The address-poisoning attacker who allegedly tricked a user into sending them $68 million worth of Wrapped Bitcoin (WBTC) has sent $153,000 worth of Ether (ETH) back to the victim in an apparent show of good faith. In the same transaction, the attacker sent a message agreeing to negotiate and asking the victim for a Telegram username where they can be contacted. The amount sent back represents just 0.225% of the total funds allegedly stolen.

Blockchain data shows that on May 5, the attack victim, whose account ends in 8fD5, sent three messages to an account ending in dA6D. The recipient of the message had received funds from the attacking account, labeled “FakePhishing327990” on Etherscan, through several intermediate accounts. This implies that dA6D was likely to have been controlled by the attacker.

The messages implied that the victim was willing to give the attacker 10% of the funds as a bounty and refrain from prosecuting if they returned the other 90%. The victim stated:

“We both know there's no way to clean this funds. You will be traced. We also both understand the ‘sleep well’ phrase wasn't about your moral and ethical qualities. Nevertheless, we officially admin your right to the 10%. Send 90% back. There are 24 hours for you before 10am UTC, 6th May 2024 to make a decision that will change your life, in any case.”

At 11:37 am UTC on May 9, another account ending in 72F1 responded by sending 51 Ether (ETH) (worth $153,000 at today’s price) to the victim. 72F1 had also received funds from FakePhishing327990 through several intermediate accounts, indicating it was also under the attacker's control.

In the transaction that sent the 51 ETH, the attacker also posted a message stating “PleaseleaveyourtelegramandIwillcontactyou.” They then attempted to correct their bad punctuation at 11:43 am, posting an additional message that stated: “Please leave your telegram and I will contact you[.]”

In response, the victim posted a Telegram username where they can be contacted.

The negotiation occurred after the attacker allegedly tricked the victim into sending 1,155 Wrapped Bitcoin (WBTC) (worth $68 million at the time) into their account by mistake, which they did through an “address poisoning” transaction.

Blockchain data shows that at 09:17 am on May 3, the attacker used a smart contract to transfer 0.05 of a token from the victim’s account to the attacker's account. The token transferred had no name listed on Etherscan and was simply referred to as “ERC-20.” Under normal circumstances, an attacker cannot transfer a token from another user without their consent. But in this case, the token had a custom design that allowed it to be transferred from an account without the user’s consent.

At 10:31 am on the same day, the victim sent 1,155 WBTC to this address, apparently by mistake. The address may have appeared similar to an address used by the victim to deposit funds into a centralized exchange or for some other reason.

In addition, the victim may have seen that they sent 0.05 of a token to this address in the past and therefore assumed it was safe. However, the 0.05 tokens were sent by the attacker and only appeared to have come from the victim.

When an attacker attempts to confuse victims by spamming them with transactions that appear to be coming from them but are actually coming from the attacker, security experts call it an “address poisoning attack.” Experts recommend that users carefully inspect the sending address in a transaction before confirming it, so as to avoid costly errors from these kinds of attacks.

Related: How to avoid zero-value transfer address poisoning attacks