Social engineering scam that nearly cost me all of my ETH

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust.

Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave when you lend out your assets for interest. The aETH is redeemable for the underlying asset.

The scammers created a fake NFT project associated with space and drones, and proceeded to give Thomas a free one, but asked that he stake it (or deposit it into a smart contract), to earn yield in the form of Armstrong ETH, a token they made up that had the same acronym as Aave's (aETH).

The catch was that when he went to stake his NFT, they asked for an approval for spending aETH from his wallet. Approvals such as this are normal when interacting with smart contracts, since the contract has to be "delegated" responsibility over the tokens in order to move them. However, what wasn't normal is that the approval was actually for Aave ETH.

If he had only looked at the front end of the scam site, it wasn't obvious what was going on. However, a quick glance at Etherscan revealed that he had signed off on an unlimited spend approval for Aave ETH.

Luckily, he had done so on a fresh wallet and not his main wallet that has $100M in aETH. When the scammers tried to get him to stake a second NFT from his main account, he got suspicious and discovered the truth.

This scam was specifically targeted at Thomas, and orchestrated over multiple weeks, for the specific assets in his primary wallet.

Couple takeaways:

- divide your assets across multiple wallets. New wallets are free. Don't put all your eggs in one basket.

- use a hardware wallet or an audited battle tested smart contract such as Gnosis Safe for storing significant sums of money.

- always verify your transactions

- avoid associating your public identity with your main wallet / vault address

- be careful, scammers are getting more creative and advanced in technique including standing up professional front end websites to give the appearance of legitimacy

If a scammer scams you out of a scam, do you come out ahead?

Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets?

I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me.

Fabulous comment, by the way. Easily one of the top ten in the last month. Thank you for the breakdown.

Meanwhile I wish someone would come over to take one of my sandwiches. It turns out that human contact in covid’s era is hard to come by.

You’re probably right though. But if you ever find yourself near Lake St Louis, MO, feel free to raid our fridge.

Yes, he has $100M+ in Aave Eth in one wallet. You can see this on etherscan