phishing

Binance Wallet announced the launch of real-time detection and risk interception features for high-risk signature scenarios to prevent phishing attacks that exploit the authorization mechanisms of DeFi projects.Binance stated that some attacks only require inducing users to complete offline signatures that do not require gas fees, which could lead to asset theft. In the future, it will continue to expand the scope of risk identification scenarios and security protection coverage.

According to the Brooklyn District Attorney's Office, 23-year-old Brooklyn man Ronald Spektor was sentenced to 4 to 12 years in prison for committing phishing and social engineering fraud. Over approximately one year, Spektor impersonated Coinbase customer service, luring about 100 American users to transfer cryptocurrency to wallets under his control, claiming "accounts were hacked and assets were at risk," stealing nearly 15.94 million dollars in total.Subsequently, he laundered the money through multiple exchanges, mixing services, and cryptocurrency gambling platforms. On September 2, he pleaded guilty to all 31 charges, including first-degree money laundering and first-degree grand larceny, and was ordered to forfeit cash, cryptocurrency, and personal property valued at over 500,000 dollars, while also needing to pay restitution of nearly 16 million dollars. Investigations revealed that he had publicly flaunted his criminal gains on platforms like Telegram.

According to official disclosures from Coinbase, it has collaborated with Microsoft and several institutions to combat the AI-driven cybercrime platform EvilTokens. This platform offers "phishing as a service" through Telegram bots, utilizing AI to analyze trust relationships and payment permissions in compromised email accounts, and bypassing multi-factor authentication through Microsoft's device code login process.The Coinbase global intelligence team tracked that between October 2025 and June 2026, EvilTokens generated approximately $1.1 million in revenue through four Tron addresses, involving over 1,000 deposits from more than 700 different addresses. The related evidence supported Microsoft's civil lawsuit, ultimately leading to the seizure of 50 websites and the deactivation of over 175 associated domain names. The Metropolitan Police Service of the United Kingdom arrested the relevant operators and seized digital devices on September 11. Coinbase stated that this incident did not result in the leakage of Coinbase accounts or credentials, but some customers were manipulated into transferring cryptocurrency to the scammers' addresses through phishing emails.

According to CriptoNoticias, the Spanish Civil Guard and National Police have respectively cracked down on two cryptocurrency-related criminal cases, capturing or identifying a total of 48 individuals involved.Among them, one Ponzi scheme resulted in losses of approximately 327,000 euros for 113 investors; another criminal network implemented fraud through phishing, fake rental advertisements, and other methods, converting illegal gains into cryptocurrency to evade tracking, causing losses exceeding 430,000 euros.

According to a report by the Korean Yonhap News Agency, the Busan Police Agency disclosed that someone illegally accessed the account of a text message sending agency used by the marketing department of a composite shopping center in the Sasang District of Busan, sending bulk scam messages to over 260,000 unspecified individuals, claiming "the cryptocurrency wallet has been updated" and inducing quick installation.Once users click on the attached link, they may encounter phishing attacks (Smishing) that could lead to the theft of virtual assets. The police have currently blocked access to the relevant accounts and are conducting a tracking investigation into the illegal intruder.

Recently, the meme coin market has been booming, and on-chain trading has become increasingly active. However, with the warming market, meme coin display pages have frequently shown highly disguised phishing links, and the "novel" attack methods have caused several seasoned traders to fall victim. Crypto KOLs @insidecalls and @cladzsol recently revealed that while scanning chains, they clicked on the meme coin homepage, which resulted in a "cloudfare verification" prompt. After completing the verification as instructed, the victim's on-chain funds were stolen. Among them, @cladzsol lost approximately $600,000 in assets.According to market news, on several recently popular meme coin display pages, the homepage redirects to a "cloudfare verification" page, which is actually a phishing link. If users follow the prompts, their computer systems will download and execute malicious scripts, leading to asset loss. This phenomenon is so rampant that it may be related to the delayed review processes of mainstream trading aggregation platforms like DexScreener. Currently, the display logic of relevant platforms is to directly reference the "official website" or social media links filled in the token metadata. These fields can be updated by token creators or those who later claim "community takeover." Hackers are exploiting this review loophole to transform meme coin display pages into new "fishing grounds" for phishing attacks. Users may inevitably click on unfamiliar links during the chain scanning process; if a "cloudfare verification" or other highly suspicious page appears, they should close it immediately to avoid interaction and protect their asset security.

