# Phishing Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Phishing", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Trezor user reports new wave of phishing

A Trezor user reported receiving a phishing email disguised as a message from the hardware wallet provider. The fake email claimed there was a critical entropy vulnerability in the firmware, alleging that a 2021 update could have weakened the seed phrase generation on some devices. Trezor acknowledged this new wave of phishing attacks, stating that attackers are likely using a combination of data from past leaks at various cryptocurrency services, which may include compromised KYC information. The company referenced a prior security incident involving a third-party tool and mailing list subscriber emails as a possible link. Trezor also noted it has taken measures to prevent further data leaks. This follows a recent report from Trezor about a data breach affecting 13,689 customers due to a hack at its logistics partner, ShipMonk, approximately two weeks earlier.

cryptonews.ru19h ago

Trezor user reports new wave of phishing

cryptonews.ru19h ago

Investment Company Lost $2 Million in Address Poisoning Attack

An investment firm, Bofur Capital, lost $2 million in a crypto dusting (address poisoning) attack. The scammers first sent a minuscule 0.0002 USDC transaction to the firm's Ethereum wallet. The recipient address had nearly identical starting and ending characters to a legitimate counterparty the firm regularly transacted with. It is believed a wallet operator later copied the wrong address from the transaction history, inadvertently sending 2 million USDC to the fraudulent wallet, which promptly converted the funds to DAI. Analysts noted the trap was set 20 hours before the large transfer, suggesting hackers monitored the target wallet for a major withdrawal. Following the Ethereum Fusaka upgrade, such address poisoning attacks have surged dramatically. Data shows a 612% increase in USDT dusting transactions over three months, with one investor losing over 500,000 USDT. An earlier Etherscan study (covering July 2022-June 2024) identified roughly 17 million poisoning attempts, affecting at least 1.3 million users and causing over $79.3 million in losses. These attacks are even more frequent on chains with lower fees, like BSC.

cryptonews.ru2 days ago 08:38

Investment Company Lost $2 Million in Address Poisoning Attack

cryptonews.ru2 days ago 08:38

The Danger of Old Bookmarks: How an Expired Tornado Cash Domain Cost a User 1,000 ETH

A user lost over 1,010 ETH (worth millions) due to a phishing attack via an expired official domain of the Tornado Cash protocol. As reported on August 20, 2026, the domain `tornado.cash` was not renewed by the original developers amid U.S. OFAC sanctions and was subsequently registered by malicious actors. They deployed a fake frontend mimicking the legitimate Tornado Cash interface. Through this site, the attackers gained access to the user's deposit notes—the data required to withdraw funds from the protocol's pools—and drained the ETH within 12 hours. On-chain data shows the stolen funds (e.g., wallet 0xd8B356...) were withdrawn from Tornado Cash pools. However, on-chain analyst Specter cast doubt on the victim's story. He suggested the individual might be involved in illicit activity, noting that a large sum of BTC was received from a coin-mixing service (Whirlpool) and converted to ETH before being sent to the fake Tornado Cash site. The victim's explanation of urgently moving funds due to a compromised hardware wallet was questioned, as the fund trail indicated deliberate obfuscation. Specter speculated this might be a conflict between malicious actors rather than a simple phishing case. The incident highlights the danger of expired domains for major protocols, where old bookmarks can lead to compromised sites. WHOIS records show the domain was registered in March 2025. Broader analysis notes that in 2025, over $1.8 billion was lost to scams and exploits, largely through social engineering like phishing via familiar but hijacked links. This case underscores the persistent risk when a domain's legal status changes but user trust and search engine reputation remain.

cryptonews.ru08/23 17:40

The Danger of Old Bookmarks: How an Expired Tornado Cash Domain Cost a User 1,000 ETH

cryptonews.ru08/23 17:40

India Orders Closure of Hundreds of Google Firebase Accounts Used in Banking Frauds

India's cybercrime agency ordered Google to block hundreds of accounts on its Firebase app development platform. The move came after investigators traced numerous fake banking apps and phishing websites to the service. The Indian Cyber Crime Coordination Centre (I4C) sent multiple notices to Google, identifying at least 57 websites and databases on Firebase allegedly used to distribute malware and steal victims' financial data. Among these, seven were phishing pages mimicking login screens of major Indian banks like State Bank of India, ICICI Bank, and Axis Bank. The rest were reportedly data collection points for stolen information like credit card numbers and one-time passwords. The fraud scheme involved Android malware disguised as legitimate banking apps, luring victims with promises of new credit cards, rewards, or credit limit increases. Once installed, the app secretly forwarded device data to a Firebase database controlled by scammers, granting them access to other apps and the victim's funds. One scam specifically targeted beneficiaries of a government farmer aid program. This action marks a shift in India's approach. Previously focused on blocking individual fraudulent websites, authorities are now targeting the broader infrastructure enabling these scams. The move highlights how fraudsters exploit widely accessible platforms like Firebase, attracted by its free tier and database capabilities, to target India's vast digital payment user base.

