QUANTSTAMP - Phishing during ICO - 60 ETH stolen - Bounty of 5 ETH

[Par Paranga]

On the shapeshift address, I noticed most of the transfers are incoming, and only one outgoing transfer; so I follow that one!

I guess that this address belongs to the scammer:

https://etherscan.io/address/0xe9319eba87af7c2fc1f55ccde9d10ea8efbd592d
 

TxHash:

0xc5a46b53e6f3a8db326e871f635a823761bf8087f26df36c3ba656d94e5e99bc

TxReceipt Status:

Success

Block Height:

4590150 (51 block confirmations)

TimeStamp:

16 mins ago (Nov-20-2017 07:19:57 PM +UTC)

From:

0xe9319eba87af7c2fc1f55ccde9d10ea8efbd592d

To:

 Contract 0xe94b04a0fed112f3664e45adb2b8915693dd5ff3 (Bittrex_2)  
 TRANSFER  38.9993106 Ether  to  0xfbb1b73c4f0bda4f67dca266ce6ef42f520fbb98

Value:

 38.9993106 Ether ($14,275.70)

Gas Limit:

 135546

Gas Used By Txn:

 34470

Gas Price:

 0.00000002 Ether (20 Gwei)

Actual Tx Cost/Fee:

 0.0006894 Ether ($0.25)

Cumulative Gas Used:

 231948

Nonce:

 1045



https://etherscan.io/address/0xfbb1b73c4f0bda4f67dca266ce6ef42f520fbb98

https://etherscan.io/tx/0xc5a46b53e6f3a8db326e871f635a823761bf8087f26df36c3ba656d94e5e99bc#internal

https://etherscan.io/address/0xb90e84fd1868483e9d2c61651c99364187a15b1b

https://etherscan.io/address/0x5892a2d11a3787dadc743cfd5ca61d90e1bf8c62

https://etherscan.io/address/0x5592306b747c0730e9ef01fc3f144c533cb81dae

https://etherscan.io/address/0xb37760eb1df9255950effa2bef4204efd0a3f1d8

https://etherscan.io/address/0xc4119f0db08f6a02141fcaa65eac07747529db4e

https://etherscan.io/address/0x7a5c5aa9a5575a746334a68ee6f39810c7d86942

https://etherscan.io/address/0x60059a8853ab0937ae6dbfc7673e494be358c3c2

https://etherscan.io/address/0x17e98e874a4b034b7b46ad7b0bee6421bdcb0a7e  --> 1,001 Ether

https://etherscan.io/address/0xaf3e38ae67c976f7ea03177c946853122a57f13a

https://etherscan.io/address/0xda33ac9363342c3cf11c6dbbd6abaeddd7494c94

https://etherscan.io/address/0x870e91067737fa1711029eccfb60d18a34edbe9d

https://etherscan.io/address/0x526d1d7670f9e4402a981da50eba0ac5309d07c5

https://etherscan.io/address/0xc4026cbc9a91a929152afcfe3497c02e40a78812

https://etherscan.io/address/0x885344ecc732427b007f21ebd78ecf157a967af5 --> 1,001 Ether  - Final Wallet


No this games goes on ...

[1713290145]

1713290145

[1713290145]

1713290145

[Par Paranga]

https://etherscan.io/address/0x5433004b47c70d29d60335387897a8469ab6edc6

https://etherscan.io/address/0x910e473c87253f47d87431d38e4b0057fe8e0a02

He takes a break now on this 1,001 Ether wallet :

https://etherscan.io/address/0x9ea44cbec4fa9069af5235dac8b3a05e0891ab95

[Par Paranga]

The scammer is using a part of the stolen ETH, to buy BAT tokens.

https://etherscan.io/address/0x3feedd6a7028dd56dc0bd5f260371161eaf06341

And then this shuffle goes on:

https://etherscan.io/address/0x9ea44cbec4fa9069af5235dac8b3a05e0891ab95

https://etherscan.io/address/0x4e005aa5cd466d30f90df15fde80592163291f11

https://etherscan.io/address/0x9ae9642a9b4fad11d7b815a6176636fd96fc651a --> 0,2 ETH For Contract creation written by Bitrex, to create wallets

https://etherscan.io/address/0xdbda8173ff0220ce3b533725e0875a937761ed0b

[SwiftDonut]

It's always the same. Whenever an ICO is running, scammers appear and try to lure people to send ETH to their addresses! Always, and I mean absolutely ALWAYS double check, that you get the address only from the official website and not just one that looks similar.

