Crypto wallet founder loses $125,000 to fake LFG token phishing attack

The co-founder and CEO of Nest, a security-focused crypto wallet app, fell victim to a phishing attack while trying to claim what he thought was a real airdrop, draining 52 stETH tokens worth $125,000.

The LFG token airdrop, which stands for “less fees and gas,” was revealed yesterday to reward Ethereum users who have spent more than $4,269 on transaction fees since 2016, aiming to onboard them to the Solana blockchain.

One fake website, mimicking the official LFG token, popped up to steal users’ funds, taking Lou as one of its high-profile victims.

“I just got scammed out of $125k of stEth while trying to claim the LFG airdrop,” Nest Wallet co-founder Bill Lou posted on X today. 

Lou clicked on a link from an article at the top of a Google search that led to the scam website. “I saw an article guide to the airdrop and followed the link to sign a message. I didn't even question it,” Lou explained. He said he was using MetaMask instead of Nest to claim as he had a “test version installed and was fixing some bugs.” If he had used his own product, the wallet would have caught it, Lou added.

“Transaction simulation is a must,” Lou told The Block. “Nest Wallet has this built in but MetaMask lacks it completely. This could have been completely avoided.” Lou also advised users to always seek out official X accounts for links and consider multisig wallets for extra security.

Fake links and X accounts

Lou is seemingly not the only one affected by such an attack, with other victims reporting their wallets were drained after clicking on similar fake links via fake X accounts.

Acknowledging the issue, the project behind LFG posted, “We are aware of several scam accounts impersonating us and are reporting them. Please do the same and help protect your fellow users,” clarifying its official X account and website details.

A total of 400 billion LFG will be airdropped to the 387,000 wallets that qualify, according to the project, with unclaimed tokens burned in one month’s time. The token is currently valued at $0.000069, according to CoinGecko data. Some 25,000 users have so far claimed LFG tokens on Solana.

Blockaid, a web3 security provider working with MetaMask, has observed an increasing number of malicious "drainer groups" migrating to Solana, attributed to the network's growing popularity and usage in recent months.

The company warned several of its users earlier today, aiding in the protection of assets from being stolen by sites imitating the LFG token over the past several hours. “These drainers are highly sophisticated and can deceive the simulations used by Solana wallets, leading users to unknowingly sign malicious transactions,” Blockaid noted.

Updated with extra comments from Lou and Blockaid.