Three Arrows Capital Founders Served Subpoenas via Twitter in Bankruptcy Process

January 5, 2023 Bitcoin.com

Crypto Firm Wyre Reportedly Shuts Down After Canceled Bolt Acquisition, CEO Claims Firm Is Just ‘Scaling Back’ Operations

January 5, 2023 Bitcoin.com

Crypto users claim Gemini email leak occurred much earlier than first reported

December 14, 2022 Coin Telegraph

Coin Telegraph

Alleged reports of compromised emails began appearing as early as October.

"Not handled well." This was how one user described the revelations brought forth by Cointelegraph on Dec. 14 regarding the leak of 5.7 million Gemini customers’ email addresses and partial phone numbers. Shortly after publication, multiple users reached out to Cointelegraph alleging that the leak, which Gemini attributes to a “third-party incident,” happened much earlier than initially understoo.

Mysterious reports of users receiving targeted phishing emails began surfacing on the official r/Gemini subreddit in the weeks prior. In one thread dating back to November, Redditor u/DaveJonesBones claimed that the received a targeted phishing email from an address that was only registered on Gemini:

“It promoted a Cyberbroker NFT drop using Opensea branding. I think I also received one last month, but I deleted it without reading it. Today, I got the hump because I’d specifically opted-out to all marketing emails from Gemini.”

To which a Gemini representative responded:

“Reporting this to our security team. Thank you for letting us know.”

In another thread titled “Gemini is compromised. Gemini user data is being used for complex phishing attempts” from two weeks prior, u/Exit_127 claimed they received a phishing email from a MetaMask imposter regarding the need to “sync my wallet due to the merge.” The user also claimed that “I use email aliases so each online account has a specific email linked to it. This phishing attempt went to the email used by and only by my Gemini account.”

I just experienced a very sophisticated crypto phishing attempt from a @Gemini customer information hack/leak.

1) I first received this text message: pic.twitter.com/0UVfHa9q7B
— cfo.btc (@btc_cfo) November 29, 2022

A similar thread by u/Opfu the prior week claimed that Gemini was already aware of the breach. As told by u/Opfu:

“I just got an email claiming that my Exodus wallet was linked to the Binance exchange from Bermuda (phishing of course). I ONLY use that particular email address at Gemini. When I asked Gemini, they confirmed a breach at a third-party vendor. Customer emails and partial phone numbers. When I asked if they were planning on informing users, they said thanks for the feedback.”

Another user responded:

“The same thing happened to me as well. The email was definitely a phishing attempt. I was so confused how Exodus got my Gemini email address as well, so knew there must have been some compromised at some point…”

In an official statement, Gemini wrote that “no Gemini account information or systems were impacted as a result of this third-party incident, and all funds and customer accounts remain secure.” It also warned of “increased phishing campaigns” as a result of the third-party breach. The blog post did not mention the date of the security incident. Prior to publication, Cointelegraph reached out to a Gemini spokesperson, who declined to comment on the matter.

*An alleged targeted phishing attempt sent to a Gemini email address dated Oct. 3, 2022.* *Source: Anonymous user*

This is what your email could look like in Web3

October 13, 2022 Coin Telegraph

Coin Telegraph

The first generation of blockchain-based messaging platforms are attempting to address the missing pieces of Web3 adoption.

Forget about tracking DAO votes, DeFi transactions or data breaches across many channels and platforms. Your Web3 mailbox will handle it for you without requiring your phone number or legacy email address. Instead, your wallet address will receive and organize all this information.

At least, these are some of the promises made by Web3 communications companies attempting to build the first generation of blockchain-based messaging platforms: theWeb2 experience with Web3 privacy and security, and, most importantly, focusing on Web3 problems.

Wallet's monthly statements, transaction notifications and hack updates, for example, are some of the contents users could receive in their inbox, explained Swapnika Nag, co-founder of Hashmail — an India-based startup that launched in beta on Oct. 1.

The startup is now offering users the possibility to exchange email through their existing wallet addresses. "That's essentially an inbox which feels very much like email, but on the backend, you just connect with your wallet address and your messages," noted Nag.

For native Web3 companies, the technology means an alternative to Telegram and Discord communication channels by providing a direct line with users, and also a potentially valuable marketing tool. For users, it adds an extra layer of protection against phishing attacks, and potentially offers token rewards via paid advertising and subscriptions received.

"In Web3, your point of access is your wallet, and that is what you log in with. Essentially, that is what most applications know about you," said Nag.

