phishing

CZ's post pointed out that on that day, there were 4 reported data breaches involving Coinbase's third-party vendor Amplitude, the South Korean cryptocurrency exchange Bithumb, and South Korean securities firms Mirae Asset and Daishin Securities. Among them, the breach related to Amplitude did not affect customer funds.CZ stated that the leaked exchange data was primarily used for phishing, SIM card hijacking, social engineering scams, and wrench attacks. He suggested that all platforms use independent email aliases and dedicated backup numbers, refuse to fill out unnecessary personal information, and use strong independent passwords.CZ also recommended enforcing the use of hardware security keys or passkeys, completely disabling SMS 2FA, enabling withdrawal address whitelists, withdrawal time locks, and anti-phishing codes, regularly cleaning API keys and active sessions, and requesting number porting locks from carriers. He also reminded that all customer service contacts that reach out proactively are scammers, and never to click on external links.

According to the official announcement from Foundation, regarding the recent phishing email incident, the team’s investigation found that their email system recorded over 23,000 phishing email sending attempts, of which 19,057 were sent via Mailgun, and another 1,503 were sent via Google Workspace.Due to some email accounts receiving multiple emails, and some sending attempts being unsuccessful or intercepted, it is currently not possible to confirm the actual number of affected individuals.

Slow Fog's Yu Xian posted on platform X, stating that Slow Fog's MistEye global threat intelligence hunting has discovered over 1,500 DarkSword phishing sites deployed across the internet, involving e-commerce, fake Binance, fake OKX, fake wallets, gaming, and cryptocurrency exchange businesses.

Binance founder CZ tweeted that there are concerns about artificial intelligence attacking cryptocurrencies, but the encryption technology relied upon by the internet and banking systems is weaker.He pointed out that artificial intelligence can cause harm without cracking Bitcoin's cryptography, and the leaked data has fueled more phishing and social engineering attacks, reminding users to pay attention to security.

Digital hardware wallet manufacturer NGRAVE disclosed that attackers hijacked the third-party notification service used by its LIQUID companion app and sent false security alerts to users, resulting in approximately 70 wallet addresses being stolen across 4 blockchains, amounting to about 2.56 million dollars. Among these, the loss in Bitcoin was approximately 1.77 million dollars, XRP about 454,000 dollars, Ethereum assets about 316,000 dollars, and Stellar about 18,000 dollars.The attackers induced users to click on a counterfeit website and enter their 24-word recovery phrase or Perfect Key, subsequently using automated scripts to transfer assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised; the victims voluntarily provided their recovery credentials during the phishing process. Unauthorized access may have begun on October 11. After obtaining an access key, the attackers acquired a broader access key and sent false notifications on October 17; NGRAVE detected anomalies about 1 minute after the notifications appeared, but the first wallet was emptied 6 minutes later, and the notification system was shut down that evening.NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a cryptocurrency security firm and mentioned that affected keys have been replaced, with new dual approval, domain restrictions, and emergency shutdown mechanisms implemented. The company also reminded affected users to create new wallets and contact the support team, as some device information, wallet activity, IP addresses, and approximate locations may have been exposed.

According to CryptoSlate, Microsoft and the cybersecurity organization Health-ISAC have obtained a court order in the United States to seize and redirect the domains supporting three services: YAM Store, CoGUI, and Iron Man. These three services sell stolen accounts and phishing tools to fraudsters. Since January of this year, they have assisted in sending over 1 billion phishing messages, targeting more than 75,000 institutions across over 150 countries, generating tens of millions of dollars in revenue for the operators.Microsoft has disabled over 20,000 accounts associated with YAM Store and continues to block more than 100,000 counterfeit and fraudulent domains. According to Microsoft's investigation, these services accept payments in USDT (Tron network) and ETH, and Cloudflare stated that buyers can also use USDC for payments. Blockchain analytics company TRM Labs assisted investigators in locating and freezing related assets, but the amount frozen has not been disclosed.

Slow Mist stated that a fraudulent "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to carry out attacks. The phishing page is highly realistic, including a fake "Genuine check" page, device selection interface, and "Update Now" button. Slow Mist reminds users not to update Ledger devices through website links and not to enter recovery phrases anywhere.

