Phishing and Old Vulnerabilities in Crypto: $470K Stolen

In the space of a few days, hackers have made off with more than $470,000 from crypto users, taking advantage of phishing and long-standing vulnerabilities. To avoid such losses, security experts are calling for a greater degree of caution in dealings with smart contracts and addresses.

Sophisticated Phishing Attacks and Address Poisoning

Address poisoning is a notable attack vector, as Incrypted has pointed out. It is a form of subtle phishing aimed at the user’s wallet: a scammer will send a tiny transaction from a wallet that has the same first and last characters as the victim’s real address. The idea behind it, according to the most recent report from Incrypted, is to capitalize on the habit of copying an address from one’s transaction history and thus trick the user into sending funds to the attacker. Given the prevalence of these old vulnerabilities and phishing schemes, experts advise that every character of a wallet address be checked before making a transfer.

Exploiting Legacy Permissions and Forgotten Contracts

Then there is the case of a user who lost $167,000 in August 2023 by signing a malicious Permit-2 approval without realizing it. Outdated permissions can be left open to exploitation months later if one is not careful to revoke them, as the Incrypted channel has described. An unknown hacker did just that with a MakerDAO smart contract from 2020, a remnant of the market crash that year, and in the process pocketed over half a million dollars. Such incidents show how risks from phishing and old vulnerabilities can be compounded and persist well after the fact.

Security Best Practices and Community Guidance

Well-regarded blockchain sleuths including ZAGS XBT are among the security professionals now advocating for stronger self-custody measures. Their suggestion is to keep a smartphone on hand as a cold wallet for storing cryptocurrency. For those wishing to turn an old phone into a secure wallet with AirGap technology, Incrypted has put out a guide that is free of charge; a video covering safe storage of crypto is also in the works for their YouTube channel. All this is to give users some means of protecting their assets.

The current spate of attacks is testament to why up-to-date security habits and vigilance are essential. The team at Incrypted advises not to copy from your transaction history and to review any smart contract permissions before granting access. Following their lead will go a long way in insulating users from whatever new threats the crypto world may present.