Utoday: Crypto Services Targeted by Massive Phishing Scam Here's How It Happened

Ethereum's (ETH) explorer Etherscan, crypto analytics service CoinGecko, portfolio management app DexTools and other Web3 infrastructure services are attacked

Contents

• No free "Apes" in crypto
• Was the attack mitigated?

Crypto scammers attacked Web3 infrastructure platforms through an unusual design. By compromising a single advertising instrument, attackers managed to steal tokens from thousands of wallets.

No free "Apes" in crypto

Today, on May 14, 2022, dozens of cryptocurrency websites, including major Ethereum explorer Etherscan, QuickSwap DeFi, CoinGecko analytics dashboard, DexTool hub and so on, faced a massive phishing attack.

While visiting the websites, users were asked to authorize a transaction through their noncustodial wallets. The scammers offered to take part in a fake NFT giveaway.

The scammers' domain impersonated Bored Apes Yacht Club (BAYC), the most expensive non-fungible token collection. Right now, the BAYC floor price inches closer to $200,000, but the scammers offered the "apes" for free.

Crypto enthusiasts revealed that the attack was carried out via Coinzilla, a popular crypto-centric advertising network. As such, the users of modern adblock services were the only safe ones.

Was the attack mitigated?

At the same time, the signature itself was not malicious; victims were asked to sign another transaction required to transfer Ethereum (ETH), Binance Coins (BNB), Crypto.com Coins (CRO) or Fantom (FTM).

As per the official statement by the Coinzilla team, the attack was mitigated in less than one hour after it was revealed by DeFi enthusiasts:

A single campaign containing a piece of malicious code has managed to pass our automated security checks. It ran for less than an hour before our team stopped it and locked the account.

As such, all crypto users are now safe; the malicious intereference has been successfuly mitigated.

The exact amount of funds stolen is yet to be evaluated.