void1nd3x🔺️

here's a technical explanation of how that phishing exploit worked Comming from a WAPT security professional, being in the industry for 3+ years as bug bounty hunter 1. Phishing is a part of social engineering which is not exactly hacking 2. the code involved here was to hack the mind of user not the system --- how that phishing attack worked 1. Its all because he was able to trick @dqn4861 into beliving that another tweet was part of main tweet, so he followed along with all the action thinking it was from team 2. i checked the code, he just copied our previous version of website with it's UI saying "connect wallet", there nothing so much special, other than a specific js code he externally added 🔗 link : [proposal-dqn.com/ ] 3. here he obfuscated the function and variable name and wallet address, to prevent it from being easily understandable by anyone* --- also why i said this attack was highly sophisticated 1. obfuscated function and variable names and attacker wallet address 2. used specific code to prevent it loading with developer's tool, so no one can investigate what's happened there 3. targeted human mind instead of browser, which is more secure, (method of sneaking in transfer transactions between connect wallet is kind of genius, many ppl gets frustrated and press confirm again again thinking something's wrong with his wallet or some glitch is happening) 4. domain was bought within last 24 hours 5. used combination of contract and wallet to drain funds, to evade footprinting and suspicion --- scammer's website & tweet 🔗 website: [proposal-dqn.com/ ] 🔗 Malacious js : [proposal-dqn.com/0ff4a32a-f1…] 💬 scammer's account: [xitter.cf/dgn40A ] 🕵️ Web Archive of website i took as soon as i heard @dqn4861 's wallet got drained: [ web.archive.org/save/https:/…] Token Transfer Transactions $BLUB : snowscan.xyz/tx/0xa5198069b2… $ERROR : snowscan.xyz/tx/0xa5db175bc2… POC : attached the interaction with scammer's website, which i tried to replicate with my own wallet