Token

ZachXBT

Arkham

Crypto data and news providers Cointelegraph, WalletConnect, Token Terminal, and De.Fi email addresses are sending phishing emails. 
In a Jan. 23 Telegram <a href="https://t.me/investigations/89" target="_blank">post</a>, pseudonymous blockchain sleuth ZachXBT warned emails from domains under the legitimate domains of those companies. <a href="https://platform.arkhamintelligence.com/visualizer/entity/0xe7D13137923142A0424771E1778865b88752B3c7?flow=all&amp;positions=%7B%7D&amp;sortDir=desc&amp;sortKey=time&amp;usdGte=0.1" target="_blank" rel="noopener">Data</a> gathered from blockchain analytics service Arkham Intelligence shows that the address received hundreds of transactions, with nearly all activity starting on Jan. 23. Etherscan data shows 80 <a href="https://etherscan.io/address/0xe7D13137923142A0424771E1778865b88752B3c7" target="_blank" rel="noopener">transactions</a> just on Ethereum (<a href="https://crypto.news/price/ethereum/">ETH</a>). 
<blockquote class="wp-block-quote"> 
 $580,000 has been drained so far. <cite>ZachXBT | Investigations by ZachXBT Telegram channel</cite>
</blockquote> 
<figure class="wp-block-image size-full">
 <img loading="lazy" decoding="async" width="826" height="744" src="https://crypto.news/app/uploads/2024/01/image-67.png" alt="Cointelegraph, others sent phishing emails in presumed hack - 42" class="wp-image-14241501">
 <figcaption class="wp-element-caption">
 Visualization of the transactions that reached the phishing address since Jan. 23 | Source: Arkham Intelligence
 </figcaption>
</figure> 
 You might also like: <a href="https://crypto.news/trezor-investigates-phishing-attack-66-thousand-users/"> Trezor investigates phishing attack that left 66k users vulnerable </a> 
So far, it is unclear how the attacker could send messages that appear to come from the aforementioned organizations. Multiple hacking techniques may have been employed by the entity behind the phishing attack. 
One tactic is email spoofing, where attackers forge the email header to make the message seem like it’s from a legitimate source. In this scenario, the attacker could have altered the “from” field in the emails to mimic the legitimate domains of the cited companies. However, this approach is usually thwarted by modern email services unless the attacker compromises the DNS records. 
Another plausible method is the compromise of the companies’ email servers. Gaining access to these servers would enable the attackers to send emails that genuinely come from the companies’ addresses. Alternatively, the attackers might have accessed individual employee email accounts within these organizations. 
This can be done through phishing, malware, or using credentials from other data breaches. Having control over an employee’s email account allows the attacker to send emails that seem to come from that individual. 
Lastly, a breach in the security of third-party email service providers used by these companies could also explain the situation. In this case, the attackers would have targeted the service providers rather than the companies, enabling them to send emails from legitimate addresses. 
At this point, it is unknown what method the attacker employed if any of the ones listed were used. In the meantime, Cointelegraph issued a <a href="https://cointelegraph.com/news/coordinated-crypto-investor-phishing-campaign-email-alert" target="_blank" rel="noopener">warning</a> article to its readers, and the Etherscan <a href="https://etherscan.io/address/0xe7D13137923142A0424771E1778865b88752B3c7" target="_blank" rel="noopener">page</a> for the address also includes a phishing scam disclaimer. 
WalletConnect took to X to <a href="https://twitter.com/WalletConnect/status/1749734325287858597" target="_blank" rel="noopener">explain</a> that the company is aware of the phishing campaign promoting a fake airdrop. The company confirmed that its employees or affiliates did not send the email directly and is collaborating with crypto hack protection service Blockaid. 
<blockquote class="wp-block-quote"> 
 While we continue to better understand the situation further, we urge anyone who has received this email not to interact with it whatsoever.<a href="https://twitter.com/WalletConnect/status/1749734325287858597/photo/1" target="_blank" rel="noopener"></a> <cite>WalletConnect | X</cite>
</blockquote> 
Cointelegraph similarly announced in an X <a href="https://twitter.com/Cointelegraph/status/1749753189597938059" target="_blank" rel="noopener">post</a> that the company is “aware of scammers impersonating Cointelegraph.” The company reiterated that it does not issue airdrops. 
<blockquote class="wp-block-quote"> 
 Please don’t respond or click on any links sent in your DM/E-MAIL by anyone claiming to be part of the Cointelegraph team. <cite>Cointelegraph | X</cite>
</blockquote> 
<a href="https://twitter.com/tokenterminal/status/1749746211270128091" target="_blank" rel="noopener">Token Terminal</a> and De.Fi have issued similar warnings, with the latter <a href="https://twitter.com/DeFi/status/1749779351053152479" target="_blank" rel="noopener">attributing</a> the incident to MailerLite — the mail service provider used by the company. The firm explained that the other emails were likely sent the same way. 
<blockquote class="wp-block-quote"> 
 Unfortunately, it seems like MailerLite was also used by WalletConnect, Cointelegraph &amp; Token Terminal which have also become victims of this. <cite>De.Fi | X</cite>
</blockquote> 
 Read more: <a href="https://crypto.news/hackers-hijack-vechains-x-page/"> Hackers hijack VeChain’s X page </a>

Cointelegraph, others sent phishing emails in presumed hack

crypto.news

Other articles published on Jan 23, 2024

Ark Invest CEO Catherine Wood and 21Shares Co-Founder Discuss Partnership

Deciphering Bitcoin Option Data and Short-Term Panic Orders

Microsoft Copilot Pro Faces Initial Performance Issues

Shiba Inu Burn Rate Spikes 400% Amid 4 Tln SHIB Whale Activity

Bitstamp alerts Canadian users about Mt. Gox repayments

Dogecoin Founder Fires Back At Ripple CEO: “DOGE Is Essentially The Same Thing As BTC”

Join our free newsletter for daily crypto updates!