cryptonews.ru08/22 10:43

India Orders Closure of Hundreds of Google Firebase Accounts Used in Banking Frauds

cryptonews.ru08/22 10:43

Hackers Set Traps on Over 2000 Hacked WordPress Sites for Cryptocurrency Users

Cybersecurity firm Check Point Research has uncovered a hacking campaign, dubbed "StopAndProtect," that has compromised over 2,000 poorly maintained WordPress sites. These legitimate-looking websites are used to host malware that specifically targets cryptocurrency users and Windows systems. The campaign employs a deceptive tactic where visitors are shown a fake CAPTCHA page. Attempting to solve it instructs the user to run a malicious PowerShell command. This downloads .NET malware capable of stealing cryptocurrency wallet seed phrases, saved passwords, and files from the infected computer. The malware can also encrypt data for ransom, take screenshots, and even record keystrokes. The attackers' unique method involves using these hijacked WordPress domains as free infrastructure to host malicious payloads, command-and-control servers, and stolen data storage. Researchers gained significant insight because the hackers left directories and log files publicly accessible online. These logs revealed an infection of over 6,000 unique IP addresses between mid-May and late July, with victims primarily in the U.S., Russia, and India. The uncovered data also included an attacker's tool for managing the compromised sites and a list of the nearly 2,000 domains involved in the scheme.

cryptonews.ru08/21 19:17

Hackers Set Traps on Over 2000 Hacked WordPress Sites for Cryptocurrency Users

cryptonews.ru08/21 19:17

Wallet Connection Prompts Are a Sign of a Fake AML Check Website

Fake anti-money laundering (AML) verification sites are stealing from cryptocurrency investors. These websites trick users into connecting their wallets and signing transactions, which is unnecessary for a basic wallet check, as discovered by Malwarebytes. Legitimate wallet verification only requires a public address to analyze transaction history for links to hacks, thefts, or sanctioned entities. The fraudulent sites, some copying brands like AMLBot, mimic this process. After a user initiates a scan, they are prompted to connect their wallet, shown fake progress bars, and sometimes asked to pay a small "fee." Eventually, a false "clean, low risk" verdict is given to download a report. Connecting a wallet reveals the public address and assets, allowing scammers to craft targeted transactions for the victim to approve, which can drain funds. Malwarebytes warns that any AML checker requesting wallet connection instead of just a public address is a major red flag. The report details that the same malicious template is repackaged under different names. It also mentions a $500 scam kit advertised on cybercrime forums that creates fake token presales, scans visitor wallets for valuable assets, and attempts to steal secret recovery phrases by offering a bonus. The article advises users who connected only a wallet to revoke the site's permissions. Those who signed suspicious transactions should check activity and move funds to a new wallet if compromised. Anyone who entered a recovery phrase or private key should assume the wallet is breached.

cryptonews.ru08/21 05:26

Wallet Connection Prompts Are a Sign of a Fake AML Check Website

cryptonews.ru08/21 05:26

They tapped it out: scammers find a new way to deceive Hamster Kombat players

In the summer of 2026, scammers intensified their operations targeting players of the game Hamster Kombat. They exploited the announcement of the new Gram crypto wallet in Telegram and the volatile price of the game's HMSTR token. Dozens of fake Telegram channels and websites appeared, offering users profitable ways to sell or transfer their HMSTR tokens. The schemes involved directing victims to phishing sites that stole Telegram account credentials via phone numbers and confirmation codes or tricked them into signing malicious smart contracts, thereby granting access to their wallets. Experts note a sharp surge in searches related to Hamster Kombat and "how to withdraw money." The schemes prey on users' confusion about new features and fear of missing out during price spikes. Security advice includes only using official services to conduct trades, never sharing seed phrases or authentication codes, verifying all transaction details carefully, and being wary of urgent, unsolicited offers from strangers. While interest in the low-liquidity HMSTR token saw a brief revival, it primarily created an attractive environment for fraud rather than signaling a full project comeback.

