I became a victim of DEFI scam

[IBO Panama]

Hello.


I have been recently scammed by a person who lured me to transfer my assets to a HUOBI defi wallet and plant a smart contract using a fake QR code.
I was supposed to make a USDT transaction of 25,000, which I was told to temporarily store in my wallet without knowing that it would be transferred to his wallet without my consent or transfer action.

TRONSCAN | TRON BlockChain Explorer
This is the transaction of 25,000 USDT from my Binance wallet by TRC20 to Huobi Wallet.


TRONSCAN | TRON BlockChain Explorer
And this is the unauthorized smart contract hack where my money was sent right away to the scammer's wallet. He blocked me after that.


I have already reported this incident to HUOBI wallet but they are very unprofessional and unwilling to help me or trace my money.
I am unable to trace the IP of the scammer and I do not know how this will be transferred but a friend told me to contact every exchange to trace and freeze assets to recover at least portions of what I lost.
I was in El Salvador when this happened and honestly, I do not know which law enforcement to contact.


Is there any way I can freeze this money and trace the a*****e who scammed me with a smart contract?

P.S. No Assholes

 

[polonieth]

How did the scam work?

You thought you were transferring to HUOBI but transferred elsewhere?

 

[IBO Panama]

How did the scam work?

You thought you were transferring to HUOBI but transferred elsewhere?

I was supposed to make a transaction with the scammer.
I made a tron wallet but didn't have USDT token in it, so he sent me 1 USDT to test it out,
Told me to give it to him using his QR code, i transferred using the address but said it didn't go thru.
The QR code had some smart contract planted, I transferred 25k to my own wallet and it evaporated in front of my eyes.
The guy blocked me and its been like a week.

 

[polonieth]

Ok just trying to figure out how the scam works so others don't get stung...

You created a wallet, a scammer sent you 1 USDT.

You then sent it back to him by scanning a QR code address?

This failed, then you moved 25k USDT into your wallet and it disappeared instantly?

You never entered your seed phrase anywhere, or interacted with fake front ends?

 

[IBO Panama]

Ok just trying to figure out how the scam works so others don't get stung...

You created a wallet, a scammer sent you 1 USDT.

You then sent it back to him by scanning a QR code address?

This failed, then you moved 25k USDT into your wallet and it disappeared instantly?

You never entered your seed phrase anywhere, or interacted with fake front ends?

Nope, i never told this to anyone, im quite sure that this is fake QR code that has SC hidden inside it.
This can happen to anyone trusting technology and the idea of everyone becoming their own bank and their money safe.

 

[polonieth]

Nope, i never told this to anyone, im quite sure that this is fake QR code that has SC hidden inside it.
This can happen to anyone trusting technology and the idea of everyone becoming their own bank and their money safe.

Is this actually possible?

A smart contract that automatically empties a wallet once it receives funds from elsewhere?

 

[IBO Panama]

A smart contract that automatically empties a wallet once it receives funds from elsewhere?

Yes, it happened to me.
I couldn't believe myself either.

 

[polonieth]

Yes, it happened to me.
I couldn't believe myself either.

I am pretty sure the wallet has been compromised some other way.

Struggling to see how it can be automatically emptied...

 

[IBO Panama]

I am pretty sure the wallet has been compromised some other way.

Struggling to see how it can be automatically emptied...

Contacted Huobi, they don't wanna take responsibility.
I contacted different agencies, no answers.

 

[JohnLocke]

Thank you very much for sharing your experience. I feel sorry for your lost and hope someone is able to help you at some point.

This can help others to avoid such scams.

 

[celizo]

I don't understand why you are so focused with "QR code": a QR code is just a shorcut to an address.
Obviously if you don't verify the destination address, it's stupid.

If you have created your own TRON address and you don't share you private key, there is no risk.
It's impossible that a smart contract was deployed on your own address!

If you have sent to an another address (TRON address or TRON smart contract), it's sent directly to the pocket of the scammer.

 

[polonieth]

Thank you very much for sharing your experience. I feel sorry for your lost and hope someone is able to help you at some point.

This can help others to avoid such scams.

Yes, I think it will be tough to get anything back.

I am pretty sure what the OP is describing how it happened is impossible though. The wallet must be compromised somehow.

 

[celizo]

TRONSCAN | TRON BlockChain Explorer
This is the transaction of 25,000 USDT from my Binance wallet by TRC20 to Huobi Wallet.

Just check it on Tronscan.

THoPE11pFbYYCoZkUZv8b3vg2wi78ntsJs
is it your created address?

This address has no smart contract deployed.

When 25k arrived on this address, a withdrawal has been done 8 minutes after to the address TKxTM6hKvF4ZtvD6UQLLM9Xo41XAmjatkY
with the method "transferFrom".

TKxTM6hKvF4ZtvD6UQLLM9Xo41XAmjatkY is the address you have refunded 1 USDT a few hours before.
https://tronscan.io/#/transaction/defc8de05732edf01c82697b92c8fa0c4e481312fadc1f4970dadce02200ad51
Do you have used Tronlink for instance or uniquely Huobi?

The question is who signed the transaction of 25k between THoPE11pFbYYCoZkUZv8b3vg2wi78ntsJs and TKxTM6hKvF4ZtvD6UQLLM9Xo41XAmjatkY

 

[JackAlabama]

Yes, I think it will be tough to get anything back.

I am pretty sure what the OP is describing how it happened is impossible though. The wallet must be compromised somehow.

Having programmed the one or other smart contract on ETH myself, it seems impossible.

Maybe OP has been tricked into installing a certain super great wallet/extension using this a temp fund storage which could have been hijacked by the accused party due to some planted private key derivation path etc?
You can program "watchers" for addresses and given the private key known, forwarding can be programmed.
But again, these systems are 100% safe and errors are due to human handling errors sadly and being played.