Upbit Handles Fraudulent Aptos Tokens

On 24 September, Upbit users received fraudulent ClaimAPTGift tokens as part of an airdrop without submitting the corresponding request. The exchange’s system treated the asset as Aptos (APT).

⚡️How did such a huge and foolish incident occur?

— It seems that during the process of reflecting $APT coin deposits, there was a failure to check the type arguments, and all same functions transfers were recognized as the same APT native token.
— Under normal circumstances,… https://t.co/CvDgTdqnGl pic.twitter.com/8gEx5YnOLH

— Definalist (@definalist) September 24, 2023

According to Definalist, the only explanation for the situation is that the wallet management system checked only the token type and data, without proper verification of its source code.

“It seems that during the processing of APT deposits there was a failure to check the type arguments. All transfers of the same functions were recognised as the APT coin. If all tokens of the Aptos ecosystem had been sent to the Upbit wallet, they would have been erroneously identified as APT,” he explained.

Definalist, citing the creator of _TUNA_BOT under the handle Mingmingbbs, noted that the catastrophe was averted by the fact that the price of ClaimAPTGift had six digits after the decimal, while APT has eight.

Under such a scenario, all users would have received $25,000 instead of $250. As a result, thousands of customers could have dumped ‘APT’ for $25,000, causing significant disruptions.

Following the detection of the ‘non-standard deposit attempt’ of APT, the exchange’s specialists initiated a review. The platform suspended processing of transactions involving the asset and resumed after addressing the issue.

Some recipients of ClaimAPTGift sold the ‘APT’, after which Upbit’s support team asked them to return the funds.

Earlier in August, the Aptos team unveiled a ‘flexible’ token standard. According to the statement, the new form enables seamless airdrops, individual asset binding, and improved performance.

Earlier, ForkLog reported on a fraudulent airdrop of Grayscale Investments tokens.