phishing

FlashRescue co-founder @DarcyAri posted on the X platform that the Hyperliquid-related Google paid advertising phishing incident has resulted in approximately $550,000 in financial losses.The addresses related to the attackers have been disclosed, and users need to be vigilant about the phishing risks associated with Google paid advertisements and pay attention to protecting their asset security.

According to SBS, the Financial Supervisory Service (FSS) of South Korea has begun a comprehensive reform of its system to address compensation issues related to financial fraud, including voice phishing involving virtual assets. The FSS launched the "Financial Fraud Loss Compensation System Improvement Project" on August 6. This project aims to reform the existing compensation calculation system centered on the Korean won, in preparation for including virtual asset losses in the compensation scope starting in October this year.The current system primarily calculates compensation amounts based on losses valued in Korean won, but after the reform, a compensation ratio will be adopted, taking into account the type and quantity of virtual assets involved. Additionally, during payment suspensions, the Korean won exchange value of virtual assets will also be included in the calculations.

According to on-chain detective Specter, the same attacker is running similar phishing activities targeting Ledger. The relevant screenshots were taken two days ago, and the sponsored advertisement has now been removed.As of now, these activities have stolen over 3 million dollars.

Bitcoin News posted on the X platform that a Trezor user claimed their life savings were stolen after clicking on a Google sponsored search result impersonating Trezor. The phishing page was hosted on Google Sites and allegedly tricked victims into entering their wallet recovery seed.Trezor stated that it is upgrading its response to the report, working to remove the website, and reminding users to never enter their wallet backups or recovery phrases on any website or online form. Google sponsored phishing ads remain a persistent attack vector faced by cryptocurrency users.

According to GoPlus monitoring, a user on the Base chain lost 500,000 USDC due to a phishing attack. When the attacker exchanged the stolen funds for WETH, the script did not set slippage protection, routing to a Uniswap V4 WETH/USDC pool with almost no liquidity, resulting in only 67.9 ETH (worth $129,000) being exchanged for 500,000 USDC, of which $370,000 was earned by an MEV bot.The MEV bot only paid 0.03 USDC to front-run the transaction but incurred 3.5 ETH in gas fees for this. Subsequently, the victim sent an on-chain message to the attacker and the MEV address, stating that they had identified the attacker and were willing to pay a 10% bounty for a refund.

According to official news, the Ethereum Foundation's "Trillion Dollar Security" (1TS) has announced a special grant to the Freedom of the Press Foundation (FPF) to support the ongoing development of the open-source tool WEBCAT, aimed at addressing the long-standing front-end code verification security gap in Ethereum wallets and decentralized applications (DApps).WEBCAT (Web-based Code Assurance and Transparency) is an open-source tool designed to help browsers verify whether the code loaded by a website matches the version publicly released by the developer.This funding will promote the expansion of WEBCAT to Ethereum wallets and application scenarios, enabling users to verify whether the front-end pages they access have been tampered with.The Ethereum Foundation stated that while HTTPS can verify the website a user is connected to and encrypt communication, it cannot prove that the front-end code actually running on the website is the same version released by the developer. If an attacker controls the website's front-end code, they may modify the transaction receiving address without the user's knowledge or induce the user to sign transactions that do not match the content displayed on the page.The Ethereum Foundation noted that front-end attacks have become a significant security risk for blockchain infrastructure, with malicious modifications to web interfaces potentially leading to supply chain attacks, DNS hijacking subsequent attacks, and user interface deception.WEBCAT was initially developed by the Freedom of the Press Foundation to enhance the code credibility of secure communication systems like SecureDrop.With this expansion into the Ethereum ecosystem, it will complement security measures such as "Clear Signing" in the 1TS program: the former helps wallets confirm that the application front-end has not been tampered with, while the latter helps users understand the transaction content they are approving.

According to Bloomberg, the Internal Revenue Service (IRS) has warned cryptocurrency holders that scammers are contacting some taxpayers by mailing fake letters in an attempt to steal their digital assets or personal data. The IRS stated that these letters may ask taxpayers to register for a so-called "Digital Asset Compliance Portal," which does not exist. The IRS also reminds users not to scan suspicious QR codes and not to answer or cooperate with calls requesting payment.While phishing and digital scams are not new in the cryptocurrency industry, sending fake IRS notices through physical mail seems to be a new scam tactic. Since the IRS has indeed sent letters related to digital assets to taxpayers in the past, and last year saw a surge in cryptocurrency tax filing notifications, many taxpayers are confused, which may lead scammers to exploit this familiarity for disguise. As the U.S. tax system requires taxpayers to disclose cryptocurrency activities on their tax returns, communication between the IRS and cryptocurrency holders has become more common. This also makes counterfeit tax notices more misleading. For cryptocurrency users, encountering "IRS letters" involving portal registration, QR code scanning, wallet connections, or payment requests should be treated with caution, and verification should be done through official channels.

GoPlus Security issued a security alert stating that a user signed a malicious Permit transaction 183 days ago, resulting in approximately $1,625 of USDC being transferred by a phishing attacker.Since the user did not revoke the relevant authorization afterwards, the attacker again used that authorization to transfer approximately $75,780 of USDC.

Moonshot tweeted a reminder that some users received a phishing email with the subject "View Recent Activities." This email did not come from Moonshot, and no signs of account compromise have been found so far. The official team is investigating this matter.Moonshot advises users to delete the email and not to click on any links. If you have clicked on a link or entered a verification code, please contact the official support through the in-app support.

