Counterfeit currency is prevalent: a monthly income of one million is not a dream

This article is jointly published by X-explore and Wu Says Blockchain.Summary:There are hundreds or thousands of ERC20 Tokens being created on the chain every day, which is mixed with more than 15% of fake contracts (we call tokens that are created quickly in a short period of time, attract normal users to buy them and end their entire life cycle as fake coins).This article digs deeper into the counterfeit industry, reveals the counterfeit money profit process of the black industry gangs, analyzes the counterfeit money situation in 2022, and finally case studies the evolution of the escalation of the black industry gangs' practices. as part of the black industry expose, we hope Web3 users will be more alert.What is on-chain counterfeit currencyHundreds of new erc20 tokens are created every day on the chain, including.Token of value issued by the project owner: These Tokens will be included in CoinMarketCap and CoinGecko after a rigorous audit.
These Tokens will be included in CoinMarketCap and CoinGecko after a rigorous audit and will be traded on centralized exchanges at a later stage.Advertising Token
: Some platforms, such as gambling platforms, will distribute URLs as Token names to users on the chain. to play the effect of advertising.Counterfeit Token
: We call tokens that are created quickly in a short period of time, attract normal users to buy them, and end their entire life cycle as fake coins.This fake coin often has a short life span, surviving from a few days to a few minutes. It will be disguised as a real coin, and the powerful ones will portray a certain project, after which the creator will hide behind the drawing line, creating a k-line chart with a continuously high coin price, attracting the inflow of funds from the chain users.
The fake group will try to create an illusion by using multiple small numbers to repeatedly trade with the pool to raise the price, or to mislead uninformed users by portraying a certain project party, or to define false events in the contract to create the illusion that major exchanges, V God, Sun Yuchen and other giant whale addresses are buying fake coins.Counterfeit money profit process
(*EOA: Externally Owned Accounts External Accounts; *CA: Contact Account Contract Accounts)Each process is described in detail as follows.The counterfeit ring transfers some of the funds to a new EOA account for subsequent gas fees and to create liquid assetsUse EOA account to complete the creation of fake CA, while giving some of the designated users mint fake coins, the contract may also be hidden fake coins often have features, such as brave, fake airdropThe counterfeit ring uses EOA to create a liquidity pool in uniswap between the counterfeit coin and another valuable coin (usually WETH) in order to generate value for the counterfeit coinCounterfeit money rings use a number of tactics to achieve the goal of attracting user funds (described below)Counterfeit money gangs use the harvesting of funds to complete their profits (described below)Counterfeit gangs will launder the funds harvested and mention the coin mixer or exchange, or the funds flow into the next round of the counterfeit currency cycle (described below)Among them, the detailed breakdown of ④ means of attracting user funds, ⑤ harvesting methods, and ⑥ methods of fund flow is as follows.1. Classification of means of attracting user funds.1.1 Coin Price Inflation0xaecf2954a6c49e99e570dfaaa857c53e17a88027
From the source of funds, the fake coin creator's source of funds is the token swipe user 0xae......27; from the direction of funds to see the swipe user swipe amount 41 ETH after the remaining 9 ETH directly Transfer to the fake coin creator. can be sure that the address and the fake coin creator belong to the same identity, the trend of the coin price rise for the group initiative manipulation.
1.2 Hot TopicsThe company's main goal is to provide the best possible service to its customers.
1.3 Fraudulent transfersThe counterfeit group will transfer money to a large number of giant whale addresses through fake events, *** this transfer will not really transfer tokens to the user, but will only record the Logs of the transfer in the blockchain browser, without actually completing the operation of token transfer*** .
This is used to deceive some users who follow the giant whale, as well as to try to make the fake coin credible again.This transaction, for example, is typical of fake airdrops that trick browsers into creating fake erc20 transfer records. the counterfeit group forged tokens with the same name as the project owner LayerZero and faked the transaction logs to give the illusion that the Stargate Finance contract deployer had given airdrops to 500 on-chain megawhales. the airdropped megawhales included the addresses of exchanges such as Binance, Kucoin, FTX, etc., which would make on-chain users believe that these exchanges were about to shelve these tokens.
It is clear from the parameters submitted for this transaction that both the sender and the receiver are arbitrarily designated by the group as the two sides of the transaction, ready to construct fake transaction events to mislead the transaction decisions of the on-chain users and on-chain monitors.
In the token contract airdrop() function we learn that the function simply loops and logs 500 transfer events, with no actual token transfer.
However, the normal transfer logic should be *** Decrease the sender's balance -> Increase the receiver's balance -> Transfer logging events.***2. Classification of harvesting methods.When the counterfeit group has attracted user funds into the pool, it will obstruct the user funds from leaving the field in various ways, including quick harvesting so that users can't sell, or defining the logic of "no re-trade after users buy" in the contract, or a 100% token fee, or being blacklisted after buying, and even more outrageous is the token creator monitoring the user who bought the coins, and then actively calling the contract to burn the tokens in the hands of the user ....... After that, it's time to harvest the funds in the pool.2.1 Delete mobilityThe creator of a fake coin can add liquidity (create a transaction pair and pay two tokens to the pool) and remove liquidity on Uniswap at any time without any audit or permission, which directly results in the creator being able to add liquidity to any token, including the fake coin, and the creator also has the right to withdraw the pool liquidity to get back all the two tokens, so many fake coins will remove liquidity as the owner when the value of the tokens in the transaction pair is the highest, thus getting all the tokens in the pool and completing the harvesting of user funds.
2.2 SmashThe counterfeit creator holds the highest authority over the counterfeit coins and can mint a large amount of counterfeit coins at any time, or use the large amount of counterfeit coins issued to him when creating the contract to instantly empty the counterfeit pool of all the other valuable tokens, and unlike the deletion of liquidity, there will be a large amount of counterfeit coins and very few other tokens in the pool at this time, and the authority in the creator's hands will ensure that he can harvest repeatedly in the future.3. Classification of fund flow methods.The gradual improvement and mixing of money flow techniques will make it difficult for others to trace and track, and can largely avoid the attention of others and make a big fortune for themselves.3.1 Direct TransferThe direct eth transfer is the crudest way, the initial way of money flow for the group, and represents the most rudimentary but most convenient technical means for the group to begin with.
3.2 via 1inch TransferAt this stage, the group uses 1inch's swap function to replace the WETH earned from counterfeiting with ETH and sends it directly to a new address, hiding the flow of funds in a swap interaction with 1inche, a transaction that is less traceable.
3.3 Transferring funds via uniswapThe group uses addresses with large amounts of counterfeit coins to smash into the pool of trading pairs, sending the profitable WETH directly to the new address in preparation for the next fake issue), thus hiding the large amount of WETH in the etherscan transaction list. the transaction list of the upstream address only sees the large amount of counterfeit coins flowing into uniswap, which is harder to track.