Beware of custom RPC node scams

TokenPocket Security Awareness - RPC Scam

TokenPocket Security Awareness - RPC Scam

Is there a risk in using unofficial RPC nodes? The answer is yes, because RPC nodes are responsible for important functions such as sending transactions, querying balances, and obtaining account information. Using insecure RPC nodes poses significant risks. These risks exist in both online and offline environments. Today, we will introduce you to a new type of scam — the custom RPC node scam.

What is an RPC Node?

In cryptocurrency wallets, an RPC node typically refers to a Remote Procedure Call node, which is a server within the blockchain network responsible for handling requests from clients (such as wallets). Through an RPC node, wallets can communicate with other nodes in the blockchain network and perform various operations, such as sending transactions, querying balances, and retrieving account information.

RPC nodes play a critical role in blockchain networks as they serve as the bridge between wallets and the blockchain network.

Malicious RPC Node Attack Scenarios

Scammers gain users' trust through online or offline methods by either using the current wallet or guiding users to download a legitimate wallet, then transferring a small amount of assets to test deposits. After gaining trust, they recommend users to use a malicious RPC node link by importing it into the wallet through the Custom Node feature.

This node, however, has been modified by scammers using Tenderly's Fork feature. The user's USDT balance is falsified, making it appear as though the scammer has transferred funds into the user's wallet. Seeing the fake balance, the user mistakenly believes the funds have been received.

After completing the transaction, the user finds they cannot transfer funds using the malicious node. When switching back to a normal node, they realize that the asset balance has not actually increased, and there are no transaction records on the blockchain. At this point, they realize they have been scammed.

In reality, beyond falsifying balance displays, Tenderly's Fork feature can even modify contract information, posing an even greater threat to users (this will not be the focus of this introduction).