According to PeckShieldAlert monitoring, the phishing attacker who stole $2 million worth of DAI from an address of Bofur Capital has exchanged the stolen funds for 825.5 ETH.

Hardware wallet manufacturer COLDCARD stated that its official X account had previously posted a fake security announcement, directing users to a phishing website disguised as a wallet migration guide. The post has been deleted, but no corresponding login, session, or access records have been found.COLDCARD indicated that its credentials and offline two-factor authentication remain secure, leading to suspicions that the attacker may have gained X platform-level or administrative access, and has requested an urgent investigation by the X security team. The company also mentioned unverified reports of X administrator accounts being sold on the dark web, but no connection to this incident has been found.

The Chief Information Security Officer of Slow Fog, 23pds, tweeted that public WiFi itself does not steal coins. The losses are caused by phishing pages opened by fake WiFi and the actions of users themselves signing transactions or importing private keys. What websites are accessed and what operations are performed after connecting are the core factors that determine whether asset losses occur.Previously, X user Xiaoyu_184CM tweeted that after connecting to free WiFi at Singapore Airport, a wallet that had not been used for a month had 3.7 BNB transferred away. Binance founder CZ responded that he has always advised against connecting to public WiFi, but merely connecting to WiFi does not lead to wallet theft, and asked if there were any other operations in between. Crypto KOL AB KuaiDong speculated that someone might have specifically set up free WiFi or modified the router, and Xiaoyu indicated that he felt this was likely the case.

According to Slow Mist's Yu Xian monitoring, phishing attacks targeting FOMO's web bookmarks are emerging.Such phishing webpages lure users into completing fake human verification, dragging malicious JavaScript code into the browser's favorites and saving it as a bookmark. After the user clicks on this bookmark 2 to 3 times, the previously logged-in FOMO account will be hijacked by the attacker, and the encrypted assets within the account will be immediately stolen.

According to Scam Sniffer monitoring, a user lost LINK tokens worth $167,342 after signing a phishing authorization for Permit2 on Ethereum.The authorization was signed on August 18, 2025.

Binance Wallet announced the launch of real-time detection and risk interception features for high-risk signature scenarios to prevent phishing attacks that exploit the authorization mechanisms of DeFi projects.Binance stated that some attacks only require inducing users to complete offline signatures that do not require gas fees, which could lead to asset theft. In the future, it will continue to expand the scope of risk identification scenarios and security protection coverage.

According to the Brooklyn District Attorney's Office, 23-year-old Brooklyn man Ronald Spektor was sentenced to 4 to 12 years in prison for committing phishing and social engineering fraud. Over approximately one year, Spektor impersonated Coinbase customer service, luring about 100 American users to transfer cryptocurrency to wallets under his control, claiming "accounts were hacked and assets were at risk," stealing nearly 15.94 million dollars in total.Subsequently, he laundered the money through multiple exchanges, mixing services, and cryptocurrency gambling platforms. On September 2, he pleaded guilty to all 31 charges, including first-degree money laundering and first-degree grand larceny, and was ordered to forfeit cash, cryptocurrency, and personal property valued at over 500,000 dollars, while also needing to pay restitution of nearly 16 million dollars. Investigations revealed that he had publicly flaunted his criminal gains on platforms like Telegram.

According to official disclosures from Coinbase, it has collaborated with Microsoft and several institutions to combat the AI-driven cybercrime platform EvilTokens. This platform offers "phishing as a service" through Telegram bots, utilizing AI to analyze trust relationships and payment permissions in compromised email accounts, and bypassing multi-factor authentication through Microsoft's device code login process.The Coinbase global intelligence team tracked that between October 2025 and June 2026, EvilTokens generated approximately $1.1 million in revenue through four Tron addresses, involving over 1,000 deposits from more than 700 different addresses. The related evidence supported Microsoft's civil lawsuit, ultimately leading to the seizure of 50 websites and the deactivation of over 175 associated domain names. The Metropolitan Police Service of the United Kingdom arrested the relevant operators and seized digital devices on September 11. Coinbase stated that this incident did not result in the leakage of Coinbase accounts or credentials, but some customers were manipulated into transferring cryptocurrency to the scammers' addresses through phishing emails.

