WARNING: New Crypto Scam on Telegram

As much as we love cryptocurrency, it is well-known that the crypto space is filled with scams. A new scam that recently popped up on our radar is worse than most, and we want to make sure everyone is aware of it and how it is perpetuated.
Read on to discover the details of the newest cryptocurrency scam that is circulating on Telegram and learn how to protect yourself and your cryptocurrency greater.

What is the Scam?

The scam is a phishing scam, and it tricks users into clicking on a malicious link. This link is good however, and while it doesn’t direct to the real site, it directs to one which is eerily similar. The link, however, tracks keyboard inputs, allowing the malicious actors to collect information to steal your cryptocurrency directly from your wallet.
To be clear, the original site is connect.collab.info, and the site scammers are sending victims to is connect-collab.info. This small change is difficult to notice with the naked eye and can trip up even those who are the best at sniffing out scams.
This scam is specifically targeting users of ERC-2612 standard tokens, as these tokens allow gas-less transfers with given permission. These transactions only require a single signature, which this scam is leeching from those who click the malicious link. They are then able to drain your wallet without you noticing.
The individuals who have become victims of this scam have unknowingly entered a fake Telegram support group which is very similar to the real support group. The real support group is under @collablandbot, while the fake group is under @colIablandbot. Can you spot the difference?
The only difference between these two usernames is that one uses two lowercase L’s while the other uses one lowercase L and a capital I. As you can see, from afar, these usernames look exactly alike.
While this scam is only currently linked to the Collabland site, we suspect that the perpetrators may set up similar scams on related websites that work with the ERC-2612 tokens.
Related: How to Tell if a Crypto Website is Legit (Complete Guide)

How is the Scam Perpetuated?

ERC-2612 tokens are specially designed with a permit function to allow future user-friendly features to be developed for these wallets. The future features would create a new generation of stablecoin-only wallets ideal for businesses and use in industry.
However, in the meantime, this permit function is actually a known weakness in the standard that these scammers are exploiting.
Basically, they get you to connect your wallet to theirs via a malicious link. Then, they trick you into signing a message that allows them to be permitted to transact with your wallet without needing you to sign each transaction. Think of it a little like giving a company permission to directly debit funds from your bank account.
Once the hacker has received this singular permission from you, they will send one massive transaction request to take all your coins. Since you have given them permission to do so, your wallet will allow them to take all the tokens you hold and will be left empty.
Since they can do this all with a single transaction, victims are left with an empty wallet before even becoming aware that they have given someone access to their wallet. The scam is usually perpetuated in under 30 minutes.

How to Protect Yourself From This Scam

This scam is extremely difficult to avoid because the real Telegram group and the fake Telegram group look so similar. We recommend not engaging with links in either group. You never know when one may be real, and another is not.
In general, a support group should be able to help you with technical and account issues without having you click a link. If they continually insist you click a link, this should be a red flag, and you should exit the group and find another way to get help with your account.
If you absolutely need assistance with a site issue, head back to the website and click on support directly from the site page to ensure you are going to the official group and not a scam one. You could also go directly from the site to the company’s social media account and get help that way.
Additionally, because the scammers are exploiting a known weakness of the ERC-2612 coins unless you absolutely need to transact in these coins, we recommend not doing so except with individuals you know.
Related: How to Identify Scam Stablecoins

Is the Scam Still Going On?

Unfortunately, shutting down a scam like this is not easy, and there are many steps that must be taken. This scam has been reported to Telegram and the original site, which the scammer is using to perpetuate their scam.
It is unclear whether or not authorities will eventually be involved.
In the meantime, as we mentioned above, if you have any of these tokens and use a site like Collabland, don’t click any links, and if you must get support, only do so from the site itself.

Will the ERC-2612 Standard Change?

The developers of ERC-2612, developed wallets with the permit transaction ability for a reason, because they want cryptocurrency to become more useful in the business world. While they may not have realized the vulnerability while they were creating the token with this feature, it is a huge vulnerability, especially when users don’t realize how the function works.
It is unlikely, however, that they will change the standard. They may update it to make it harder to give away permissions accidentally, but as far as the big picture goes, we believe this gas-less permission transfer is here to stay.
Therefore, if you hold ERC-2612 tokens of any type, you need to be on your guard, especially when it comes to clicking links or giving any sort of signing permissions. Always double-check the websites you visit and any telegram groups you join. If you are in doubt, remember to message support directly from the website and always verify who you are speaking with before giving out any personal or financial information.