More than $4.7M stolen in Uniswap fake token phishing attack

cointelegraph.com:

A sophisticated phishing campaign targeting liquidity providers (LPs) of the Uniswap v3 protocol has seen attackers make off with at least $4.7 million worth of Ethereum (ETH). However, the community is reporting the losses could be even greater. 

Metamask security researcher Harry Denley was one of the first to raise the alarm bells of the attack, telling his 13,000 Twitter followers on July 11 that 73,399 addresses had been sent malicious ERC-20 tokens to steal their assets.

⚠️ As of block 151,223,32, there has been 73,399 address that have been sent a malicious token to target their assets, under the false impression of a $UNI airdrop based on their LP'sActivity started ~2H ago0xcf39b7793512f03f2893c16459fd72e65d2ed00ccc: @Uniswap @etherscan pic.twitter.com/5W51AikFuV

At least $4.7 million in ETH has been lost in the attack, according to a Twitter post from Binance CEO Changpeng “CZ” Zhao. However, there are also reports amongst the crypto community that there may be more significant losses from the incursion.

Prominent crypto Twitter user 0xSisyphus noted on July 11 that a “large LP” with around 16,140 ETH, worth $17.5 million, may have also been phished.

did a large LP get phished?https://t.co/3n6oruM8Hjthe v3 NFTs in 0x09b5 all originated from this wallet which has 16k ETH ($18m) sitting in it

According to Denley, the phishing attack works by sending unsuspecting users a “malicious token” called “UniswapLP” — made to appear as coming from the legitimate "Uniswap V3: Positions NFT" contract by manipulating the “From” field in the blockchain transaction explorer.

Users curious about their new tokens would be directed to a website purporting to allow them to swap their new tokens for Uniswap’s native token UNI, worth