The cryptocurrency realm is no stranger to hacks and scams. Every now and then, the community gets to witness hackers exploiting the tiniest loopholes in different projects to just sprint away with a bag of cash. 2022 was the biggest year for cryptocurrency hacks in terms of the volume of assets lost. The majority of the hacks pointed fingers at the North Korean hacking group, Lazarus.
Also read: Crypto Mixer ChipMixer Shut Down for Alleged Money Laundering
In one of the latest exploits, it has come to light that an organization called PeopleDAO has fallen prey to a social engineering exploit. According to the details from the tweet released by the organization, the community treasury was exploited.
1/10
Bad news:
PeopleDAO Community Treasury on @safe has recently been exploited of 76 ETH (~$120,000) via social engineering during monthly reward payout on March 6th.
This expoloit is not related to $PEOPLE token contract.
Details below:— PeopleDAO (📜, 🤝) (@The_PeopleDAO) March 11, 2023
PeopleDAO loses 76 ETH to hackers
The details reveal that the hackers managed to escape with 76 ETH through social engineering during the monthly reward payout on March 6. However, they confirmed that the exploit is not linked with the token contract of PEOPLE.
PeopleDAO narrated how the hacker managed to pull the trick. The accounting lead mistakenly shared a link to the Google form with edit access used for collecting monthly contributor rewards. The hacker managed to gain an editing role through the link and inserted a 76 ETH payment to himself in the sheet.
4/10
Because the malicious is hidden, team leads did not find it during recheck.Then the csv with the insertef data was downloaded, and submitted to CSV Airdrop tool in Safe to distribute the reward. pic.twitter.com/hIF3eFZOtX
— PeopleDAO (📜, 🤝) (@The_PeopleDAO) March 11, 2023
The hacker managed to insert his address and hide it. This helped the hacker evade the recheck. The team also failed to notice the malicious transfer and sent 76 ETH to the hacker’s address.
PeopleDAO addressed the fact that they are working with SlowMist and also ZachXBT to track the funds. They identified that the hacker deposited the funds into HitBTC and Binance. The fraud transaction was also reported to the FBI and FTC to track the culprit and recover the lost assets.
To save the hacker, they are also offering a 10% white-hat bounty if they are willing to return the funds.
