month, a crypto user lost $50 million after falling victim to it, according to Scam Sniffer, a crypto security platform.

“In the last seven days alone, we have detected more than 1 million address poisoning concoctions per day on Ethereum, highlighting the scale at which these campaigns are currently taking place,” Michael Pearl, vice president at crypto security firm Cyvers, told me.

Ethereum’s Fusaka upgrade in December helped lower transaction costs, expand the blockchain to more users, and open up new use cases.

But it’s a double-edged sword.

Increased bandwidth also means that massive address poisoning attacks have become much less costly for fraudsters to carry out.

Additionally, Magalhães said, recent upgrades to Ethereum’s user experience, such as those enabling account abstraction, have made it easier for users to inadvertently sign a transaction they don’t fully understand.

So what can be done to combat such attacks? Stop Ethereum users from falling in love with them.

Just as services such as Google’s Gmail scan email attachments for viruses and warn users of attacks, crypto wallets must also provide warnings to prevent users from falling into the trap of address poisoning.

“Portfolios need to clearly convey intent and make risk apparent,” Magalhães said. “We also need to adopt more naming systems like ENS because human-readable identifiers make lookalike address attacks more difficult. »

Some wallets already include features to help users avoid address poisoning.

Rabby, for example, alerts users if they have never interacted with an address before when sending funds, evaluates potential transactions for suspicious activity, and flags phishing-related transfers in a user’s transaction history.

But until more wallets adopt these features, crypto users will need to remain extra vigilant.

Best DeFi Stories of the Week

This week in DeFi governance

VOTE: Lido DAO decides whether or not to reform its rewards sharing committee

PROPOSAL: the debate on the Optimism OP buyout plan continues before the vote on January 22

VOTE: Aave DAO votes on the deployment of Aave v3 on the Mantle blockchain

Article of the week

Gold continues to outperform most major crypto assets, hitting an all-time high of over $4,725 on Tuesday.

Tim Craig is DL News’ DeFi correspondent based in Edinburgh. Contact us with advice at tim@dlnews.com.