The perpetrator initiated their scheme by funding each wallet with small amounts of Ether and subsequently deploying a proprietary token named Gemstone (GEM), which was not open source. They then proceeded to whitelist all their wallets, claiming all self-deployed tokens in the process.
đ¨Warning: 21877 sybil wallets by one person #zkSync
Let’s disclosure this individuals sybil tactics, he funded all of his wallets with very small amounts of ether, then he deployed Gemstone ( $GEM ) token that wasn’t open source. (https://t.co/UXS2O2fivg)
++ pic.twitter.com/firJbfcdfLâ Lingland 09. â (@lingland09) September 10, 2023
To facilitate transactions between these wallets, the individual even went as far as creating a non-open source decentralized exchange (DEX), allowing indirect transfers of assets.
To boost the value of GEM tokens, the attacker added liquidity with over 80 ETH to their own DEX contract. This strategic move was followed by testing the market by trading GEM tokens. Subsequently, they swapped GEM tokens claimed from the 21,877 wallets for a profit ranging from 0.6 to 0.7 Ether.
All of these transactions were automated, and executed by a bot meticulously programmed by the attacker. This approach allowed them to maintain control and avoid manual intervention.
Remarkably, the attacker adjusted liquidity as needed, achieving a $10,000 volume and 10 transactions per wallet while only incurring fees ranging from $1.5 to $2 in Ether. They carefully timed transactions across different months, weeks, and days to resemble other Layer-2 projectsâ activities.
While the extent of the attackerâs reach was limited to 10,000 wallets due to zkScan Explorerâs history constraints, Matter Labs, the team behind zkSync, is actively working to identify and mitigate the Sybil attack through GEM token claim contract detection.
DISCLAIMER: The information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.
