# Bài viết Liên quan Phishing

Trung tâm Tin tức HTX cung cấp những bài viết mới nhất và phân tích chuyên sâu về "Phishing", bao gồm xu hướng thị trường, cập nhật dự án, phát triển công nghệ và chính sách quản lý trong ngành tiền kỹ thuật số.

3 crypto attacks in 24 hours – From fake apps to a $14.2M SOL theft

The cryptocurrency space witnessed a high volume of attacks within 24 hours, highlighting several major security threats. First, fraudsters targeted SecondFi by creating fake browser extensions and apps to steal crypto; the company clarified its official channels and warned against unsolicited links. In a separate incident, a compromised early Solana whale wallet led to the theft of 180,900 SOL (worth $14.2 million), with the stolen funds being bridged to Ethereum and laundered via Tornado Cash. Finally, the jscrambler npm package suffered a supply chain attack where stolen credentials were used to publish malicious versions containing an information-stealing payload. These events underscore the prevalence of phishing, wallet exploits, and software supply chain vulnerabilities, emphasizing the need for vigilance, verifying official sources, and prompt software updates.

ambcrypto4 giờ trước

3 crypto attacks in 24 hours – From fake apps to a $14.2M SOL theft

ambcrypto4 giờ trước

Polymarket to reimburse users after third-party compromise triggers $3M phishing attack

Prediction market platform Polymarket will fully reimburse users after a security breach on June 25. A compromised third-party vendor injected malicious code into Polymarket's frontend, leading to a phishing attack that targeted users interacting with the platform during a specific window. Blockchain security firm PeckShield estimates the attack drained approximately $3 million in PUSD from over 11 wallets. The stolen funds were bridged from Polygon to Ethereum and converted into roughly 1,893 ETH. Polymarket has contained the incident, removed the affected dependency, and is contacting impacted users for full refunds. The platform's underlying smart contracts were not compromised. No detailed postmortem or reimbursement timeline has been provided.

ambcrypto06/25 18:05

Polymarket to reimburse users after third-party compromise triggers $3M phishing attack

ambcrypto06/25 18:05

AI Deceives with Perfection: How Can Crypto Users Defend Against New Scams?

AI has made crypto scams more sophisticated by generating flawless text and realistic interfaces, rendering traditional detection methods like spotting typos and grammar errors obsolete. Scammers now use AI for polished phishing emails, fake customer service chats, and convincing websites. Crypto users face unique risks as blockchain transactions are irreversible, and attackers can steal assets simply by tricking users into authorizing malicious transactions. To defend against these advanced threats, users must adopt rigorous verification habits: - Carefully check website URLs for subtle spoofing. - Use only official links and channels. - Scrutinize all wallet permissions and token approvals before signing. - Verify contract addresses directly from trusted sources, not token names. - Ignore unsolicited private messages posing as customer support. - Treat urgent requests with extreme skepticism. The core principle is that a professional appearance no longer equals safety. In the AI era, security hinges on proactive verification of every link, transaction, and communication, not on trusting surface-level credibility.

marsbit06/08 09:38

AI Deceives with Perfection: How Can Crypto Users Defend Against New Scams?

marsbit06/08 09:38

AI's Deceptive Perfection: How Can Crypto Users Defend Against New Scams?

AI-generated content is making cryptocurrency scams more sophisticated and harder to detect. Previously, users could spot phishing attempts through poor grammar and spelling errors. Now, AI tools allow scammers to produce flawless, professional-looking emails, websites, and social media posts, often personalized using stolen user data. This shift poses unique risks in crypto, where transactions are irreversible and self-custody wallets can be compromised by a single malicious authorization. The article advises a shift from relying on visual cues to adopting rigorous verification as the primary defense. Key recommendations include: manually checking website URLs against official sources, scrutinizing wallet permissions before approving transactions, verifying smart contract addresses directly from project websites or block explorers, and being wary of unsolicited "urgent" messages from impersonated customer support. The core message is that in the AI era, a polished appearance is no guarantee of safety; every link, request, and interaction must be independently verified before any action is taken.

