mnemonic

According to CoinDesk, the South Korean National Tax Service has apologized after a seizure operation inadvertently displayed original photos containing hardware wallet recovery phrases, leading to the theft of $4.8 million in cryptocurrency. The South Korean National Tax Service stated that it failed to recognize the inclusion of sensitive information when providing photos from the seizure site.The South Korean National Tax Service has now requested police intervention to recover the assets and plans to conduct a comprehensive review of security systems and virtual asset management manuals. South Korean Deputy Prime Minister and Minister of Economy and Finance Koo Yun-cheol posted on the X platform that institutions such as the Financial Services Commission and the Financial Supervisory Service will investigate this leak incident and strengthen the regulation of public institutions managing digital assets.

According to a report by South Korea's Asia Economy, the National Tax Service of South Korea released news materials regarding on-site searches of 124 high-profile, habitual tax evaders, revealing现场照片 that included the seized Ledger hardware wallet's mnemonic phrase, with no pixelation applied.Blockchain data expert Jaewoo Cho stated that shortly after the mnemonic phrase was leaked, all 4 million PRTG tokens stored in the wallet were transferred to an unidentified wallet early this morning, with estimated losses reaching approximately 6.4 billion won (about 4.8 million USD).Analysis shows that the thief first deposited a small amount of Ethereum to be used as transaction fees into the wallet, and then transferred all the tokens in three transactions.

Trust Wallet issued a security alert on platform X, stating that it will never ask users for their recovery phrases or private keys. If such a situation arises, it is not Trust Wallet. If you have any questions, you should immediately pause transactions and contact Trust Wallet through official channels.Previously, Trust Wallet faced a security incident due to a vulnerability in the browser extension version 2.68, resulting in a total asset theft of approximately $8.5 million.

The Chief Information Security Officer of Slow Fog Technology @im23pds posted a reminder that a new type of "2FA security verification" phishing scam has recently emerged targeting MetaMask wallets.Scammers impersonate the MetaMask security alert page to lure users into completing a so-called two-factor authentication process, which is actually aimed at stealing their mnemonic phrases. The process usually includes a forged security alert page, a fake 2FA verification interface, and countdown prompts, ultimately guiding users to input their wallet mnemonic phrases.

The Chief Information Security Officer of Slow Fog Technology, 23pds, stated on social media, "Users of wallets with continuously stolen versions must first disconnect from the internet, then export the mnemonic phrase to transfer assets. Otherwise, opening the wallet online may lead to theft. Wallets with backed-up mnemonic phrases must transfer assets first before upgrading the wallet."

The Chief Information Security Officer of Slow Fog Technology, 23pds, stated on social media, "Users of wallets with a continuously stolen version must first disconnect from the internet, then export the mnemonic phrase to transfer assets. Otherwise, opening the wallet online may lead to theft. Wallets with backed-up mnemonic phrases must transfer assets first before upgrading the wallet."

According to a report by Caijing Magazine, the main suspect in the laundering case involving 60,000 BTC, Qian Zhimin, escaped with a laptop that has a built-in cryptocurrency wallet. After several searches by the British police, multiple electronic devices, including phones, computers, and USB drives, were seized. One of the USB drives contained photos of pages from Qian Zhimin's notebook, while the relevant pages of the notebook were suspected to have been torn out before the police confiscated them.The photos of the pages recorded the startup password for the black computer and several mnemonic phrases, such as "number + love," and also included hints for the numbers, which made it possible to recover the previously seized bitcoins.

According to the GoPlus Chinese community, a malicious Chrome extension named "Safery: Ethereum Wallet" has been discovered, which is stealing user assets. This extension was released on November 12, 2024, disguised as a simple and secure Ethereum wallet, but it contains a built-in backdoor.The attack method is highly covert: the malicious extension encodes the user's mnemonic phrase into a Sui address and broadcasts microtransactions through a Sui wallet controlled by the attacker to steal the mnemonic phrase. The attacker's email is kifagusertyna@gmail[.]com. Currently, this malicious extension has not been removed from the Chrome Web Store.

