The team at Forta Network has sounded the alarm about a new version of the Sleepdrop scam. This version of the scam uses NFTs and verified nodes to mislead users into thinking they are interacting with a legitimate airdrop.
Forta Network is a California-based security and operational monitoring network for portfolios, developers, and investors. Lido is one of their users. The scam was discovered by the Forta community when a new Lido NFT was moved to one of the Forta multitasking wallets.
A new kind of SleepDrop scam
After Lido confirmed that it was not an NFT source, the Forta community studied it and discovered that it was a scam.
The scam process involves several steps. First, the scammer creates an ERC-1155 pool (NFT pool) impersonating a legitimate team. Then, the fraudster transfers most of these fake assets to a legitimate contract that has previously conducted an airdrop.
Then, the scammer runs the contract’s airdrop function to distribute the NFTs to multiple addresses. To deceive recipients, the description of the NFT includes a phishing URL embedded in it.
The main difference between a traditional sleepdrop and this scam is that the scam offers NFT as a fake reward. This makes it look more authentic than an ERC-20 token that includes a URL.
The fraudster’s contract is verified, but it delegates execution logic to another unverified contract. This can fool targets into thinking they are interacting with a verified contract. In fact, the important implementation logic lies in an unverified contract, which leaves them vulnerable.
Do not interact with unknown icons
In a discussion with BeInCrypto, Forta Network researcher Christian Seifert gave some tips for staying safe.
“Don’t interact with any code you receive randomly. Even if the sender appears to be a legitimate team,” Seifert said.
“Analyze the contract you are interacting with: who the publisher is or how long they have been in. Check the official social media of the forensic team where they may have reported the scam.”
However, the source confirmed that in the case of this Sleepdrop scam, the company’s social media may have been hacked.
BeInCrypto covered the original Sleepdrop scam when it first came to the attention of the Forta community. This scam works by simulating the appearance of a real token through a technique similar to “sleepminting” in NFTs.
So far, scammers have impersonated tokens from Uniswap, Chainlink, Lido, Circle, and others.
Disclaimer
Adhering to the Trust Project’s guidelines, BeInCrypto is committed to providing unbiased and transparent reporting. This news article aims to provide accurate and timely information. However, readers are advised to independently check the facts and consult with a professional before making any decisions based on this content.