Another company attempting to address the communication friction in the industry is Ethermail; a platform offering encrypted wallet-to-wallet communication. In August, Ethermail disclosed a $3 million seed funding led by Fabric Ventures and Greenfield One.

"Today, most users buy a token and speculate on its price without tapping into the community," said an EtherMail representative to Cointelegraph, stating that straightforward communication may catalyze broader adoption by helping users to understand and engage with their chosen communities.

Similar to HashMail, EtherMail seeks to offer a paywall to filter spam and incentivize readers to profit from any advertising received, along with subscriptions and other resources for companies.

Despite its potential, Web3 emails don't seem to be a threat to Web2 message providers in the short term, said Nag. But in the long run, we could see an increase in the adoption of Web3 native emails as users seek fundamental advantages, such as decentralized storage and privacy.

Web3 is a possible future version of the internet based on public blockchains, a record-keeping system best known for facilitating cryptocurrency transactions. The industry is expected to reach $81.5 billion in 2030, according to Emergen Research, but it still faces challenges, including security and interoperability.

Blockchain security firm warns of new MetaMask phishing campaign

August 1, 2022 Coin Telegraph

Coin Telegraph

Blockchain security firm Halborn has warned users of the latest phishing emails doing the rounds.

A cybersecurity firm has issued warnings over a new phishing campaign targeting users of the popular crypto wallet MetaMask.

In a July 28 post written by Halborn's technical education specialist Luis Lubeck, the active phishing campaign used emails to target MetaMask users and trick them into giving out their passphrase.

The firm analyzed scam emails it received in late July to warn users of the new scam. Halborn noted that at initial glance, the email looks authentic with a MetaMask header and logo, and with messages that tell users to comply with KYC regulations and how to verify their wallets.

However, Halborn also noted there are several red flags within the message. Spelling errors and a fake sender’s email address were two of the most obvious. Furthermore, a fake domain called metamaks.auction was used to send the phishing emails.

Phishing is a social engineering attack using targeted emails to lure victims into revealing more personal data or clicking links to malicious websites that attempt to steal crypto.

There was also no personalization in the message, the firm noted, which is another warning sign. Hovering over the call to action button reveals the malicious link to a fake website which prompts users to enter their seed phrases before redirecting to MetaMask to empty their crypto wallets.

Halborn, which raised $90 million in a Series A round in July, was founded in 2019 by ethical hackers offering blockchain and cyber security services.

In June, Halborn researchers discovered a case where a user’s private keys could be found unencrypted on a disk in a compromised computer. MetaMask patched its extension versions 10.11.3 and later following the discovery.

However, there was no mention of the new email phishi threat on MetaMask’s Twitter feed at the time of writing.

Last week, Celsius users were warned of a phishing threat following the leak of customer emails by a third-party vendor employee.

In late July, security researchers warned of a new malware strain called Luca Stealer appearing in the wild. The information stealer has been written in the Rust programming language and targets Web3 infrastructure such as crypto wallets. Similar Malware called Mars Stealer was discovered targeting MetaMask wallets in February.

Phishing risks escalate as Celsius confirms client emails leaked

July 29, 2022 Coin Telegraph

Celsius

It is not the first time Celsius' customer emails have been exploited and leaked online.

Celsius depositors should be on the lookout for phishing scams after the company revealed some of its customer data has been leaked in a third-party data breach.

On July 26, Celsius sent an email to its customers informing them that a list of their emails had been leaked by an employee of one of its business data management and messaging vendors.

According to Celsius, the breach came from an engineer at the Customer.io messaging platform who leaked the data to a third-party bad actor.

“We were recently informed by our vendor Customer.io that one of their employees accessed a list of Celsius client email addresses,” said Celsius in its email to customers. The data breach is part of the same incursion that leaked OpenSea customer email addresses in June.

Announcement from Celsius: “We are writing to let you know that we
were recently informed by our vendorhttps://t.co/452EROQtbc that one of their employees
accessed a list of Celsius client email
addresses held on their platform and
transferred those to a third-party.”
— Celsians (@CelsiansNetwork) July 28, 2022

Celsius has however played down the incident stating that it did not “present any high risks to our clients,” adding that they just wanted users to “be aware.”

On July 7, Customer.io wrote in a blog post that “We know this was a result of the deliberate actions of a senior engineer who had an appropriate level of access to perform their duties and provided these email addresses to the bad actor.” The employee has since been terminated.

