TOKENICATION_ is your reliable source for the latest news and analysis on cryptocurrencies. We provide up-to-date information on Bitcoin, Ethereum, and other digital currencies to keep you informed about the latest trends and help you make informed decisions.
Date: 2025-02-27 07:09:48
Security specialists in the field of blockchain have discovered a malicious mobile application that managed to steal sensitive wallet data from users' devices, resulting in the theft of more than $1.8 million in cryptocurrency.
A fraudulent app named BOM stole over $1.82 million in cryptocurrency by stealthily gaining access to users' private keys and mnemonic phrases, according to a study report published on Feb. 27 by blockchain security firms SlowMist and OKX Web3 Security. The first unauthorized transactions with the app were detected on Feb. 14, as per SlowMist.
Analysis of on-chain data led to the identification of primary leaks, which subsequently revealed that BOM was indeed a fraudulent app that deceived victims into granting file access. Once permission was granted, the app searched through device storage, took wallet data, and transmitted it to a remote server.
The app requested unnecessary permissions, like access to photos and media, which security experts deemed "highly suspicious" behavior.
"On iOS, the app initially requests permissions, deceiving users with a message claiming the access is necessary for normal operation. This behavior is highly suspicious — as a blockchain-related application, it has no legitimate reason to require access to the photo gallery."
SlowMist
Read More: "Zac Prince, ex-CEO and co-founder of BlockFi, Joins Galaxy, Led by Michael Novogratz"
SlowMist traced the stolen funds across various blockchains, estimating that the main hacker address (0x49aDd3E...) stole assets from at least 13,000 victims and transferred the funds through BNB Chain, Ethereum, Polygon, Arbitrum, and Coinbase's Base.
The stolen cryptocurrency included Tether (USDT), Ethereum (ETH), Wrapped Bitcoin (WBTC), and Dogecoin (DOGE).
The identity of the individual or group behind the scheme remains unclear. However, analysts at SlowMist have noted that the app's backend services were offline during the analysis, indicating that the attackers are already attempting to cover their tracks. Some of the funds were exchanged on decentralized exchange platforms such as PancakeSwap and OKX-DEX.
Read More: "British administration proposes legislation for seizing crypto crime earnings"