[Vatimins]

Damn. That's too sad. I feel bad for you man. Whoever did this to you is heartless taking other people's hard earned crypto holdings. Thi just pisses me off. Why can't they just go and work their ass off in beimg better instead than spending their time hacking and scamming other people who are doing their best to earn momey. :/

[motka90]

Hi there! I have found a really nice review for Quantstamp from team ICOEvents and recommend you to read it. http://icoevents.io/en/events/quantstamp/

[investblog]

Hi there! I have found a really nice review for Quantstamp from team ICOEvents and recommend you to read it. http://icoevents.io/en/events/quantstamp/

Great article! I think, dev's will like it 

[Par Paranga]

Yes, but you have Always people who participate for the first time, and the scammers exploit everything they can.
There are alway's certain technical issues during an ICO, and then they provide a newbie with "assistence" ...


https://etherscan.io/address/0xdbda8173ff0220ce3b533725e0875a937761ed0b

https://etherscan.io/address/0x4fc85d18a2b12c045ba669af135c07f5eb29bd9f  --> contract for webwallet creation by bitrex: v0.4.11+commit.68ef5810

https://etherscan.io/address/0xf8c38a022f062dddc21805988596fc60c880da5f

Enough for today, I will continue to follow his traces tomorrow.

( Notify on Outoing (Sent) Ether Txn)

[Par Paranga]

Hi in the ICO url, I just want to show you this specific sentence:
"Whitelist was available till the 10th of November with the necessary registration in their Telegram channel and verification via the email address. There is Know Your Customer (KYC). "

I never used Telegram before, I just did what was asked, and there the scammer was waiting for me, pretending that he was from Quantstamp...

[Par Paranga]

https://etherscan.io/address/0x31af952559a877be39dc0fdb66da6e2d7be9c6f3
https://etherscan.io/address/0x0e50eb07799c7024a281278cf6f2978a0547893c
https://etherscan.io/address/0x28cc6c7cad0cd4d6d84c741ab45d6177aa72a082
https://etherscan.io/address/0x281dbbf9167959a9237a8a0f0d26dcc4433da1a8
https://etherscan.io/address/0xf970911cb314335cc98fdac11ccfd143ce3143d1
https://etherscan.io/address/0x05a20497a5f6cd971d4caf235595df3d3ab97da5
https://etherscan.io/address/0x3038013ca544618a71f860041498dd02f550a492
https://etherscan.io/address/0xee8861676352caa16565cece885ed26ab6c291e2  ==> 4 OUT transactions i.s.o. 3 !
https://etherscan.io/address/0x643eb8305a266baf3656c474f71b2d3d9036ee28
https://etherscan.io/address/0x47191d327f23a50f988898b5410f09c3ac1da82c
https://etherscan.io/address/0x47e82fdc192ae87f90803b711e16fcf8670e585b
https://etherscan.io/address/0xadcfb0b00f222d7ca1fd81489bd628e0cc497bac
https://etherscan.io/address/0x46ef51bd6f4620d360ae4b69abb749567b307f11
https://etherscan.io/address/0x987139a29d3a58a958d07d5c75e9fae6267dffb2
https://etherscan.io/address/0x40730b086c8d0af97161530e5e0e01668c91c879
https://etherscan.io/address/0x636fbd6822d78183b19e18545d59044debfe9e4e
https://etherscan.io/address/0xbcffb6e9c3547935e354dd7187ccb02cad2acf74
https://etherscan.io/address/0xe8c18ea38caf4961c73f75c8f5b09f6c8ff87d67
https://etherscan.io/address/0xd9caa4f5944613687cbc52bd9d41a30b5c3f23b9
https://etherscan.io/address/0x1a0aeb8c7ff662ff5b678c75e42e1f06f0f7bf8c
https://etherscan.io/address/0x5a91f993f4b4d025ccdb56d4b510fb64a738c950
https://etherscan.io/address/0x70b2de20b27df70dd624def44bf11a366a477be8
https://etherscan.io/address/0x9ffb368103bf0081d18c4120f3851cca31889ca1
https://etherscan.io/address/0xf54f2cd212e71267ccac791d9fb40574da09f6cf
https://etherscan.io/address/0xd74f516c357c96917f1648eef9c820aada5bc47c
https://etherscan.io/address/0x2b8e39d667314fe92db10e6d2fc6223b78575389
https://etherscan.io/address/0x59bc5505c4d507d2d7dcde0a46967eea08477ad7
https://etherscan.io/address/0xfa5b0029e5e827895e57f88c303aff94efc2e5a6
https://etherscan.io/address/0x66147b9a5aa2139d68f0d455775eb25dac2beb36
https://etherscan.io/address/0x810416defa0945a800b8e40954fc866ccd860bf8
https://etherscan.io/address/0x13414336b9804f4c1a609b305552df1e9e8cc583
https://etherscan.io/address/0x1646b8db95258111f801d2add81ad2251dc11fcd   ==> 4 OUT transactions i.s.o. 3 !
https://etherscan.io/address/0x34b479d171e0dc3011c616e28ef18960d94d67bb
https://etherscan.io/address/0xe8827aa661001aff9dc67fbaca88a2c0868a51b9
https://etherscan.io/address/0xc02416ac7e97a8a685496e7719712b41b9a1aedb   4 OUT transactions
https://etherscan.io/address/0x623397f13a95c2766dd25ab3388552c2e600bd00
https://etherscan.io/address/0x7588328c2e06af05bbd5e97c4e5ce3b732c8c051
https://etherscan.io/address/0x5a54add9e1ccedec3495285fbb486a485d08993b
https://etherscan.io/address/0x0b0c7b24a5d97eeb5edff1fb618e23ca69ff5393
https://etherscan.io/address/0xa2539c0b29b7776927730b1b250324db1b5577d9
https://etherscan.io/address/0x05bb53f483c77f29cfca218cf1756626a0b0e873
https://etherscan.io/address/0xb97b4562e5337cf5c4039c4ce31eb1dc8c2f361a
https://etherscan.io/address/0xf191be1b17a79ccfaffbc477ad84a5858db1a10e
https://etherscan.io/address/0x4a9b5505bf9169aca40882b11ccf7ea19855b8f8    4 OUT
https://etherscan.io/address/0xeeb5a4257fbc0567189b5e5e6bd6129f322b787b
...
https://etherscan.io/address/0x9820c26e41776b180c8df99a2dbeb77fed9c19d8
https://etherscan.io/address/0xaa0dc06d767864bbb4715b311e553f2515e80374  (Nov-21-2017 05:59:08 PM +UTC) 1,001 Ether  $369,308.94

