phishing

The cryptocurrency wallet project SafePal has released updates on the security incident, stating that it is continuously tracking phishing websites and impersonation accounts, and plans to introduce a professional anti-phishing security company to expedite the removal of malicious information to protect user asset security. SafePal mentioned that it is currently in the final selection process among four professional anti-phishing security companies, and once a partner is selected, it will further enhance the efficiency of handling threats such as counterfeit websites and scam accounts.The team is also continuously monitoring whether the affected data has been sold or made public, including channels such as dark web forums and trading markets. Once signs of data leakage are detected, affected users will receive risk alerts immediately. Regarding security audits, SafePal stated that it is in the final selection among three mature independent security institutions, which will conduct a comprehensive security review of the order system. Meanwhile, the team is reassessing the order and logistics processes to reduce the amount of data that needs to be stored in the initial phase of the system, thereby reducing potential risks from the source.For affected users, SafePal stated that it will continue to provide one-on-one assistance through official support channels and will keep updating the fraud protection page, providing updates on the incident, FAQs, and analysis of fraud cases. SafePal once again reminds users: the official will never ask users to provide their seed phrase. Users should not disclose their seed phrase to anyone, should not scan unknown QR codes or click on suspicious links, and should verify the source of information through official channels.

According to CoinDesk, the Internal Revenue Service (IRS) has issued a warning that a sophisticated email phishing campaign targeting U.S. cryptocurrency holders is spreading. Attackers are impersonating official tax letters to lure users into scanning malicious QR codes to steal cryptocurrency wallet credentials and private keys.It is reported that attackers are sending paper letters impersonating the IRS, creating a sense of urgency under the guise of "tax compliance" and "account verification," and including QR codes in the letters. Once users scan the code, they may be directed to a counterfeit website, leading to the leakage of wallet login information, recovery phrases, or private keys, resulting in the theft of digital assets.The IRS reminds taxpayers that official agencies will not request users to provide cryptocurrency wallet private keys, recovery phrases, or perform similar "wallet verification" operations through unofficial channels. Cryptocurrency holders should be vigilant against any suspicious emails and letters that request scanning QR codes, connecting wallets, or submitting sensitive information.As the number of cryptocurrency asset holders grows, social engineering attacks targeting digital wallets continue to increase, and regulatory and security agencies are strengthening warnings against related fraudulent activities.

According to on-chain detective Specter, the victim claims to have transferred funds from Bitcoin to Ethereum due to a hack on Coldcard. However, on-chain data shows that 73 BTC (worth $4.6 million) originally came from the Whirlpool mixer two weeks ago, with some of it crossing over to Ethereum and subsequently deposited through a phishing Tornado Cash interface.Two mixers were used during the related fund transfer process. The individual was also found to be present in Telegram groups related to private key searches and brute force cracking. On-chain detective Specter indicates that the victim may be a threat actor, and their funds may have also been stolen by another threat actor.

According to Cointelegraph, cybersecurity company Rapid7 has disclosed a phishing operation named Operation Asterix, targeting approximately 885,000 phone numbers across multiple countries and directing victims to fake wallet service websites. A total of 5,576 phone numbers have been matched with Binance user accounts and are included in the attack queue.The attackers steal mnemonic phrases by impersonating fake applications of Ledger, Trezor, and Exodus, while also using forged customer service emails and phone calls to contact victims. Rapid7 also found that out of over 316,000 phone numbers in Germany, 43,066 matched with cryptocurrency trading accounts, resulting in a hit rate of approximately 13.6%. Related attacks also include a bulk phone number verification tool targeting Kraken accounts, with investigations revealing that AI tools have been heavily used in the phishing operations.Data from blockchain security company Hacken shows that phishing attacks and social engineering scams caused losses of $306 million in the first quarter of this year, accounting for the majority of the total losses of $482 million in the cryptocurrency industry.

On-chain detective Specter posted on the X platform, stating that considering the time period covered by the stolen data, this could mean that the data breach occurred as early as April, and no later than early May. However, the parties involved chose to remain silent until recently, roughly at the same time Trezor announced its own data breach.Some users had already received phishing attacks and suffered asset losses at that time, but the parties involved did not maintain transparency, warn users, or provide risk alerts, instead denying the data breach.

