Web3 attack incidents and security accidents

ChainCatcher news, Slow Mist founder Yu Xian stated that the "fake Ledger" scam has reemerged recently, with attackers mailing counterfeit Ledger devices to users, accompanied by fake manuals, guiding them to input the mnemonic phrases from their real Ledger into a fake application, resulting in asset theft. This attack method had cases as early as 2021, and there are also variants that commit fraud by pre-setting mnemonic phrases or tampering with random number generators.Experts remind that although such physical-layer phishing attacks may seem rare, their success rate is not low, and the targets are often high-net-worth users.

ChainCatcher message, Zhao Changpeng released several security tips to prevent phishing attacks:Never disclose your password to anyone claiming to be "customer service." Real customer service representatives will never ask users for their passwords.Do not click on links received in emails; always log into your accounts by manually entering the website URL or using bookmarks. Before entering any password, make sure to triple-check that the website is not a phishing site.Do not use the same password across multiple sites. Use a password manager to set a unique and strong password for each site, and the password manager will not match your passwords on phishing site domains.Use hardware two-factor authentication (2FA) devices like Yubikey, which can prevent most phishing attacks.

ChainCatcher news, according to Decrypt, DeGods founder Frank (real name Rohun Vora) had his Solana wallet hacked, resulting in the theft of 16 DeGods NFTs which were sold on the open market, with losses amounting to approximately 108 SOL (about $19,000).Frank stated that the attack originated from his trading laptop being compromised, but the attack was limited to a single wallet. This incident occurred just days after he announced his resignation as the project's CEO. Frank denied speculation on social media regarding his active selling of NFTs and emphasized that he still holds a significant number of DeGods NFTs in other wallets, as well as DEGOD tokens worth over $50,000.

ChainCatcher news, according to PeckShield monitoring, the Zunami Protocol disclosed that it was hacked, and the collateral for zunUSD and zunETH has been stolen, resulting in a loss of approximately $500,000. The attacker has transferred the stolen funds to Tornado Cash.

ChainCatcher news, Curve releases the latest update on DNS hijacking: the registrar has successfully frozen curve[.]fi (the domain is currently unavailable, phishing attacks have stopped). Users can access the following domain: curve.finance.

ChainCatcher news, according to Scam Sniffer monitoring, a user just lost 3.13 million WBTC due to signing a phishing signature.

ChainCatcher news, according to Cointelegraph, the DeFi protocol Curve Finance has issued an urgent warning that its official website curve.fi has suffered a DNS hijacking attack, redirecting users to a malicious phishing site. This is the second security threat the platform has faced within a week, following the hacking of its official X account on May 5.Blockchain security company Blockaid detected that attackers may have implemented a front-end attack by tampering with DNS resolution records, advising users to immediately stop all transaction signing operations. The Curve team has contacted the domain registrar for urgent handling and confirmed that the smart contracts are unaffected, but they remind users that there is still a risk of asset theft when interacting with the platform.