I will follow the money tomorow again, to find out the final destination of these stolen Ether.

[Par Paranga]

He is shuffling these 1000 ETH from wallet to wallet 24/7.
Creating new wallets automatically with Smart Contracts, I suppose
It looks like that he is on the run on the Etherium Blockchain...
I wonder if it is programmed to keep the shuffle of this criminals wallet ongoing 24/7.

Nov-22-2017 04:17:06 PM +UTC
https://etherscan.io/address/0x7959ce51b1a0c6bd4b84e8e49340d1c843618afd
https://etherscan.io/address/0x739432e066fdc59c660e70e14fe30922d8e970a6

[Par Paranga]

The wallet with my stolen ETH is still moving the 1000 ETH from wallet to wallet :

https://etherscan.io/address/0xf94edfc8acd9deefc3ac024e61c3a889fb8e14fd

Is there someone who can explain this technique of the cyber criminal.
Is he afraid that the 1000 ETH are staying to long to a wallet ?

[Anonymous Kid]

You can do nothing  60 eth is actually nothing in this space, because of multi signature wallet contract issues, projects lose millions of dollars and they did nothing because it is impossible to do anything normally 

Agreed. Unfortunately, the amount lost is peanuts compared to the other things going on in the space. The best thing to do is learn from this and remember; ALWAYS CHECK THE LINKS.

[Rexler]

You can do nothing   60 eth is actually nothing in this space, because of multi signature wallet contract issues, projects lose millions of dollars and they did nothing because it is impossible to do anything normally  

Agreed. Unfortunately, the amount lost is peanuts compared to the other things going on in the space. The best thing to do is learn from this and remember; ALWAYS CHECK THE LINKS.

The issue of theft and scams is a major problem in the crypto space. I've come to realize that being decentralised means there's no central entity that can help track and recover stolen  funds. We'd have to be careful.

[Qunenin]

https://etherscan.io/address/0x95869cee6f20f44940f8eebb2f1bd2db804c531c  is a fake ETH address, used by a robber
during the Quantstamp ICO of 17 November 2017

Via Phising initiated via the dedicated Telegram channel, myself and 8 other people were directed to this fake URL: https://ethercsan.io/address/0x95869cee6f20f44940f8eebb2f1bd2db804c531c

Please join forces to reclaim all these stolen ETH!

The scammer also created and used false ERC20 tokens, in an effort to convince the 9 Phissing victims to use this FAKE address during the ICO.

I start with a bounty of 5 ETH, for any person who can help to track the person behind this SCAM.

If the other victims read this message please respond, so that we can increase the bounty.

The real address to use during the ICO was : 0xaD41548Fa92921597Da3AE783a330396B47Cba3C

Best regards

P.P.

Well, sorry to hear yet another scam attempt in the name of ICO. I think you will be able to catch the real scammer because you only have his ETH address and that is insufficient to detect any person. This is one feature of digtial currency which is being misused a lot by scammers as they know they do not have their identity associated with the ETH  BTC addresses and they do crime with much more confidence.