Email phishing scam targeting BlockFi, FTX creditors reels in millions and counting

An Ethereum wallet with an ENS name too crude to publish has amassed millions of dollars over the past week in cryptocurrency and NFTs in what appears to be a sophisticated scam operation. 

Security expert Plumferno first flagged the operation in a thread on X, who said with the help of a few friends she was able to uncover the source of the wallet's stolen crypto: a series of phishing emails purportedly sent from crypto firms BlockFi and FTX, and possibly others, to creditors of the now-bankrupt companies. 

It's possible that the hacker obtained the list of email addresses from data originally stolen from email service Mailer Lite, which was hacked in January, leading to a separate phishing scam that reeled in big bucks, Plumferno said. 

This email, purportedly from BlockFi, is actually a sophisticated phishing attempt.

"The worst part of this scam is that most of the assets have been stolen from dormant wallets - people who were likely affected by the BlockFi bankruptcy and haven't touched the funds since," Plumferno wrote in her thread. "It may also be likely that some of these victims are still unaware they've been robbed."

Blockchain data reviewed by The Block shows inflows of nearly $4.5 million in ether into the wallet since March 17, with more transactions arriving by the second. In addition, the wallet appears to have stolen and sold several high-value NFTs including Mutant Apes, Otherdeeds, and more. 

Crypto phishing attacks are an increasingly common vector of attack for cybercriminals, with $300 million stolen in such attacks last year alone. Even experienced figures in the crypto industry occasionally fall victim to such scams, underscoring the need for care when interacting with new protocols.