Crypto Shuttle News

Tag: PSA

  • Security PSA: Mining Pool Scams Targeting Self-Custody Wallets | by Coinbase | Mar, 2022

    Security PSA: Mining Pool Scams Targeting Self-Custody Wallets | by Coinbase | Mar, 2022

    [ad_1]

    By Coinbase Security Team

    Coinbase

    As part of our mission to build a more fair, accessible, efficient, and transparent financial system enabled by crypto, we actively monitor for security threats not only to Coinbase but to the crypto ecosystem as a whole. As we have discussed in our previous blog posts on industry-wide crypto security threats and airdrop phishing campaigns, malicious activity against any crypto user or business is bad for the industry. That’s why it’s important to have a community mindset when we see security threats in the wild. As they say, rising tides lift all boats.

    Recently, our security teams have uncovered ongoing mining pool scams targeting users of self-custody wallets. These scams have primarily leveraged malicious smart contracts on the Ethereum network. Based on blockchain research into known scammer wallets, Coinbase estimates these have resulted in the theft of over $50 million in crypto assets from a variety of non-custodial wallet applications. These scams target those using any decentralized wallet browser (e.g. Coinbase Wallet, Metamask, Trust, etc).

    The scam typically follows this chain of events:

    • Victims are contacted via social media and/or other messaging services by scammers claiming to offer an attractive crypto investment opportunity to stake USDT (Tether) in their wallet for a guaranteed return
    • Victims are directed to visit a fraudulent website that can only be accessed via a crypto wallet browser or extension. These websites generally contain fake reviews, endorsements, live-feed payouts, and partner lists to add an appearance of authenticity
    • Scam sites will often fraudulently claim to be sponsored by or partnering with recognizable crypto brands such as Coinbase, Binance, and MetaMask
    • Example mining pool landing page

    Source: Scam Site

    • Clicking the ‘Receive’ button displays a pop up similar to this

    Source: Scam Site

    • Clicking this ‘Receive’ button will then display a fake pop-up designed to impersonate the Coinbase Wallet interface. The permissions that are displayed are not the true permissions that are actually being requested and are intentionally displayed in a way to attempt to trick users into clicking ‘Connect’

    Source: Scam Site

    • Viewing the smart contract via a trusted token approval checker shows the true permissions being requested. The scammer gains delegated transaction approval status with an unlimited transaction allowance within the victim wallet, meaning the scammer can approve USDT sends of any amount on behalf of this wallet.

    Source: etherscan.io

    • Attackers will remove USDT from the victim’s wallet and the scam site will show that their balance is increasing. Scammers will frequently reassure victims that if they add more funds, they will get more USDT in returns by mining.
    • At the end of the period, the funds are not returned to the victim and no profits will be received.
    • If the victim contacts customer support via the fraudulent website, the attacker may indicate they detected irregular activity on the account and that in order to fix that issue, the victim would need to pay additional USDT to ‘release’ the funds. However, no funds are ever returned regardless of whether or not the victim makes payment.

    The following security steps can be taken to defend your assets:

    • Be wary of investments that claim a guaranteed return
    • Be wary of investment advice and opportunities from unknown or untrusted sources
    • Do not visit or connect self-custody wallets to any unknown site
    • Do not hold high value assets in the same wallet used to regularly interact with dapps. Use cold storage or custodial solutions such as the freely available Coinbase Vault.
    • Use a token approval checker to validate actual permissioning on self-custody wallets and revoke approvals that you did not knowingly authorize.

    Coinbase is working with industry partners to take down these sites and developing ways to warn users when visiting known scam sites in order to help limit the damage caused by this type of scam.

    [ad_2]

    Source link

  • Security PSA: Airdrop Phishing Campaign

    Security PSA: Airdrop Phishing Campaign

    [ad_1]

    By Coinbase Security Team

    As a part of our mission to build a safe and open financial system, we actively monitor for any security threats not only to Coinbase but to the crypto ecosystem as a whole. As we have discussed in our previous blog post on industry-wide crypto security threats, malicious threats against any crypto user or business are bad for the industry. With this community mindset, we do our best to inform and to defend our community from bad actors.

    Over the past month, Coinbase Threat Intelligence, Special Investigations, and Global Intelligence teams have been tracking an ongoing phishing campaign on Ethereum, Polygon, Binance Smart Chain, and other EVM-compatible platforms which has unfortunately resulted in the theft of more than $15M in various crypto assets to date. The phishing campaign does not affect customers who custody funds on Coinbase.com. However, anyone who uses self-custody wallets (e.g. Coinbase Wallet, Metamask, etc.) may be at risk.

    The campaign works by airdropping fictitious coins into victim wallets and enticing them to visit specially-crafted malicious websites. Below is an example of one such coin:

    Source: Polygonscan

    When users attempt to interact with the airdropped tokens such as transferring them to a Decentralized Exchange (DEX), they are presented with an error message encouraging them to visit a malicious phishing website:

    Source: Polygonscan

    The website presents users with a Decentralized Application (DApp) interface supposedly meant to connect their wallets and approve trading of the airdrop tokens. However, when users approve any transactions on the phishing website, in reality they are unknowingly approving a transfer of their personal tokens to the scammers.

    Source: Phishing Site

    The scammers change airdrop token names and phishing websites frequently to evade blocklists; however, they still use the same tactics to steal tokens using fake airdrops and malicious Dapps. Nevertheless, you can take the following security steps to defend your assets:

    • Be wary of airdrop tokens received from an unknown source. It is highly likely these unsolicited tokens are part of a phishing campaign.
    • Do not visit or connect self-custody wallets to any websites advertised by airdropped tokens through error messages, token names, or other methods.
    • Do not interact with airdropped tokens (e.g. approving, transferring, swapping, etc.). As annoying as it sounds, it’s best to just leave them sitting in your wallet.
    • Do not hold high value assets in the same wallet used to regularly interact with Dapps. Use cold storage or custodial solutions such freely available Coinbase Vault or Custody.

    Coinbase is working with industry partners to help limit the damage caused by the scam and we are planning to publish a more detailed analysis of the campaign in the near future.

    Security PSA: Airdrop Phishing Campaign was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

    [ad_2]

    Source link