Malicious Crypto App Steals $1.82M from Users
Blockchain security firms SlowMist and OKX Web3 Security found that BOM turned out to be a deceitful mobile application which stole $1.82 million in digital money from users.
The app tricked users by appearing as a normal crypto tool and illegally read access to their private wallet data to steal thousands of dollars in cryptocurrency.
On February 27, SlowMist confirmed unauthorized BOM transactions starting on February 14. Special agent research showed that the application tricked users into letting it scan device storage for private keys when users granted it file access. The attackers used this stolen data to send it over a distance to their connected remote server.
Hackers Exploit BOM App to Steal Crypto Assets
Security experts observed that BOM displayed unusual behavior when it demanded more permissions beyond required access to take photos and view media files. The security experts saw these actions as suspicious so they tracked the stolen funds on various blockchain networks.
“On iOS, the app first requests permissions, deceiving users with a message claiming the access is necessary for normal operation. This behavior is highly suspicious as a blockchain-related application, it has no legitimate reason to require access to the photo gallery.” SlowMist
The main hacker wallet at 0x49aDd3E… took stolen funds from 13,000 victims by sending them across BNB Chain, Ethereum, Polygon, Arbitrum, and Base of Coinbase.
Hackers stole cryptocurrencies from different blockchain platforms containing Tether, Ethereum, Wrapped Bitcoin, and Dogecoin. The hackers hid their path online by sending parts of their stolen money between the decentralized exchanges PancakeSwap and OKX-DEX.
Investigators found no backend servers operating during their analysis but could not identify the people responsible for the theft. These actions show the attackers want to make it hard for investigators to find and arrest them. International research partners say watch out for harmful apps and do not give access to untrustworthy program applications.
Authorities and blockchain security companies track the issue while asking users to check app authenticity before installation. Users need to realize they face crypto risks when using unverified digital asset apps while also needing strong cybersecurity protection.