According to CriptoNoticias, the Spanish Civil Guard and National Police have respectively cracked down on two cryptocurrency-related criminal cases, capturing or identifying a total of 48 individuals involved.Among them, one Ponzi scheme resulted in losses of approximately 327,000 euros for 113 investors; another criminal network implemented fraud through phishing, fake rental advertisements, and other methods, converting illegal gains into cryptocurrency to evade tracking, causing losses exceeding 430,000 euros.

According to a report by the Korean Yonhap News Agency, the Busan Police Agency disclosed that someone illegally accessed the account of a text message sending agency used by the marketing department of a composite shopping center in the Sasang District of Busan, sending bulk scam messages to over 260,000 unspecified individuals, claiming "the cryptocurrency wallet has been updated" and inducing quick installation.Once users click on the attached link, they may encounter phishing attacks (Smishing) that could lead to the theft of virtual assets. The police have currently blocked access to the relevant accounts and are conducting a tracking investigation into the illegal intruder.

Recently, the meme coin market has been booming, and on-chain trading has become increasingly active. However, with the warming market, meme coin display pages have frequently shown highly disguised phishing links, and the "novel" attack methods have caused several seasoned traders to fall victim. Crypto KOLs @insidecalls and @cladzsol recently revealed that while scanning chains, they clicked on the meme coin homepage, which resulted in a "cloudfare verification" prompt. After completing the verification as instructed, the victim's on-chain funds were stolen. Among them, @cladzsol lost approximately $600,000 in assets.According to market news, on several recently popular meme coin display pages, the homepage redirects to a "cloudfare verification" page, which is actually a phishing link. If users follow the prompts, their computer systems will download and execute malicious scripts, leading to asset loss. This phenomenon is so rampant that it may be related to the delayed review processes of mainstream trading aggregation platforms like DexScreener. Currently, the display logic of relevant platforms is to directly reference the "official website" or social media links filled in the token metadata. These fields can be updated by token creators or those who later claim "community takeover." Hackers are exploiting this review loophole to transform meme coin display pages into new "fishing grounds" for phishing attacks. Users may inevitably click on unfamiliar links during the chain scanning process; if a "cloudfare verification" or other highly suspicious page appears, they should close it immediately to avoid interaction and protect their asset security.

Bitcoin hardware wallet manufacturer Trezor has warned that its third-party marketing platform Brevo, used for sending newsletters, experienced a data breach, with attackers using the platform to send phishing emails to 347,000 Trezor customers. The attackers sent emails using Trezor's domain, making the phishing attempt more deceptive, with malicious links encouraging users to download applications and enter wallet backups.Trezor stated that it shut down the domain at the DNS level within 20 minutes to prevent the links from remaining active, but approximately 2,500 people had already clicked on them. Trezor has suspended its Brevo account to stop further emails from being sent and emphasized that other Trezor systems were not affected aside from the marketing platform, while reminding users that Trezor never asks customers for wallet backups.Prior to this incident, Trezor disclosed last month that its third-party fulfillment partner ShipMonk was attacked, resulting in the data breach of 11,742 customers; last week it also reported that the names, emails, phone numbers, shipping addresses, and order numbers of another 67,000 U.S. customers were exposed in the breach. This year, cryptocurrency wallet Ledger's payment processor Global-e and wallet provider SafePal have also experienced data breaches, with approximately 39,800 customers' order information at SafePal being accessed without authorization.

According to GoPlus alerts, the meme coin LAPTOP issued by Hunter Biden, son of Biden, is about to launch an airdrop. A large number of phishing websites for fake LAPTOP airdrop whitelists, eligibility checks, and claims have appeared on Twitter, and there are also lookalike versions on multiple chains, with risks such as unverified contracts, high taxes, and trading suspensions.GoPlus reminds users to refer to the official website and Twitter for accurate information, to be cautious when participating in lookalike trading, and to use Token security checks to confirm contract safety. Remember the four principles: do not click, do not install, do not sign, do not transfer.