In the case last night, a user downloaded a fake wallet from Huawei’s official store and lost 177,000 U. Most people’s first reaction was to wonder how the store’s screening process missed it. But the second half of the story is even more worth reviewing: after getting the seed phrase, the hackers didn’t rush to transfer the funds out all at once. First, they changed the address’s permissions to multisig. The balance didn’t move, so the user thought the funds were still there. When they realized they couldn’t withdraw them, the hackers said they could unlock the funds for a fee. After the user transferred another sum, all the USDT in the address was wiped out. Even the video exposing the scam was mass-reported by paid commenters and taken down.
The most insidious step in this scam was changing the multisig settings. Most people who lose crypto only check their balance, not their permissions. Once the multisig settings are changed, the original owner is already locked out; the balance is just a number still displayed on the screen. Official stores can only screen out some risks. Once you lose control, everything is gone.
Next time you open your wallet, take a moment to check the multisig settings and permissions. That habit is more useful than blaming the store.
The most insidious step in this scam was changing the multisig settings. Most people who lose crypto only check their balance, not their permissions. Once the multisig settings are changed, the original owner is already locked out; the balance is just a number still displayed on the screen. Official stores can only screen out some risks. Once you lose control, everything is gone.
Next time you open your wallet, take a moment to check the multisig settings and permissions. That habit is more useful than blaming the store.