The SlowMist team uncovered a new cryptocurrency scam exploiting altered Ethereum nodes' RPC function. This fraud targets offline transactions, using Tether (USDT) as payment. Victims are lured with a small USDT and ETH transfer via the legitimate imToken wallet to gain trust. Subsequently, they're prompted to make larger transactions. However, the altered RPC function redirects transactions to the scammers' address, appearing normal to victims. To avoid such scams, users should download wallets from reputable sources, verify transactions meticulously, and keep software updated. These precautions can mitigate the risk of falling victim to deceptive practices in the cryptocurrency realm.