The number of emails leaked was not disclosed, nor was the platform to which they were leaked.

However, the crypto community has started to warn Celsius users of phishing attacks which usually follow an email data breach.

Phishing is a form of social engineering in which targeted emails are sent to lure victims into revealing more personal data or clicking links to malicious websites that installs malware to steal or mine crypto.

⚠️ Celsius users should expect phishing emails along the lines of "Verify your wallet to withdraw your funds" that will phish for your SRP/PKey due to this

Remember, your SRP should only be known to you and you only https://t.co/QYuDhEE7aL
— harry.eth (whg.eth) (@sniko_) July 28, 2022

A similar data breach in April 2021, saw Celsius customers reportedly targeted by a fraudulent website claiming to be the official Celsius platform. Some received SMS and emails prompting them to reveal personal information and seed phrases.

At the time, the company reported that hackers had gained access to a third-party email distribution system it uses.

Perhaps the most famous crypto data breach was from hardware wallet provider Ledger, which had its servers hacked in 2020. The spewing of thousands of customers’ personal details on the internet resulted in untold losses and even physical threats for many victims, yet the company has refused to compensate them.

Anonymous Has Released Over 2 Million Russian Emails in Cyberwar With Russia

April 12, 2022 Bitcoin.com

BlockFi confirms unauthorized access to client data hosted on Hubspot

March 19, 2022 Coin Telegraph

Coin Telegraph

As a third-party vendor for BlockFi, Hubspot stored user data such as names, email addresses and phone numbers, which has been historically used for conducting phishing attacks.

New Jersey-based crypto financial institution BlockFi confirmed a data breach incident via one of its third-party vendors, Hubspot. BlockFi’s proactive warning about the breach aims to deter the intentions of bad actors in repurposing the user data for fraudulent activities.

According to the announcement, the hackers gained access to BlockFi’s client data on Friday, Mar. 18, that were stored on Hubspot, a client relationship management platform:

“Hubspot has confirmed that an unauthorized third-party gained access to certain BlockFi client data housed on their platform.”

As a third-party vendor for BlockFi, Hubspot stored user data such as names, email addresses and phone numbers. Historically, bad actors have used such information for conducting phishing attacks and gaining access to accounts through user-provided passwords.

Regarding recent third-party data incident: pic.twitter.com/50z7IrQ1za
— BlockFi (@BlockFi) March 19, 2022

At the time of writing, BlockFi is supporting Hubspot’s investigation to gain clarity on the overall impact of the data breach. While the exact details of the breached data are yet to be identified and revealed, BlockFi reassured users by highlighting that personal data — including passwords, government-issued IDs and social security numbers — “were never stored on Hubspot.”

In addition, BlockFi has also confirmed that its internal system and client funds were not accessed and that the breach remains limited to the third-party vendor, Hubspot.

The company further recommended four methods to help users protect their online presence from bad actors — good password hygiene, two-factor authentication (2FA), allowlisting trusted applications and vigilance against scammers.

On an end note, BlockFi acknowledged that time is of the essence and are expediting their investigations to identify the extent of the breach:

“Additional information will be emailed to all impacted clients in the coming days.”

Investors are advised to be wary of all company communication, especially that demand urgency in requesting/changing personal details including passwords and wallet addresses.

On Friday, Mar. 18, the recently launched nonfungible token (NFT) project Rare Bears was attacked, resulting in a theft of nearly $800,000 in NFTs.

Warning @BearsRare
Discord has unfortunately been compromised. Please DO NOT click any links, connect your wallet and block all incoming DMs in our discord. Our team are working on the situation as we speak
— Rare Bears (@BearsRare) March 17, 2022

As Cointelegraph reported, the attacked was conducted by a hacker who posted a phishing link in the project‘s Discord channel, and eventually stole 179 NFTs.

OpenSea planned upgrade stalls as phishing attack targets NFT migration

February 20, 2022 Coin Telegraph

Coin Telegraph

OpenSea announced a new smart contract upgrade with a one-week deadline yesterday. However, the urgency and short deadline opened up a small window of opportunity for hackers.

Just yesterday, OpenSea announced a smart contract upgrade, which requires users to migrate their listed NFTs from Ethereum (ETH) blockchain to a new smart contract. As a direct result of the upgrade, users that don't migrate over from Ethereum risk losing their old, inactive listings — which currently require no gas fees for migration.

Major nonfungible token (NFT) marketplace OpenSea has reportedly fallen victim to an ongoing phishing attack within hours after announcing a week-long planned upgrade to delist inactive NFTs on the platform.