Foresight News06/08 08:04

AI's Deceptive Perfection: How Can Crypto Users Defend Against New Scams?

Foresight News06/08 08:04

Interpreting the FBI's '2025 Internet Crime Report': AI Fraud Becomes the Biggest Variable, Individuals Aged 60+ Emerge as Primary Targets for Crypto Scams

FBI's 2025 Internet Crime Report, based on over 1 million complaints, reveals record losses of $20.877 billion, a 26% increase from 2024. Cryptocurrency-related crimes surged to $11.366 billion, with victims over 60 years old being the primary target, suffering $2.76 billion in crypto investment scams alone. This age group was also most affected by recovery scams. Investment fraud was the costliest crime at $8.649 billion, followed by BEC scams ($3.047B) and tech support fraud ($2.135B). Phishing was the most common complaint. Ransomware attacks caused over $32 million in losses, with Akira and Qilin among the top variants. A significant emerging threat is AI-driven fraud, involved in over 22,000 complaints causing $893 million in losses. AI was used to create deepfakes for investment scams ($632M), BEC, and impersonation schemes. The report highlights the industrialization of scams through automation. Despite law enforcement successes, like freezing $679 million, the escalating losses and sophistication of attacks underscore the critical importance of public awareness and enhanced cybersecurity measures.

marsbit04/16 07:18

Interpreting the FBI's '2025 Internet Crime Report': AI Fraud Becomes the Biggest Variable, Individuals Aged 60+ Emerge as Primary Targets for Crypto Scams

marsbit04/16 07:18

How to Protect Your Digital Assets? A 15-Step Checklist from an OpenAI Co-founder

In the era of advanced AI, cybersecurity is no longer optional but a necessity. As AI tools like Anthropic's Mythos enable highly sophisticated and automated attacks, personal digital security requires proactive measures. OpenAI co-founder Andrej Karpathy’s 15-step "digital hygiene" checklist offers a foundational guide to self-protection: 1. Use a password manager to generate unique passwords. 2. Enable hardware security keys (e.g., YubiKey) for 2FA. 3. Use biometric authentication (Face ID, fingerprint). 4. Treat security questions as passwords—use random answers. 5. Encrypt disks (FileVault/BitLocker). 6. Reduce smart home devices to minimize attack surfaces. 7. Use Signal for encrypted messaging with auto-delete. 8. Switch to privacy-focused browsers like Brave. 9. Use independent search engines (e.g., Brave Search). 10. Employ virtual credit cards (e.g., Privacy.com) for online payments. 11. Use virtual mailing addresses to protect physical location. 12. Avoid clicking email links; manually type URLs. 13. Use VPNs (e.g., Mullvad) on untrusted networks. 14. Enable DNS-level ad/tracker blocking (e.g., NextDNS). 15. Monitor network activity with tools like Little Snitch. With AI-powered threats likely to become widely available soon, implementing these steps now is critical to safeguarding digital assets.

marsbit04/12 06:08

How to Protect Your Digital Assets? A 15-Step Checklist from an OpenAI Co-founder

marsbit04/12 06:08

Crypto Victims Relieved – Or Too Late? What Operation Atlantic Really Means

Operation Atlantic is a major UK-US-Canada law enforcement initiative targeting crypto fraud and approval-phishing scams, involving agencies like the UK's National Crime Agency and the U.S. Secret Service, along with private partners such as Chainalysis. The operation aims to identify victims and compromised wallets in real time, freeze illicit funds before laundering, and generate investigative leads. Initial results include over 20,000 identified victims, more than 20,000 flagged wallet addresses, and over $12 million in frozen suspected scam proceeds. Globally, $45 million in stolen crypto has been identified. Approval phishing scams trick users into signing malicious transactions, allowing direct wallet draining. The operation highlights growing efforts to combat these rapidly evolving crypto crimes.