Bitcoin hardware wallet manufacturer Trezor has warned that its third-party marketing platform Brevo, used for sending newsletters, experienced a data breach, with attackers using the platform to send phishing emails to 347,000 Trezor customers. The attackers sent emails using Trezor's domain, making the phishing attempt more deceptive, with malicious links encouraging users to download applications and enter wallet backups.Trezor stated that it shut down the domain at the DNS level within 20 minutes to prevent the links from remaining active, but approximately 2,500 people had already clicked on them. Trezor has suspended its Brevo account to stop further emails from being sent and emphasized that other Trezor systems were not affected aside from the marketing platform, while reminding users that Trezor never asks customers for wallet backups.Prior to this incident, Trezor disclosed last month that its third-party fulfillment partner ShipMonk was attacked, resulting in the data breach of 11,742 customers; last week it also reported that the names, emails, phone numbers, shipping addresses, and order numbers of another 67,000 U.S. customers were exposed in the breach. This year, cryptocurrency wallet Ledger's payment processor Global-e and wallet provider SafePal have also experienced data breaches, with approximately 39,800 customers' order information at SafePal being accessed without authorization.

According to GoPlus alerts, the meme coin LAPTOP issued by Hunter Biden, son of Biden, is about to launch an airdrop. A large number of phishing websites for fake LAPTOP airdrop whitelists, eligibility checks, and claims have appeared on Twitter, and there are also lookalike versions on multiple chains, with risks such as unverified contracts, high taxes, and trading suspensions.GoPlus reminds users to refer to the official website and Twitter for accurate information, to be cautious when participating in lookalike trading, and to use Token security checks to confirm contract safety. Remember the four principles: do not click, do not install, do not sign, do not transfer.

According to GoPlus monitoring, a user lost 97,000 USD worth of SYN tokens to a phishing attack after signing a malicious Permit transaction 922 days ago. The user did not revoke the related authorization, which subsequently led to another theft of 122,000 USD worth of SYN.

The cryptocurrency wallet project SafePal has released updates on the security incident, stating that it is continuously tracking phishing websites and impersonation accounts, and plans to introduce a professional anti-phishing security company to expedite the removal of malicious information to protect user asset security. SafePal mentioned that it is currently in the final selection process among four professional anti-phishing security companies, and once a partner is selected, it will further enhance the efficiency of handling threats such as counterfeit websites and scam accounts.The team is also continuously monitoring whether the affected data has been sold or made public, including channels such as dark web forums and trading markets. Once signs of data leakage are detected, affected users will receive risk alerts immediately. Regarding security audits, SafePal stated that it is in the final selection among three mature independent security institutions, which will conduct a comprehensive security review of the order system. Meanwhile, the team is reassessing the order and logistics processes to reduce the amount of data that needs to be stored in the initial phase of the system, thereby reducing potential risks from the source.For affected users, SafePal stated that it will continue to provide one-on-one assistance through official support channels and will keep updating the fraud protection page, providing updates on the incident, FAQs, and analysis of fraud cases. SafePal once again reminds users: the official will never ask users to provide their seed phrase. Users should not disclose their seed phrase to anyone, should not scan unknown QR codes or click on suspicious links, and should verify the source of information through official channels.

According to CoinDesk, the Internal Revenue Service (IRS) has issued a warning that a sophisticated email phishing campaign targeting U.S. cryptocurrency holders is spreading. Attackers are impersonating official tax letters to lure users into scanning malicious QR codes to steal cryptocurrency wallet credentials and private keys.It is reported that attackers are sending paper letters impersonating the IRS, creating a sense of urgency under the guise of "tax compliance" and "account verification," and including QR codes in the letters. Once users scan the code, they may be directed to a counterfeit website, leading to the leakage of wallet login information, recovery phrases, or private keys, resulting in the theft of digital assets.The IRS reminds taxpayers that official agencies will not request users to provide cryptocurrency wallet private keys, recovery phrases, or perform similar "wallet verification" operations through unofficial channels. Cryptocurrency holders should be vigilant against any suspicious emails and letters that request scanning QR codes, connecting wallets, or submitting sensitive information.As the number of cryptocurrency asset holders grows, social engineering attacks targeting digital wallets continue to increase, and regulatory and security agencies are strengthening warnings against related fraudulent activities.

According to on-chain detective Specter, the victim claims to have transferred funds from Bitcoin to Ethereum due to a hack on Coldcard. However, on-chain data shows that 73 BTC (worth $4.6 million) originally came from the Whirlpool mixer two weeks ago, with some of it crossing over to Ethereum and subsequently deposited through a phishing Tornado Cash interface.Two mixers were used during the related fund transfer process. The individual was also found to be present in Telegram groups related to private key searches and brute force cracking. On-chain detective Specter indicates that the victim may be a threat actor, and their funds may have also been stolen by another threat actor.