However, the urgency and short deadline opened up a small window of opportunity for hackers. Within hours after OpenSea’s upgrade announcement, reports across multiple sources emerged about an ongoing attack that targets the soon-to-be-delisted NFTs.

OPENSEA EXPLOITED Everyone tag @opensea to get them to pause their new contract while everyone figures out whats going on with the exploit! #NFT #NFTs #NFTTheft #NFTScam #NFTSecurity #NFTAlert
— gt_dog (@gt_dog84) February 20, 2022

Further investigations revealed that attackers used phishing emails to steal the NFTs before they get migrated over OpenSea’s new smart contract. Once a user authorizes the NFT migration from the fraudulent email, the attackers gain access to the NFTs.

Though unconfirmed, the @opensea hack is most likely phishing. Users authorize the "migration" as instructed in the phishing email and the authorization unfortunately allows the hacker to steal the valuable NFTs... pic.twitter.com/Fj5d9ImC2r
— PeckShield Inc. (@peckshield) February 20, 2022

Users are now advised to be wary of all communications from OpenSea in addition to revoking all permissions about the migration to the new smart contract.

We are actively investigating rumors of an exploit associated with OpenSea related smart contracts. This appears to be a phishing attack originating outside of OpenSea's website. Do not click links outside of https://t.co/3qvMZjxmDB.
— OpenSea (@opensea) February 20, 2022

OpenSea co-founder and CEO Devin Finzer acknowledged the phishing attack while confirming that 32 users have lost NFTs so far. While the NFT marketplace is yet to decipher the ongoing attack, blockchain investigator Peckshield suspects a possible leak of user information (including email ids) that fuels the ongoing phishing attack.

However, Finzer has asked affected users to reach out to the company as he concluded:

“If you are concerned and want to protect yourself, you can un-approve access to your NFT collection.”

Her Majesty’s Revenue and Customs (HMRC), the chief tax authority in the United Kingdom, seized three NFTs associated with a suspected tax evasion fraud.

As Cointelegraph reported, the suspects used fake identities and created 250 fake “shell” companies to evade 1.4 million British pounds (roughly $1.8 million) in value-added taxes.

OpenSea email over inactive NFT listings sparks Twitter debate

January 28, 2022 Coin Telegraph

Coin Telegraph

Some OpenSea users who heeded OpenSea’s call to call their inactive listings ended up losing their NFTs and their money.

Twitter users reacted negatively to an OpenSea email sent to users who still had inactive listings on their accounts. In the email, OpenSea explained that old NFTs listings are still fulfillable, and should be canceled by the user because OpenSea is unable to cancel them on their behalf. They claimed this would “prevent any of your items from being sold at the inactive listing price,” due to Ethereum’s (ETH) dropping price.

According to the NFT collector @dingalingts and other users, this warning had the opposite effect and canceling the listing ended up recreating the order. @Dingalingts tweeted a thread urging users to “FIRST transfer your NFT to a different address and cancel the listing/s on the original address BEFORE” canceling them.

1/ WARNING: DO NOT CANCEL YOUR OS LISTINGS AS STATED IN THE EMAIL THAT OPENSEA JUST SENT OUT

Please FIRST transfer your NFT to a different address and cancel the listing/s on the original address BEFORE sending it back

OS just put everyone at even more risk than before
— dingaling (@dingalingts) January 27, 2022

He cites another user @swolfchan.eth who claimed that he lost at least 15 ETH. After canceling a Mutant Ape Yacht Club listing, it was relisted for 6 ETH but someone waiting in the ETH mempool ended up selling the NFT in the same block by front-running the cancellation.

So i got two emails today from @opensea about listings, and lost 15 ETH+ from exactly what their trying to prevent...

I was told to please act urgently to cancel any inactive listings... cancelled a 15 ETH MAYC @BoredApeYC and it triggered a 6 ETH listing... and sold?? pic.twitter.com/1wt21mt9mz
— swolfchan.eth (@swolfchan) January 27, 2022

While some users like @roundcatcrypto commented to @swolfchan.eth “This one's on you man. Don't play with company because you were trying to save a couple bucks,” others rallied in support of him and @dingalingts.

Alex Attalah, co-founder of OpenSea, responded to @swolfchan.eth’s thread, tweeting that they “have a team working on it and putting up a countermeasure now.” @swolfchan.eth followed up and asked if he could expect a reimbursement, but received no response.

Email

Share this video