A group of cybersecurity researchers from Stony Brook University has uncovered a new fraud scheme aimed at stealing cryptocurrencies. Their findings are published on the arXiv preprints server and have generated widespread interest in the cybersecurity community. The discovery describes typosquatting in Blockchain Naming Systems (BNS), a sophisticated technique that exploits human error.
Typosquatting in BNS is the creation of fraudulent domains similar to the official names of well-known cryptocurrency platforms. The BNS system replaces complex alphanumeric cryptowallet addresses with simple verbal names to facilitate user interaction. However, this simplification opens the way to fraud.
When a user sends cryptocurrency, they enter a verbal address associated with the recipient. But if the name is entered with a mistake, and this mistake corresponds to one of the fraudulent addresses, the currency automatically falls into the hands of the fraudsters. Due to the irreversible nature of cryptocurrency transactions, the sender loses the funds without the possibility of return. The researchers collected data on more than 5 million BNS domain names used in more than 200 million transactions across three major platforms. The analysis showed the presence of about 25,000 typosquatting domains, which pose a threat to 37% of legitimate names. Fraudsters pay special attention to the names of famous personalities, such as Vitalik Buterin, the founder of Ethereum, whose name is easy to enter by mistake.
The researchers emphasize a simple but effective way of protection: carefully check the spelling of the address before sending cryptocurrency. This step can save a lot of money and help avoid unpleasant situations.