According to Cointelegraph, DeFiLlama founder 0xngmi stated that the team had delayed the release of the official mobile application due to the long-standing presence of phishing apps impersonating DeFiLlama on the Apple App Store. The team will only release the official mobile application after all counterfeit apps have been removed to reduce the risk of users falling victim to scams.Yesterday, DeFiLlama founder 0xngmi stated, "We have been trying for months to get a fake app impersonating DeFiLlama removed from the Apple App Store and have continuously reported trademark infringement and impersonation of the official app to Apple.Subsequently, we funded a small wallet, downloaded the app, and as expected, all the funds in the wallet were stolen, so we reported this situation to Apple. As a result, the app was removed by Apple within a few days. We hope to inform other cryptocurrency companies about this so they won't waste time like we did."

FlashRescue co-founder @DarcyAri posted on the X platform that the Hyperliquid-related Google paid advertising phishing incident has resulted in approximately $550,000 in financial losses.The addresses related to the attackers have been disclosed, and users need to be vigilant about the phishing risks associated with Google paid advertisements and pay attention to protecting their asset security.

According to SBS, the Financial Supervisory Service (FSS) of South Korea has begun a comprehensive reform of its system to address compensation issues related to financial fraud, including voice phishing involving virtual assets. The FSS launched the "Financial Fraud Loss Compensation System Improvement Project" on August 6. This project aims to reform the existing compensation calculation system centered on the Korean won, in preparation for including virtual asset losses in the compensation scope starting in October this year.The current system primarily calculates compensation amounts based on losses valued in Korean won, but after the reform, a compensation ratio will be adopted, taking into account the type and quantity of virtual assets involved. Additionally, during payment suspensions, the Korean won exchange value of virtual assets will also be included in the calculations.

According to on-chain detective Specter, the same attacker is running similar phishing activities targeting Ledger. The relevant screenshots were taken two days ago, and the sponsored advertisement has now been removed.As of now, these activities have stolen over 3 million dollars.

Bitcoin News posted on the X platform that a Trezor user claimed their life savings were stolen after clicking on a Google sponsored search result impersonating Trezor. The phishing page was hosted on Google Sites and allegedly tricked victims into entering their wallet recovery seed.Trezor stated that it is upgrading its response to the report, working to remove the website, and reminding users to never enter their wallet backups or recovery phrases on any website or online form. Google sponsored phishing ads remain a persistent attack vector faced by cryptocurrency users.

According to GoPlus monitoring, a user on the Base chain lost 500,000 USDC due to a phishing attack. When the attacker exchanged the stolen funds for WETH, the script did not set slippage protection, routing to a Uniswap V4 WETH/USDC pool with almost no liquidity, resulting in only 67.9 ETH (worth $129,000) being exchanged for 500,000 USDC, of which $370,000 was earned by an MEV bot.The MEV bot only paid 0.03 USDC to front-run the transaction but incurred 3.5 ETH in gas fees for this. Subsequently, the victim sent an on-chain message to the attacker and the MEV address, stating that they had identified the attacker and were willing to pay a 10% bounty for a refund.

According to official news, the Ethereum Foundation's "Trillion Dollar Security" (1TS) has announced a special grant to the Freedom of the Press Foundation (FPF) to support the ongoing development of the open-source tool WEBCAT, aimed at addressing the long-standing front-end code verification security gap in Ethereum wallets and decentralized applications (DApps).WEBCAT (Web-based Code Assurance and Transparency) is an open-source tool designed to help browsers verify whether the code loaded by a website matches the version publicly released by the developer.This funding will promote the expansion of WEBCAT to Ethereum wallets and application scenarios, enabling users to verify whether the front-end pages they access have been tampered with.The Ethereum Foundation stated that while HTTPS can verify the website a user is connected to and encrypt communication, it cannot prove that the front-end code actually running on the website is the same version released by the developer. If an attacker controls the website's front-end code, they may modify the transaction receiving address without the user's knowledge or induce the user to sign transactions that do not match the content displayed on the page.The Ethereum Foundation noted that front-end attacks have become a significant security risk for blockchain infrastructure, with malicious modifications to web interfaces potentially leading to supply chain attacks, DNS hijacking subsequent attacks, and user interface deception.WEBCAT was initially developed by the Freedom of the Press Foundation to enhance the code credibility of secure communication systems like SecureDrop.With this expansion into the Ethereum ecosystem, it will complement security measures such as "Clear Signing" in the 1TS program: the former helps wallets confirm that the application front-end has not been tampered with, while the latter helps users understand the transaction content they are approving.