cryptonews.ru08/20 21:48

They tapped it out: scammers find a new way to deceive Hamster Kombat players

cryptonews.ru08/20 21:48

Crypto Investor Loses 1,010 ETH on Obsolete Tornado Cash Website

A cryptocurrency investor lost 1010 ETH after using an outdated browser bookmark to access the Tornado Cash mixer website. According to security analysts from Wu Blockchain, the domain had been seized by malicious actors who deployed a fake interface mimicking the original service. The victim, believing they were interacting with genuine Tornado Cash smart contracts, inadvertently granted the scammers access to their wallet. The funds were drained within 12 hours, transferred out in small batches of primarily 100 and 10 ETH. The team behind Tornado Cash lost control of the old domain after being unable to renew it following sanctions imposed by the US Office of Foreign Assets Control (OFAC) in 2022. Criminals subsequently registered the domain and set up the phishing copy. The mixer now operates via decentralized channels like IPFS and ENS. Wu Blockchain estimates the fake site's operators have stolen a total of roughly 4000 ETH from various users over the past year. Separately, blockchain security firm Bitdefender reported that scammers are distributing the Lumma Stealer malware disguised as pirated copies of Christopher Nolan's recent film "Oppenheimer."

cryptonews.ru08/20 15:42

Crypto Investor Loses 1,010 ETH on Obsolete Tornado Cash Website

cryptonews.ru08/20 15:42

Crypto Scammers Pose as Address AML Checking Services

Cybersecurity experts have uncovered a cryptocurrency scam where fraudsters impersonate legitimate AML (Anti-Money Laundering) address-checking services like AMLBot by copying their design, logos, or using similar names such as AMLCheck. These fake services, which normally verify if a crypto address has been linked to illegal activities, trick users by asking them to connect their wallet—unlike genuine services that only require a public address. Once a user connects, scammers obtain their public address and create a transaction for them to approve, often claiming a "security check" or "compliance verification." The fake service then displays a false error, prompting the user to deposit a small amount for a "fee" to complete the check. After the user complies, the site shows a "clean address" result and offers a downloadable verification report, which installs malware. Malwarebytes Labs and security firm CertiK warn that legitimate AML checks never require wallet connections, transaction approvals, or seed phrases. If a service requests these, it is a scam. In cases of theft, users are advised to move remaining funds to a new address and avoid "asset recovery" offers for a fee. CertiK noted that phishing and deepfakes are primary hacker tools, with crypto industry losses reaching $3.3 billion in 2025 alone.

cryptonews.ru08/19 22:08

Crypto Scammers Pose as Address AML Checking Services

cryptonews.ru08/19 22:08

Web3 Wallets in a 'Turbulent Autumn': In the AI Era, How to Understand the Evolution of 'Spear and Shield' in Crypto Security?

The recent spate of incidents involving Coldcard, Trezor, and SafePal highlights a critical evolution in cryptocurrency wallet security, moving the focus beyond simple private key protection to a holistic, multi-layered attack surface. These events—spanning a random number generator flaw, supply chain data leaks, and plugin permission issues—underscore that vulnerabilities now exist across the entire wallet lifecycle: from secure element and code generation to logistics, user data, and daily interactions with dApps. This broadening threat landscape is accelerating with the advent of AI. Attackers are leveraging AI to automate and scale previously labor-intensive tasks like vulnerability discovery, sophisticated social engineering, and targeted phishing campaigns. This effectively lowers the cost of attacks, eroding the security margin once provided by the high effort required to find and exploit flaws. In response, defense strategies must also evolve by integrating AI. The future of wallet security lies not just in static rules and blacklists, but in proactive, AI-powered risk assessment. This includes pre-transaction simulation, behavioral analysis to detect anomalies (like sudden large approvals), and contextual awareness of dApps and counterparties. The goal is to transform wallets from passive signing tools into active guardians that can understand intent, predict outcomes, and clearly communicate risks to users—all while preserving user sovereignty and control through minimal permissions and human confirmation for critical actions. Ultimately, self-custody does not guarantee inherent safety; it returns absolute control to the user. Protecting that control requires a dynamic, evolving security posture where AI becomes a essential tool on both sides of an ongoing "spear and shield" arms race in the Web3 ecosystem.

marsbit08/19 08:41

Web3 Wallets in a 'Turbulent Autumn': In the AI Era, How to Understand the Evolution of 'Spear and Shield' in Crypto Security?

marsbit08/19 08:41

活动图片

Market Analysisright-arrow

Othersright-arrow