According to Scam Sniffer monitoring, a user lost approximately 999,999 USDT after signing a phishing token authorization on Ethereum.The attacker initially attempted to withdraw 1 million dollars (which was 631 dollars more than the wallet balance) but failed. After 36 seconds, they recalculated and successfully withdrew the entire remaining balance. Scam Sniffer reminds users to verify all signature requests and never rush to sign transactions.

On-chain security analyst Specter stated that a phishing attack suspected to target Polymarket users is currently occurring, with total losses amounting to approximately $2.94 million.According to its monitoring, attackers have transferred funds from more than 11 victim wallets holding PUSD, converting the stolen assets into ETH, while reminding users to be cautious of phishing risks and stating that the incident is still under ongoing investigation.

Blockchain security company Blockaid stated that its detection system found signs of a front-end attack on the Gitcoin subdomain files[.]gitcoin[.]co, with suspected malicious code named "Eleven drainer" included in the website, used for wallet asset theft. Blockaid warns users not to interact with the website at this time, and the related issues are under investigation and repair.

According to the "Мошеловка" platform, scammers impersonate authorized brokers of the Moscow Exchange through social media, luring users to click phishing links under the pretext of "testing cryptocurrency trading channels," resulting in theft of funds and information. The Moscow Exchange emphasizes that all official trading must be conducted through licensed brokers, and there are no exclusive cryptocurrency purchasing channels for ordinary users.According to data from the Russian IT company "Shard," in 2025, Russian users are expected to lose approximately 234 million rubles due to cryptocurrency phishing, accounting for 62% of the total losses in cryptocurrency assets that year.

According to GoPlus warning, a user lost approximately $316,000 worth of USDC to a phishing attack due to signing a malicious Permit2 transaction.

GoPlus issued a security alert stating that the Korean version of Liangxi, contract live broadcast KOL Xibajie @jadoodoo_'s X account has been hacked, and is crazily sending phishing links to fans under the guise of collaboration. Several KOLs have already fallen victim, with total losses amounting to approximately $5,000. Please do not click on links to connect wallets or download malware.

According to GoPlus security alerts, phishing scams promoting black U and anti-money laundering detection websites have appeared on the X platform. Investigations reveal that the website is a phishing site hosted on the Vercel platform, aimed at tricking users into authorizing their wallets, so please do not interact.GoPlus recommends: try to avoid private transactions and use the OTC features of centralized exchanges; maintain a high level of suspicion towards unfamiliar links, especially those requiring wallet signatures or authorizations; remember the "four no choices" to prevent phishing: do not click on unfamiliar links, do not install software from unknown sources, do not sign transactions with unclear content, and do not transfer funds to unverified addresses.

On-chain analyst "b-block" posted on social media on Monday that a counterfeit Uniswap website is stealing funds from multiple wallets, with assets held by the scammers valued at over $400,000. Stacy Muur, founder of the Web3 marketing agency Green Dots, shared screenshots of false sponsored results from search engines, criticizing Google for ignoring this issue for years, leading to fake links ranking above real ones, resulting in users continuously being scammed.According to Etherscan data, the two flagged addresses hold a total of about 146 ETH, valued at approximately $306,000. DeFiLlama pointed out that fake ads on Google are a common source of phishing attacks. The crypto nonprofit organization Security Alliance (SEAL) reported in April that phishing activities on Google searches significantly increased in March, with attackers deploying highly deceptive fake ads by paying for or hijacking legitimate ad accounts, using seemingly real URLs to bypass Google's automatic checks, and loading malicious payloads through hidden iframes.SEAL has blocked over 356 malicious ad links and stated that the volume of Google ads deployed by attackers has remained stable for over a year, with no slowdown in attack activities. Reports indicate that between March 13 and 30 alone, a total of $1.27 million was stolen. Additionally, earlier this month, there were malicious ad campaigns targeting Mac users that utilized Google ads and the AI chatbot Claude for shared chats. Malwarebytes also reported that Facebook is similarly a hotspot for fake ads and scams.

According to SolanaFloor monitoring, a scam gang is impersonating Jupiter, airdropping fake CJUP tokens to wallets, and enticing users to connect to a scam website to steal assets.

According to Cointelegraph, Casa co-founder Jameson Lopp warned that a new phishing technique has emerged, where attackers abuse legitimate Google recovery forms to hide malicious links within lengthy messages filled with a lot of blank space.

SlowMist has issued a security warning stating that a high-risk phishing activity targeting TRON wallet users has been discovered. Attackers created a fake Chrome extension for the TronLink wallet, using Unicode bidirectional control characters and Cyrillic homographs to disguise the brand name. After installation, the extension loads a complete phishing page through a remote iframe, forming a "shell-core separation" credential theft chain.The malicious extension name uses homographs for disguise, and its Chrome Store page inherits the high user count and positive reviews of the real extension, lowering the review threshold. There is very little local code, only loading remote pages, making static analysis nearly impossible to detect malicious behavior. The remote phishing page perfectly replicates the official TronLink web wallet interface, stealing mnemonic phrases, private keys, Keystore files, and passwords, and relaying them in real-time via a Telegram Bot.Built-in anti-analysis features disable right-click, developer tools, drag-and-drop, and printing, and redirect based on the geographic and language settings of Russian users to evade detection. SlowMist recommends immediately uninstalling suspicious extensions, clearing local storage, checking for abnormal traffic, and if credentials have been entered, creating a new wallet and transferring assets immediately.