South Korea’s UpBit Temporarily Freezes Withdrawals Following Scam Token Airdrop

decrypt.co 24 September 2023 21:25, UTC

Security

Upbit, the largest centralized cryptocurrency exchange in South Korea, temporarily suspended deposits and withdrawals after reportedly mistaking a scam token for legitimate ones from Aptos ($APT).

The freeze took place on Sunday when Upbit discovered an "abnormal deposit attempt" while monitoring flows of $APT into and out of its wallet system, according to a statement. The company has since resumed account services, but cautioned users that there may be pricing differences when interacting with other exchanges after the suspension.

“There is a possibility that the price may change drastically when [$APT] deposits and withdrawals resume. Please pay special attention to the price differences with other exchanges that occurred during the suspension of [$APT] deposits and withdrawals," said the statement.

Hacker Steals Over $690,000 After Hijacking Vitalik Buterin's Twitter Account

UpBit’s issues stemmed from a system error that misread a set of airdropped scam tokens as being the equivalent of legitimate ones, said Twitter user Definalist. The account reported that the scam tokens were linked to a fraudulent website called “ClaimAPT.com,” which airdropped them into almost 400,000 wallets, according to TraceMove.

UpBit's system reportedly misidentified the false tokens as legitimate ones through a typo in the code, according to an analysis by MingMingBBS that was shared by the Twitter account Definalist.

The writing in the fake $APT tokens code reportedly led to a deposit of about $250 in affected accounts, something that Definalist said could have been worse had the scammers written the code to include two more decimals and increase the amount of airdropped to $25,000 each.

Amazing Korean exchange upbit incident today

1. The Largest S.Korean exchange @Official_Upbit , abruptly halted Aptos' deposits and withdrawals, citing a wallet system maintenance without any specific reason

2. Various Korean users have posted authentication claiming that they… pic.twitter.com/OjfCwhB4eV

— Definalist (@definalist) September 24, 2023

"If the scam token had a decimal of 8, all users would have received $25,000 instead of $250, leading to thousands of users dumping $25,000 worth of $APT, causing significant disruption," said Definalist in a tweet.

The $APT token currently has the 38th largest market capitalization at just over $1.2 billion with about $107 million in daily trading volumes, according to data from Coingecko.