phishing

The cryptocurrency wallet provider Bitget Wallet announced plans to expand AI-assisted threat detection. In the third quarter of 2026, the average number of signature requests flagged as potential phishing increased by 7.4 times, rising from about 5,000 in the second quarter to approximately 37,000. Bitget Wallet's Chief Operating Officer Alvin Kan stated that this increase may reflect both a rise in threat activity and enhanced detection capabilities, but existing data cannot quantify the contribution of each.Alvin Kan added that the statistic refers to flagged signature interactions, rather than independent attack incidents or confirmed financial losses. Bitget Wallet introduced AI-assisted risk detection in the second quarter, and the expanded AI checks analyze website code and domain registration information to identify signs of fraud, simulating transactions before user signatures to uncover hidden permissions. In October, 90% of the newly intercepted high-risk domains were identified by AI, compared to 36% in the second quarter; nearly 70% of the domains flagged by AI that month did not have matching alerts in the external threat intelligence sources it checked.Phishing threats continue to target cryptocurrency users. In July this year, a trader lost nearly $1 million due to signing a malicious Ethereum token authorization. An August survey by Rapid7 found that a phishing campaign targeted 885,000 phone numbers, directing recipients to a website impersonating a cryptocurrency wallet provider.

The cross-chain protocol Across announced that it has regained control of its official website domain, and all systems have returned to normal operation. Across stated that it will fully compensate all affected users and will release a complete post-incident analysis report in the coming days.According to previous disclosures from Across, the attacker gained control of the domain through a social engineering attack on the domain registrar Namecheap. During the period when the domain was out of control, the security response team SEAL 911 assisted in marking it as a phishing site. Across noted that some wallets or browsers may still display phishing warnings, which are expected to be eliminated soon.

According to Scam Sniffer monitoring, someone lost $303,000 worth of aEthWETH after signing a phishing signature on Ethereum.

According to Web3 developer brucexu.eth, he encountered a phishing scam involving fake recruitment in January this year. After using Cursor to open the project directory provided by the other party, his device was infected with a Trojan, but ultimately there was no asset loss.He stated that the attacker provided a code repository through the recruitment process; he initially thought it was safe to just view the code without running it, but after analyzing the sample, Yu Xian, the founder of Slow Mist, warned that opening the project directory could also trigger malicious code. After confirming the infection, he transferred assets, rotated credentials, and reinstalled the system.

According to GCSA monitoring, the Global Cybersecurity Alliance (GCSA) has released three independent technical investigation reports, disclosing several recent security risks related to digital assets. Attackers impersonated security@ku.com to lure users into downloading remote control programs. GCSA found that the relevant domain names had not previously configured DMARC; after notification, KuCoin has completed rectification and enabled DMARC isolation policies.After the original MCP toolkit referenced in Bitkub's official documentation was taken down, a third party re-registered the npm package name. The installation method without a fixed version and the risk of plaintext keys may lead to credential leakage; there is currently no actual evidence of theft, and Bitkub has not yet responded to the notification.The TranchePool treasury within the Avalanche ecosystem was attacked due to a cross-day settlement logic flaw, where attackers utilized flash loans and repeated withdrawals to transfer approximately 1.0134 million USDC within 202 seconds. This incident is categorized as a vulnerability in the upper application, and the underlying network was not affected. GCSA stated that it has reported the clues to the relevant platforms and published the original analysis and evidence for industry reference.

CZ cited security researchers regarding the discovery of counterfeit Trust Wallet websites, reminding users to be cautious in distinguishing between .cam and .com domain names.

He Yi posted on platform X, stating that the Binance community reward activity requires regulatory approval and will go live tomorrow after being reviewed and approved by the regulatory agency.Currently, there are no cash voucher activities. Please be cautious of various phishing and scam links.

Bitcoin News posted on the X platform stating that Foundation claims attackers are sending a new round of phishing emails through the compromised domains of other companies, and these emails do not originate from the official Foundation domain.

Jameson Lopp, co-founder and Chief Security Officer of the Bitcoin self-custody service provider Casa, posted on X that a new type of Google phishing technique has emerged, where attackers abuse Google's own infrastructure to send emails. He stated that if users click on the goo.gl link in the email, they will be directed to a phishing login page, and he attached relevant email screenshots in the post.The post was published on October 29. Below the post, some users mentioned that they have reported similar situations to Google multiple times but have not received a response; other users stated that this technique is used in conjunction with calls that appear to be from Google and caller ID.

According to a report released by Microsoft Threat Intelligence on the 29th, North Korean hacker groups are using artificial intelligence to accelerate cyberattacks on South Korean users, expanding from customized phishing documents, fake recruitment, and identity disguise to malicious code development and software supply chain attacks. Microsoft assessed the AI adoption levels of eight North Korean-related hacker organizations: three have reached the highest "Operational Maturity" stage at level four, integrating AI into their daily attack processes; four are in the "Acceleration" stage, and one is in the "Expansion" stage.The report states that organized groups customized and generated over 100 PDF bait documents targeting different objectives between August and September this year, with instances of producing dozens of documents in just a few minutes. From June 8 to 12 this year, there were also cases of using three disguised companies to initiate fake recruitment invitations to professionals in AI, blockchain, and cybersecurity. Additionally, Microsoft analyzed that North Korean hackers might use AI programming tools like Cursor to assist in code generation, debugging, and evading detection; the North Korean Reconnaissance General Bureau's "Onyx Sleet" (referred to as Andariel by South Korea) and "Pearl Sleet" have been using the open-source AI penetration testing framework ARTEX in real operations since late October. Microsoft believes that while these organizations have enhanced their attack speed and efficiency with AI, they have not yet entered a fully autonomous attack phase and recommends that companies strengthen identity verification for job applicants, phishing protection, and malicious code detection.