According to Bloomberg, the Internal Revenue Service (IRS) has warned cryptocurrency holders that scammers are contacting some taxpayers by mailing fake letters in an attempt to steal their digital assets or personal data. The IRS stated that these letters may ask taxpayers to register for a so-called "Digital Asset Compliance Portal," which does not exist. The IRS also reminds users not to scan suspicious QR codes and not to answer or cooperate with calls requesting payment.While phishing and digital scams are not new in the cryptocurrency industry, sending fake IRS notices through physical mail seems to be a new scam tactic. Since the IRS has indeed sent letters related to digital assets to taxpayers in the past, and last year saw a surge in cryptocurrency tax filing notifications, many taxpayers are confused, which may lead scammers to exploit this familiarity for disguise. As the U.S. tax system requires taxpayers to disclose cryptocurrency activities on their tax returns, communication between the IRS and cryptocurrency holders has become more common. This also makes counterfeit tax notices more misleading. For cryptocurrency users, encountering "IRS letters" involving portal registration, QR code scanning, wallet connections, or payment requests should be treated with caution, and verification should be done through official channels.

GoPlus Security issued a security alert stating that a user signed a malicious Permit transaction 183 days ago, resulting in approximately $1,625 of USDC being transferred by a phishing attacker.Since the user did not revoke the relevant authorization afterwards, the attacker again used that authorization to transfer approximately $75,780 of USDC.

Moonshot tweeted a reminder that some users received a phishing email with the subject "View Recent Activities." This email did not come from Moonshot, and no signs of account compromise have been found so far. The official team is investigating this matter.Moonshot advises users to delete the email and not to click on any links. If you have clicked on a link or entered a verification code, please contact the official support through the in-app support.

According to Scam Sniffer monitoring, a user lost approximately 999,999 USDT after signing a phishing token authorization on Ethereum.The attacker initially attempted to withdraw 1 million dollars (which was 631 dollars more than the wallet balance) but failed. After 36 seconds, they recalculated and successfully withdrew the entire remaining balance. Scam Sniffer reminds users to verify all signature requests and never rush to sign transactions.

On-chain security analyst Specter stated that a phishing attack suspected to target Polymarket users is currently occurring, with total losses amounting to approximately $2.94 million.According to its monitoring, attackers have transferred funds from more than 11 victim wallets holding PUSD, converting the stolen assets into ETH, while reminding users to be cautious of phishing risks and stating that the incident is still under ongoing investigation.

Blockchain security company Blockaid stated that its detection system found signs of a front-end attack on the Gitcoin subdomain files[.]gitcoin[.]co, with suspected malicious code named "Eleven drainer" included in the website, used for wallet asset theft. Blockaid warns users not to interact with the website at this time, and the related issues are under investigation and repair.

According to the "Мошеловка" platform, scammers impersonate authorized brokers of the Moscow Exchange through social media, luring users to click phishing links under the pretext of "testing cryptocurrency trading channels," resulting in theft of funds and information. The Moscow Exchange emphasizes that all official trading must be conducted through licensed brokers, and there are no exclusive cryptocurrency purchasing channels for ordinary users.According to data from the Russian IT company "Shard," in 2025, Russian users are expected to lose approximately 234 million rubles due to cryptocurrency phishing, accounting for 62% of the total losses in cryptocurrency assets that year.

According to GoPlus warning, a user lost approximately $316,000 worth of USDC to a phishing attack due to signing a malicious Permit2 transaction.