Scammers Steal $15 Million in Crypto Through HitBTC Website Clone

Updated: 16 May 2023

Disclosure

Don’t invest unless prepared to lose all the money you invest. This is a high-risk investment, you shouldn’t expect to be protected if something goes wrong.

Join Our Telegram channel to stay up to date on breaking news coverage

In a sophisticated crypto scam, a scammer has managed to steal approximately $15 million worth of cryptocurrency by cloning the user interface of the popular Hong Kong-based crypto exchange, HitBTC. The scam, which has been ongoing for about a year, involves tricking users into activating a phishing agreement.

The perpetrator employed a complex scheme that targeted users of Bitcoin (BTC), Ethereum (ETH), Tether (USDT), and Shiba Inu (SHIB) to carry out the theft. Notably, this scam is not limited to HitBTC but also involves impersonating other prominent platforms like Coinone and LedgerX.

Hi there. The only authorized HitBTC website is https://t.co/d5IKXElU3v. Any other website is fake.

— HitBTC (@hitbtc) March 30, 2023

The scam was orchestrated through the use of a smart contract, which prompted users to link their wallets. Victims, believing they were using a legitimate exchange, made deposit transactions. However, unbeknownst to them, the malicious smart contracts tracked their transactions. Once a transaction was signed and confirmed, the scammer gained access to the user’s wallet and swiftly drained their remaining assets. Initially operating on the Bitcoin, Tron, and Ethereum networks, this fraudulent activity expanded to mimic other Web3 tools, decentralized applications (dapps), and exchanges.

Rise in Phishing Attacks

The incident highlights a concerning trend in the world of cryptocurrency. According to data from cybersecurity firm Kaspersky Lab, phishing attacks have surged by 40% between 2021 and 2022. Scammers are leveraging the allure of cryptocurrency, which is often seen as a shortcut to financial success with minimal effort.

It is crucial to recognize that crypto-phishing scams involve obtaining sensitive information, such as a user’s wallet’s private key. Phishing scams employ various tactics to entice victims, such as promising free cryptocurrency. Fake crypto websites serve as phishing pages, collecting users’ details, including their crypto wallet password and recovery phrase, and placing them into the hands of scammers.

Broader Implications of HitBTC Website Clone Attack

The scope of the scam extends beyond HitBTC, as the criminals have impersonated other reputable platforms like Coinone and LedgerX. By mimicking well-known exchanges and dapps, scammers confuse victims and widen the reach of their fraudulent activities. This highlights the need for users to exercise caution and diligence when engaging with cryptocurrency-related websites and platforms. Verifying the legitimacy of a website and never sharing sensitive information, such as private keys, is crucial to protecting one’s assets.

In response to the growing threat of crypto-related scams, the National Cryptocurrency Enforcement Team (NCET), operating under the United States Department of Justice (DoJ), has declared its intention to pursue exchanges that enable criminals to launder funds, even if they are compliant with regulations. This demonstrates a proactive approach to combating crypto-related crimes and holding platforms accountable for their role in facilitating illegal activities.

The recent crypto scam involving the cloning of HitBTC’s website serves as a stark reminder of the risks associated with the cryptocurrency ecosystem. Scammers continue to exploit the allure of digital assets, resulting in substantial financial losses for unsuspecting victims. Users must remain vigilant, exercise caution when interacting with crypto platforms, and employ best security practices to safeguard their funds. Additionally, the efforts of regulatory bodies to crack down on illegal activities in the crypto space are crucial to maintaining trust and integrity within the industry.