CZ's post pointed out that on that day, there were 4 reported data breaches involving Coinbase's third-party vendor Amplitude, the South Korean cryptocurrency exchange Bithumb, and South Korean securities firms Mirae Asset and Daishin Securities. Among them, the breach related to Amplitude did not affect customer funds.CZ stated that the leaked exchange data was primarily used for phishing, SIM card hijacking, social engineering scams, and wrench attacks. He suggested that all platforms use independent email aliases and dedicated backup numbers, refuse to fill out unnecessary personal information, and use strong independent passwords.CZ also recommended enforcing the use of hardware security keys or passkeys, completely disabling SMS 2FA, enabling withdrawal address whitelists, withdrawal time locks, and anti-phishing codes, regularly cleaning API keys and active sessions, and requesting number porting locks from carriers. He also reminded that all customer service contacts that reach out proactively are scammers, and never to click on external links.

According to the official announcement from Foundation, regarding the recent phishing email incident, the team’s investigation found that their email system recorded over 23,000 phishing email sending attempts, of which 19,057 were sent via Mailgun, and another 1,503 were sent via Google Workspace.Due to some email accounts receiving multiple emails, and some sending attempts being unsuccessful or intercepted, it is currently not possible to confirm the actual number of affected individuals.

Slow Fog's Yu Xian posted on platform X, stating that Slow Fog's MistEye global threat intelligence hunting has discovered over 1,500 DarkSword phishing sites deployed across the internet, involving e-commerce, fake Binance, fake OKX, fake wallets, gaming, and cryptocurrency exchange businesses.

Binance founder CZ tweeted that there are concerns about artificial intelligence attacking cryptocurrencies, but the encryption technology relied upon by the internet and banking systems is weaker.He pointed out that artificial intelligence can cause harm without cracking Bitcoin's cryptography, and the leaked data has fueled more phishing and social engineering attacks, reminding users to pay attention to security.

Digital hardware wallet manufacturer NGRAVE disclosed that attackers hijacked the third-party notification service used by its LIQUID companion app and sent false security alerts to users, resulting in approximately 70 wallet addresses being stolen across 4 blockchains, amounting to about 2.56 million dollars. Among these, the loss in Bitcoin was approximately 1.77 million dollars, XRP about 454,000 dollars, Ethereum assets about 316,000 dollars, and Stellar about 18,000 dollars.The attackers induced users to click on a counterfeit website and enter their 24-word recovery phrase or Perfect Key, subsequently using automated scripts to transfer assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised; the victims voluntarily provided their recovery credentials during the phishing process. Unauthorized access may have begun on October 11. After obtaining an access key, the attackers acquired a broader access key and sent false notifications on October 17; NGRAVE detected anomalies about 1 minute after the notifications appeared, but the first wallet was emptied 6 minutes later, and the notification system was shut down that evening.NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a cryptocurrency security firm and mentioned that affected keys have been replaced, with new dual approval, domain restrictions, and emergency shutdown mechanisms implemented. The company also reminded affected users to create new wallets and contact the support team, as some device information, wallet activity, IP addresses, and approximate locations may have been exposed.

According to CryptoSlate, Microsoft and the cybersecurity organization Health-ISAC have obtained a court order in the United States to seize and redirect the domains supporting three services: YAM Store, CoGUI, and Iron Man. These three services sell stolen accounts and phishing tools to fraudsters. Since January of this year, they have assisted in sending over 1 billion phishing messages, targeting more than 75,000 institutions across over 150 countries, generating tens of millions of dollars in revenue for the operators.Microsoft has disabled over 20,000 accounts associated with YAM Store and continues to block more than 100,000 counterfeit and fraudulent domains. According to Microsoft's investigation, these services accept payments in USDT (Tron network) and ETH, and Cloudflare stated that buyers can also use USDC for payments. Blockchain analytics company TRM Labs assisted investigators in locating and freezing related assets, but the amount frozen has not been disclosed.

Slow Mist stated that a fraudulent "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to carry out attacks. The phishing page is highly realistic, including a fake "Genuine check" page, device selection interface, and "Update Now" button. Slow Mist reminds users not to update Ledger devices through website links and not to enter recovery phrases anywhere.

According to PeckShieldAlert monitoring, the phishing attacker who stole $2 million worth of DAI from an address of Bofur Capital has exchanged the stolen funds for 825.5 ETH.

Hardware wallet manufacturer COLDCARD stated that its official X account had previously posted a fake security announcement, directing users to a phishing website disguised as a wallet migration guide. The post has been deleted, but no corresponding login, session, or access records have been found.COLDCARD indicated that its credentials and offline two-factor authentication remain secure, leading to suspicions that the attacker may have gained X platform-level or administrative access, and has requested an urgent investigation by the X security team. The company also mentioned unverified reports of X administrator accounts being sold on the dark web, but no connection to this incident has been found.

The Chief Information Security Officer of Slow Fog, 23pds, tweeted that public WiFi itself does not steal coins. The losses are caused by phishing pages opened by fake WiFi and the actions of users themselves signing transactions or importing private keys. What websites are accessed and what operations are performed after connecting are the core factors that determine whether asset losses occur.Previously, X user Xiaoyu_184CM tweeted that after connecting to free WiFi at Singapore Airport, a wallet that had not been used for a month had 3.7 BNB transferred away. Binance founder CZ responded that he has always advised against connecting to public WiFi, but merely connecting to WiFi does not lead to wallet theft, and asked if there were any other operations in between. Crypto KOL AB KuaiDong speculated that someone might have specifically set up free WiFi or modified the router, and Xiaoyu indicated that he felt this was likely the case.