According to reports from users on platform X, an imToken wallet user encountered the theft of 112 BNB while participating in the Binance TGE event.Security expert Slow Mist's Yu Xian @evilcos conducted a preliminary analysis of on-chain data and found that the hacker address (0x8AeB0171742AC50d20884997F9f5009a233216D5) has caused financial losses for at least 7 users. The attack pattern indicates that the hacker may have conducted a planned attack by obtaining the mnemonic phrase or private key, with victims typically having their assets transferred shortly after depositing large amounts of funds. The security team has begun to mark and blacklist the relevant hacker addresses and is continuously monitoring the situation.

ChainCatcher news, according to Cryptopolitan, the Australian Federal Police have dismantled a cryptocurrency wallet containing $6.4 million, believed to be the illegal proceeds of an organized crime group.This operation is part of a broader crackdown on encrypted communication networks that are believed to be exploited by criminal enterprises. The Australian Federal Police revealed that they decrypted the wallet's mnemonic phrase and seized a total of $6.4 million in funds. Additionally, police arrested 32-year-old Sydney resident Jay Je Yoon Jung, who is accused of developing Ghost, a highly encrypted communication platform. Police stated that the platform was specifically designed for criminal organizations.

ChainCatcher message, in response to community users claiming that the FTX fake compensation email mentioned needing to download a tool to generate XPUB, Slow Mist founder Yuxian responded on platform X: "This malicious tool appears to be pieced together using AI, and the intent to steal mnemonic phrases is very, very clear. The malicious Telegram bot is ftxsexxerbot."

ChainCatcher news, according to Cointelegraph, Kaspersky has discovered a new virus named SparkKitty, specifically targeting iOS and Android cryptocurrency applications, stealing mnemonic phrase screenshots from users' photo albums. Affected applications include "Coin" on the App Store and the SOEX messaging app, which has over ten thousand downloads on Google Play.This virus originates from the same source as the previously discovered SparkCat, with active time tracing back to early 2024, primarily attacking users in Southeast Asia and China.

According to ChainCatcher, as reported by Cryptonews, due to the increasing kidnapping threats faced by cryptocurrency holders, the Bitcoin investor family "Taihuttu family" has revealed that they have abandoned hardware wallets and instead dispersed their cryptocurrency mnemonic phrases across four continents.Taihuttu stated that over the past eight months, they have adopted a hybrid storage system: splitting the encrypted mnemonic phrases, with some engraved on fireproof steel plates hidden across four continents, while the rest is stored using blockchain-based encryption services. Even when threatened with a gun, he can only provide a limited amount of assets from his mobile wallet.This decision stems from the rise in physical attacks targeting cryptocurrency holders. Recently, Moroccan police arrested a suspect in the kidnapping of a cryptocurrency executive; the father of a cryptocurrency millionaire in France was brutally attacked; and a tourist in New York was kidnapped and tortured for two weeks, with the kidnappers attempting to obtain his Bitcoin credentials.Currently, approximately 65% of the Taihuttu family's crypto assets are stored in cold wallets across four continents, while the remainder is kept in multi-signature wallets or decentralized exchanges for trading and daily expenses.

ChainCatcher news, Slow Mist founder Yu Xian tweeted that a user's four sets of mnemonic phrases were leaked, corresponding to four wallet addresses where funds were stolen. From the on-chain operation methods, after the hacker's address received the funds, they were all converted to ETH and then laundered through FixedFloat. The longer mnemonic phrases/private keys are exposed to the internet and the more people they are distributed to for shared use, the more likely they are to be leaked, and the more difficult it becomes to investigate the reasons for the leak.

