After reading this, I gasped. How was $100 million almost defrauded?

This article is based on the views of Arrow founder thomasg.eth on his personal social media platform:

Over the past two weeks, I was targeted by a high-level scammer that nearly cost me all of my ETH. I was lucky enough to escape unscathed, so I wanted to share my story with you.

I am the founder of Arrow (a DAO dedicated to building an open source air taxi platform). We are still in the early stages and focused on growing the team, so we are open to contributors and will not turn anyone away if they are willing to help.

Two weeks ago, a user named "heckshine" joined our Discord and started introducing himself. According to him, he currently works at Ubisoft, providing assistance with 3D design and animation. The content and language of the message were a bit strange, but I just attributed it to the language barrier.

Heckshine has another friend who is passionate about VTOL. She is working on a metaverse project, and her brother-in-law is the vice president of Boeing. Isn’t that impressive?

In the following days, heckshine began to work on various animation projects for Arrow, including designing an anime hero image for the website, making some aircraft renderings, etc. He impressed us with his dedication to the project.

At the same time, Heckshine contacted his friend Linh, who was apparently also interested in our project. Heckshine asked me to send her an email. From what he told me, it seems that Linh is his friend who has connections at Boeing.

Linh sent me a very nice email back, telling me about the metaverse project she was working on, Space Falcon. I wasn’t really interested in the project, but I wasn’t really an NFT player either, so there was no reason to reject her idea.

Sure enough, she told me more about her connections to Boeing and Wisk, and offered some ideas for Arrow. She seemed eager to help us with a potential partnership with Boeing. Again, the tone of her email was a little odd, but I chalked it up to a language barrier.

After moving the conversation to Discord, we started talking more about our respective backgrounds and ultimately decided to bring her on as an advisor for the project. She offered her guidance and advice to help us figure out partnership issues, and I was excited for her support.

Later, she told me more about Space Falcon, and I felt that this NFT project was similar to other "get rich quick" projects. But given her contribution to Arrow, I had to show some support in return.

Space Falcon uses a token called Armstrong Wrapped Ether (aWETH). I was too lazy to study it in detail, but its basic logic is that users rent NFTs and holders receive corresponding passive income. I told her that this model sounds good and I am happy to keep up to date. Linh also agreed to keep in touch with me, and then I started to do other things.

I privately looked up Space Falcon, which seems to be a fairly popular gaming project on Solana, and I also saw Linh’s name on the team page.

Over the next 10 days, heckshine remained active in Discord every day and produced some super high-quality renderings. Although they were not particularly airworthy, he was very happy to be able to help, so I thought that these designs could be improved through some iterations.

I can't overstate how dedicated and sincere heckshine was throughout the process, we were largely aligned on the vision and I was delighted that he was so passionate about what we were doing.

Until yesterday, when things started to get a little weird.

At that time, Heckshine and I had been discussing the design of our v1 aircraft. He had obtained the parameters of the entire configuration and was ready to start rendering after getting up in the morning. But Linh suddenly told me that Wisk’s executives agreed to invite me to visit their workshop.

This seems ridiculous now, but at the time I had no reason not to trust Linh, and we were really touched by his efforts for us. We set a specific itinerary, and the Wisk executive also sent me a formal invitation via email.

As we chatted, Linh started telling me about the Staking application they had just launched and offered to send me the NFT. At this point, I should at least provide them with some experience support.

So I asked her to send the NFT to my hot wallet, but she sent it to my main wallet instead, saying it was worth a lot, and I was like, no big deal. Right?

She sent me some instructions for the Staking app, and the website looked pretty good, with three transactions listed: Approve NFT, Approve aWETH, and Staking. The Approve aWETH step seemed a little strange, but since I didn’t have aWETH, I wasn’t worried.

Here’s why I feel so lucky: Since this is a new project, I decided to transfer the NFT to a new ETH address before staking to prevent it from being used by others, etc. The staking process went very smoothly and I also made a profit from it.

I shared my experience with Linh, and she then offered to send me some other NFTs, but wanted me to deposit them into my main account to help their community grow further.

It was a bit annoying, but I agreed. But after I told Linh that I would read through the contract before depositing the NFT into my main account, she started to get aggressive, and that’s when I started to realize something was amiss.

I quickly opened etherscan to check the address of the NFT I had pledged before, and my whole body instantly turned cold...

The aWETH I approved was not Armstrong WETH, but Aave's Aave WETH. If I complete the approval on my main wallet, I will lose all my ETH...

I immediately blocked both people, and they also started deleting their Discord messages after realizing something was wrong. As some kind of last-ditch effort, Linh sent me 0.2 ETH to pay for the gas fee, asking me to return their NFTs, although I don’t know what the logic is.

I later looked further into the contract that authorizes spending of aWETH and discovered a truly terrifying feature. These scammers were able to transfer any amount of aWETH from my account using the following section.

I eventually found their funding source on etherscan — a 100 ETH Tornado Cash deposit. These guys are well-funded and super savvy.

I have to assume they hired a 3D design contractor who did most of the work on Heckshine. From what I understand, they also built a custom contract and front end specifically for this scam.

What about SpaceFalcon? As far as I know, it is a real project on Solana, but the real project uses spacefalcon.io, while the scammers use .com. So the "Linh" who had been interacting with me before might just be an imposter of the real Linh.

Through this, I also summarized some key points of experience:

1. Approval tokens can be very dangerous, be very careful with them. If possible, try to limit approvals.

2. Scammers are getting smarter. Before this, the best scam I encountered was basically "Hi, I'm tech support, please share your private key so we can help."

3. Always do your due diligence, no matter how much you trust a project. These guys spent two weeks researching my specific weaknesses and nearly fooled me.

Although I was very lucky to get through it all with minimal injuries, everyone should still be extra careful!

Original author: thomasg.eth, Founder of Arrow

Original translation: 0x137