Email scams surprise crypto investors, steal millions

[ad_1]

A recent wave of email scams have surprised crypto investors and steal millions of dollars in cryptocurrency.

On Friday morning, it emerged that one of these email scams was behind the theft of around $ 60 million worth of ETH from a dog-themed crypto project during its token sale.

One of the people behind the project shared a screenshot of an email she received with an attachment. The email appeared to be from a prominent crypto investor, but it was not their real email address. It contained a PDF file presented as an investment case, which could contain malware. This malware may have managed to gain access to crypto wallets controlling funds before sending them to another address.

Since then, the project says it has contacted Chainalysis to monitor the movement of the apparently stolen funds and let professional security researchers view the PDF.

This project was not the only target, however.

Venture capital firms County Capital and Sneaky Ventures both shared tweets showing they also received the same phishing email. The one sent to County Capital was also sent to venture capital firm Sino Global Capital, according to additional screenshots.

Inspired by a previous phishing attack

The individuals behind the attack posted a message on the Ethereum blockchain, stating that they were inspired by a similar phishing attack.

This is the attack on the mgnr trading company that occurred earlier this month. In this attack, an email was sent giving the impression that a venture capitalist had shared a Google Docs file with them.

“The intrusion was probably used to implant a keylogger and steal credentials from a password manager where we (foolishly) shared a [private key] as a temporary hot wallet between a few team members, ”the company said. Mgnr added that they were aware of two other crypto firms receiving similar phishing emails with documents claiming to be from the same VC firm.

A pseudonymous crypto investor by the name of mewn – who is part of the eGirl Capital investment group – pointed out that these attacks target specific crypto individuals with specialized knowledge of crypto news.

“It’s like a big red alert to me for everyone in space to be very careful,” they tweeted.

The individuals behind today’s hack said in a blockchain post that they were not the same who had phished mgnr. But they added that they were inspired by it.

How does this type of attack work?

In order to understand how such a phishing attack works and how successful it is, The Block spoke with Oren Falkowitz, founder of Area 1 Security and former NSA analyst.

Falkowitz explained that, generally, these emails would be made to give the impression that they came from a prominent person or company, to make them more credible. In the cases mentioned above, the emails appeared to come from notable crypto investors.

On how they caused the damage, Falkowitz said the links in the emails might not be what they appear to be. Although the document may appear to be a PDF file – having “.PDF” at the end of the filename – it can actually be a very different type of file. It could be an executable file that contains a series of instructions for the computer to perform a task. This is similar to downloading and installing software.

Once installed, it can be a piece of code that takes instructions from another computer, such as downloading other malware. Through this, the code could gain access to a keylogger or other services that could observe activity on the computer.

Once the attacker is able to gain this kind of access, it becomes much easier for them to intercept any kind of private blockchain data in order to gain access to the victim’s cryptocurrency holdings.

For more landmark stories like this be sure to follow The Block on Twitter.

© 2021 The Block Crypto, Inc. All rights reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial or other advice.

[ad_2]