bitcoinist04/10 20:02

Crypto Victims Relieved – Or Too Late? What Operation Atlantic Really Means

bitcoinist04/10 20:02

Steakhouse postmortem reveals DNS hijack caused by registrar 2FA bypass

Steakhouse's postmortem of a 30 March security incident reveals that attackers hijacked its domain through a social engineering attack on its registrar, OVHcloud. The attacker impersonated the account owner, convinced support to disable hardware-based two-factor authentication, and took full control of the account. This allowed them to redirect DNS to a phishing site with a wallet drainer for about four hours. No user funds were lost, as on-chain systems remained secure, and wallet protections quickly detected the fake site. The breach underscores the risk of off-chain infrastructure vulnerabilities and over-reliance on a single registrar. Steakhouse has since migrated registrars, enhanced DNS monitoring, and implemented stricter domain security controls.

ambcrypto04/10 19:03

Steakhouse postmortem reveals DNS hijack caused by registrar 2FA bypass

ambcrypto04/10 19:03

A $280 Million Lesson! The 2026 DeFi Security Guide to Avoiding Pitfalls

"DeFi Security Lessons from a $280M Hack: A 2026 Guide to Avoiding Pitfalls" The rapid growth of DeFi has turned it from a niche interest into a mainstream pursuit for high yields. However, this comes with significant risks, highlighted by a major attack on Solana's Drift Protocol in April 2026, resulting in losses between $220-$285 million. This event underscores that in DeFi, users bear full responsibility for their assets. Most losses occur during normal operations through common vulnerabilities: 1. **Excessive Token Approvals**: Granting unlimited contract permissions can lead to complete asset drainage. 2. **Phishing Websites**: Fake sites mimic legitimate projects to steal wallet credentials. 3. **Contract Exploits**: Code vulnerabilities allow hackers to legally drain funds. 4. **Rug Pulls**: Malicious projects withdraw liquidity, causing tokens to crash. The guide outlines five essential pre-interaction checks: 1. **Contract Security**: Verify contracts are open-source and audited by firms like CertiK. Avoid unaudited or newly deployed contracts. 2. **Authorization Management**: Avoid unlimited approvals; use minimal permissions and regularly revoke unused allowances via tools like revoke.cash. 3. **Official Access Points**: Bookmark official sites from trusted sources (e.g., project Twitter/Discord) to avoid phishing scams, which cause over 60% of losses. 4. **Abnormal Yields**: Extreme APYs (e.g., stablecoins >20%) often signal scams. Compare rates to established protocols like Aave. 5. **Asset Segregation**: Use a multi-wallet system (hot, DeFi, cold) to isolate assets and prevent total loss from a single breach. Additional risks include insider threats from developers or employees with privileged access. Psychological biases (e.g., FOMO) and AI-powered phishing make users susceptible. Core principles: never grant unlimited approvals, avoid unknown links, and diversify investments. Security is not optional but a fundamental requirement in DeFi.

marsbit04/08 00:06

A $280 Million Lesson! The 2026 DeFi Security Guide to Avoiding Pitfalls

marsbit04/08 00:06

X Eyes Auto-Lock For Crypto Mentions After Tortoise Death Hoax

A Solana memecoin named JONATHAN surged over 6,000% following a hoax on X that falsely reported the death of Jonathan, a 193-year-old tortoise. The scam originated from a fake account impersonating the tortoise’s real veterinarian, Joe Hollins, and was amplified by some news outlets before being debunked. Both the Governor of Saint Helena and the actual veterinarian confirmed Jonathan was alive. In response, X’s head of product, Nikita Bier, announced the platform is implementing auto-locking and verification for users who mention cryptocurrency for the first time, aiming to reduce such scams. The incident highlights a common fraud pattern: using impersonation and emotional stories to promote fraudulent tokens quickly before the truth emerges. The token’s value briefly spiked but later pulled back sharply.

bitcoinist04/03 18:32

X Eyes Auto-Lock For Crypto Mentions After Tortoise Death Hoax