According to Cointelegraph, cybersecurity company Rapid7 has disclosed a phishing operation named Operation Asterix, targeting approximately 885,000 phone numbers across multiple countries and directing victims to fake wallet service websites. A total of 5,576 phone numbers have been matched with Binance user accounts and are included in the attack queue.The attackers steal mnemonic phrases by impersonating fake applications of Ledger, Trezor, and Exodus, while also using forged customer service emails and phone calls to contact victims. Rapid7 also found that out of over 316,000 phone numbers in Germany, 43,066 matched with cryptocurrency trading accounts, resulting in a hit rate of approximately 13.6%. Related attacks also include a bulk phone number verification tool targeting Kraken accounts, with investigations revealing that AI tools have been heavily used in the phishing operations.Data from blockchain security company Hacken shows that phishing attacks and social engineering scams caused losses of $306 million in the first quarter of this year, accounting for the majority of the total losses of $482 million in the cryptocurrency industry.

On-chain detective Specter posted on the X platform, stating that considering the time period covered by the stolen data, this could mean that the data breach occurred as early as April, and no later than early May. However, the parties involved chose to remain silent until recently, roughly at the same time Trezor announced its own data breach.Some users had already received phishing attacks and suffered asset losses at that time, but the parties involved did not maintain transparency, warn users, or provide risk alerts, instead denying the data breach.

According to Cointelegraph, DeFiLlama founder 0xngmi stated that the team had delayed the release of the official mobile application due to the long-standing presence of phishing apps impersonating DeFiLlama on the Apple App Store. The team will only release the official mobile application after all counterfeit apps have been removed to reduce the risk of users falling victim to scams.Yesterday, DeFiLlama founder 0xngmi stated, "We have been trying for months to get a fake app impersonating DeFiLlama removed from the Apple App Store and have continuously reported trademark infringement and impersonation of the official app to Apple.Subsequently, we funded a small wallet, downloaded the app, and as expected, all the funds in the wallet were stolen, so we reported this situation to Apple. As a result, the app was removed by Apple within a few days. We hope to inform other cryptocurrency companies about this so they won't waste time like we did."

FlashRescue co-founder @DarcyAri posted on the X platform that the Hyperliquid-related Google paid advertising phishing incident has resulted in approximately $550,000 in financial losses.The addresses related to the attackers have been disclosed, and users need to be vigilant about the phishing risks associated with Google paid advertisements and pay attention to protecting their asset security.

According to SBS, the Financial Supervisory Service (FSS) of South Korea has begun a comprehensive reform of its system to address compensation issues related to financial fraud, including voice phishing involving virtual assets. The FSS launched the "Financial Fraud Loss Compensation System Improvement Project" on August 6. This project aims to reform the existing compensation calculation system centered on the Korean won, in preparation for including virtual asset losses in the compensation scope starting in October this year.The current system primarily calculates compensation amounts based on losses valued in Korean won, but after the reform, a compensation ratio will be adopted, taking into account the type and quantity of virtual assets involved. Additionally, during payment suspensions, the Korean won exchange value of virtual assets will also be included in the calculations.

According to on-chain detective Specter, the same attacker is running similar phishing activities targeting Ledger. The relevant screenshots were taken two days ago, and the sponsored advertisement has now been removed.As of now, these activities have stolen over 3 million dollars.

Bitcoin News posted on the X platform that a Trezor user claimed their life savings were stolen after clicking on a Google sponsored search result impersonating Trezor. The phishing page was hosted on Google Sites and allegedly tricked victims into entering their wallet recovery seed.Trezor stated that it is upgrading its response to the report, working to remove the website, and reminding users to never enter their wallet backups or recovery phrases on any website or online form. Google sponsored phishing ads remain a persistent attack vector faced by cryptocurrency users.

According to GoPlus monitoring, a user on the Base chain lost 500,000 USDC due to a phishing attack. When the attacker exchanged the stolen funds for WETH, the script did not set slippage protection, routing to a Uniswap V4 WETH/USDC pool with almost no liquidity, resulting in only 67.9 ETH (worth $129,000) being exchanged for 500,000 USDC, of which $370,000 was earned by an MEV bot.The MEV bot only paid 0.03 USDC to front-run the transaction but incurred 3.5 ETH in gas fees for this. Subsequently, the victim sent an on-chain message to the attacker and the MEV address, stating that they had identified the attacker and were willing to pay a 10% bounty for a refund.