BeeToken’s ICO Hit by Phishing Scam; $1M worth of Ethereum Stolen

The decentralized home sharing network The BeeToken customers have been tricked into losing Ethereum worth over $1 million or £700,000 thanks to a targeted phishing scam. According to reports, the Initial Coin Offering (ICO) from BeeToken become a victim of a targeted attack due to which investors in this home sharing network’s ICO lost such a huge amount in merely 25 hours. Recently, BeeToken had partnered with WeTrust, a San Francisco based financial services provider firm, to establish a decentralized competitor to Airbnb.

The company’s ICO was launched on 31st January and until yesterday BeeToken was believed to be the best example of learning the correct way of running a crowdsale given its passionate community. It performed comprehensive KYC whitelist verification and also setup considerably low cap and contribution limits of up to 0.2 ETH in order to rope in as many investors as possible to participate in its ICO. Around 100,000 people applied, which in itself is a record.

However, when the sale started hackers somehow managed to gain access to BeeToken’s vast email list, which included names and contribution addresses and then ignited a fierce phish campaign. Hackers sent out phishing emails that appeared to be sent by The BeeToken. Hundreds of people fell prey to their trickery and contributed their investments to the wrong address.

The damage could not stay limited to the BeeToken community because hackers dispatched emails that read “The Bee Token has received reports of fake emails, Telegram accounts, etc. claiming to represent the Bee Token ICO Crowdsale” to widen the scope of damage. Scammers posed as operators at the time when BeeToken ran its token sale and they launched their own version of the sale using various email IDs such as presale_regirstration@thebeetoken.com and contacted potential buyers to sign up for the full-scale token sale.

Phishing email that hit BeeToken’s ICO. Credit: Twitter

Here is the screenshot of fake email shared by one Twitter user. Reportedly, at least $928,000 has been collected by scammers from unsuspecting investors. The attack was confirmed by BeeToken through a post on Twitter and Medium accounts. The company has warned costumers to be cautious about such emails and also avoid paying attention to Telegram if it requires sending out funds. Users who were affected by this scam noted that the hackers targeted an individual who signed up for the company’s KYC process and newsletter.

Currently, it is unclear how the attackers were able to obtain information about email list of BeeToken but some users believe that the company failed to protect customer data on Reddit forums. However, Jonathan Chou, the CEO of BeeToken, stated that it is not possible because they never store customers’ data in centralized database platforms like Airbnb.

Chou further stated that the company wasn’t “at risk of exposing all of our customers’ data in one go if there is a security breach.”

The scam involved emailing the targeted investor an Ethereum address or QR code that led to the address. The victim was asked to invest quickly to increase their returns. Three Ethereum addresses were used in this scheme [1], [2], [3], however, only two addresses have been confirmed to be used in the BeeToken scam while the third one is confirmed to be generally involved in phish scams.

To prevent users from further exploitation, BeeToken has issued a statement claiming that any email address that ends with @thebeetoken.com would be a fake and must be ignored. Furthermore, BeeToken stated that:

“We will NEVER communicate ANY funding address via any channel other than on beetoken.com. If you are solicited to send money to an address (even if it’s from a thebeetoken.com email address, official Bee Token social media accounts, or Bee Token telegram moderator/group), please report this to a moderator on Telegram (@DTodd) and email team@thebeetoken.com.” The company also clarified that it would not use QR codes and will be giving 100% bonuses and accept over 0.3 ETH and may partner with Microsoft.

11th Breach Against A Cryptocurrency Platform In Last 7 Months

1: July 4th, 2017: Bithumb hacked and 1.2 billion South Korean Won stolen.
2: July 17th, 2017: CoinDash hacked and $7 million in Ethereum stolen.
3: July 24th, 2017: Veritaseum hacked and $8.4 million in Ethereum stolen.
4: July 20, 2017: Parity Technologies hacked and $32 Million in Ethereum stolen.
5: August 22nd, 2017, Enigma marketplace hacked and $500,000 in Ethereum stolen.
6: November 19th, Tether hacked and $30 million worth of tokens stolen.
7: December 7, 2017: NiceHash hacked and $70 million stolen.
9: December 21, 2017: EtherDelta hacked and $266,789 in Ethereum stolen.
10: January 26th, 2018: Coincheck hacked and $534 Million stolen.
11:January 29th, 2018: Experty ICO hacked and $150,000 in Ethereum stolen.