- Binance CEO Changpeng Zhao warns users about a potential exploit on Uniswap.
- Turns out it was a coordinated phishing attack.
- Uniswap team responded quickly to solve the issue.
Binance CEO Changpeng Zhao took to Twitter (NYSE:TWTR) to share a potential exploit on the Uniswap ETH blockchain. Zhao said that approximately 4295 ETH has been stolen thus far.
Our threat intel detected a potential exploit on Uniswap V3 on the ETH blockchain. The hacker has stolen 4295 ETH so far, and they are being laundered through Tornado Cash. Can someone notify @Uniswap? We can help. Thankshttps://t.co/OV3g7ayf77— CZ Binance (@cz_binance) July 11, 2022
According to some sources, the exploit turns out to be a potential phishing campaign. The losses, though, may be substantially higher.
One of the first to sound the alarm about the assault was Harry Denley, a security researcher at Metamask. On July 11, he informed his 13,000 Twitter followers that 73,399 addresses had received fraudulent ERC-20 tokens intended to steal their assets.
As of block 151,223,32, there has been 73,399 address that have been sent a malicious token to target their assets, under the false impression of a $UNI airdrop based on their LP’sActivity started ~2H ago0xcf39b7793512f03f2893c16459fd72e65d2ed00c
cc: @Uniswap @etherscan pic.twitter.com/5W51AikFuV
— harry.eth (whg.eth) (@sniko_) July 11, 2022
Denley claims that the “UniswapLP” “malicious token” used in the phishing assault is sent to unwary users in an attempt to trick them into thinking it is coming from the real “Uniswap V3.
Users who were interested in their new tokens would be sent to a website that claimed to let them exchange their new tokens for UNI, the native currency of Uniswap.
The website would instead attempt to steal the assets from users’ wallets while sending the users’ address and browser client information to the attackers’ command center.
The attackers have spent around 8.5 ETH just on transaction fees to send the fake assets to 74,800 addresses.
The CEO of Binance later clarified that the Uniswap team was quick to respond to the attack. He also added that it was a phishing attack and cautioned users to keep from clicking any links. Following the attack, UNI dropped by 9.9% in the last 24 hours and is currently trading at $5.56.