A recent investigation by SlowMist, alongside imToken, has uncovered a new type of scam targeting users in offline transactions involving USDT, a cryptocurrency.

The scam involves manipulating Ethereum node Remote Procedure Calls (RPC) to deceive victims into thinking they have received funds that are not actually there.

How the Scam Works

First, the scammer convinces the victim to download the legitimate imToken wallet and gains their trust by sending a small amount of USDT and ETH. Then, the scammer directs the user to change their ETH RPC URL to a node controlled by them, making it look like the user has more USDT than they actually do.

When the victim tries to transfer the USDT out, they realize they have been scammed. By this time, the scammer has disappeared without leaving any trace.

Potential Risks with RPC

SlowMist warns that understanding RPC is crucial in preventing such scams. RPC allows users to interact with blockchain networks and perform actions like checking balances and making transactions. Connecting to unsecure nodes can result in unauthorized changes that lead to financial losses.

Identifying Suspicious Addresses

Further investigation revealed that addresses involved in the scam are linked to multiple fraudulent activities. A known victim's wallet address received funds from another address, which then transferred USDT to other addresses flagged as "Pig Butchering Scammers" by MistTrack. These addresses have been associated with various trading platforms and multiple scam incidents.