ChainCatcher news, according to Cointelegraph, a recent offline phishing scam targeting Ledger hardware wallet users has emerged, with scammers requesting victims to verify their recovery phrases through postal letters.On April 29, tech commentator Jacob Canfield exposed a forged "Ledger Security Update Notification" letter on the X platform, which contained a branded QR code that lured users into entering their 24-word recovery phrase.Ledger's official response emphasized: "We will never ask for your recovery phrase in any way."This scam may be linked to the Ledger user data breach incident in July 2020, when the names, phone numbers, and addresses of over 270,000 users were exposed by hackers. Reports in 2021 indicated that some users received counterfeit hardware wallets preloaded with malware.Experts remind: Any request for recovery phrases is a scam, and physical isolation is the core security advantage of hardware wallets.

ChainCatcher news, three programmers were sentenced to three years in prison and fined 30,000 RMB each for illegally implanting a "backdoor" in the iToken wallet application to obtain users' digital wallet private keys and mnemonic phrases.According to the appraisal, the three illegally obtained a total of 27,622 mnemonic phrases and 10,203 private keys, successfully converting 19,487 digital wallet addresses. The three defendants were responsible for writing request logic code, building the backend server, and purchasing domains and encrypting private keys.The court also ruled that the three are prohibited from engaging in network security management and network operations and related work for three years after the execution of their sentences.

ChainCatcher news, according to Decrypt, cybersecurity experts recently discovered a dual malware attack targeting users inside and outside the cryptocurrency industry.Cyber intelligence company Silent Push revealed in its latest report a malicious activity named PoisonSeed, which first forges login pages of bulk email service providers like Mailchimp and SendGrid to steal user credentials. Attackers send fake emails claiming that user accounts are restricted, luring them to log into a counterfeit website. After entering their credentials, the attackers quickly and automatically export the email subscription list.Subsequently, the attackers use the stolen subscription list to impersonate Coinbase and send phishing emails to the victims' contacts, claiming that the exchange "is transitioning to self-custody wallets," and includes a 12-word recovery phrase, tricking users into importing the wallet, effectively allowing hackers to take control of the assets.

ChainCatcher message, Slow Mist Technology's Chief Information Security Officer 23pds issued a warning that the latest version of the Phantom wallet may have security vulnerabilities. Victims have explained the risks of the Phantom Profile: when users import a mnemonic phrase from an unknown source, if that mnemonic phrase is associated with a Phantom Profile, the wallet will automatically log into that account system, putting the user's assets at risk of theft.According to the victims, when users who have not enabled the Phantom Profile import such mnemonic phrases, the wallet will automatically log into a pre-set attacker account system, rather than just importing a single wallet address. Since the latest version of Phantom uses a Unified Profile System, this action allows the attacker to gain associated access to the user's device, enabling them to monitor the user's subsequent deposit activities and implement theft.

ChainCatcher news, according to Cointelegraph, cryptocurrency wallet provider Tangem has faced criticism from users for collecting their recovery phrases due to an application vulnerability. The company confirmed the issue on December 30, stating that the vulnerability stemmed from an error in application log handling, which resulted in users' private keys being recorded and potentially accessible by the support team.Although Tangem has promptly fixed the issue and deleted all related logs, users have expressed dissatisfaction with the company's response, feeling that it has not adequately addressed the situation. Tangem stated that this vulnerability only affected a small number of users and has proactively contacted those impacted. All users are advised to update the application immediately to avoid potential recovery phrase leaks.

ChainCatcher news, according to CoinDesk, a recent report from security company Kaspersky shows that a new type of scam targeting cryptocurrency thieves is becoming popular on YouTube. Scammers disguise themselves as newcomers and "accidentally" share wallet recovery phrases in the comments section, enticing others to attempt to steal USDT worth $8,000 from the wallets.However, these wallets are actually multi-signature wallets, and when the thieves pay TRX as gas fees in an attempt to transfer funds, these TRX are automatically transferred to another wallet controlled by the scammers. Since gas fees on most blockchains are less than $10, this scam primarily targets small-time thieves rather than large-scale operations.