Phishing attacks have long plagued the internet, and with the advent of Web3, these attacks have found new and sophisticated avenues to exploit.
Web3, the next generation of the internet that uses blockchain technology, promises decentralization, enhanced security and greater user control.
However, these very features have also made it a lucrative target for cybercriminals. This article goes into the nature of phishing attacks in Web3, some popular cases of phishing and strategies for prevention and mitigation.
Phishing in Web3 often involves deceitful tactics to trick users into revealing private keys, seed phrases or other sensitive information. Unlike traditional phishing attacks that rely on fake emails or websites, Web3 phishing exploits smart contracts, decentralized applications, and blockchain transactions.
As user activity increases, the risks associated with on-chain interactions become more exposed. Phishers employ a variety of methods such as creating counterfeit wallet websites, stealing social media accounts, creating malicious browser extensions, sending phishing emails and messages and publishing fake applications to lure users into disclosing sensitive information, leading to asset losses. Phishing activities exhibit characteristics of diversity, complexity and stealthiness.
Before we proceed further here’s my first article on some popular web3 scams: https://medium.com/@Dreyville_Crypt/popular-defi-scams-and-hacks-86385513d9bc
Phishing attacks in Web3 have led to significant financial losses, eroding trust in decentralized ecosystems. According to a report by CipherTrace, over $1.9 billion was lost to phishing and other types of fraud in the cryptocurrency space in 2021 alone. These attacks not only affect individual users but also harm the reputation of legitimate projects and platforms.
Below are some popular cases of phishing in web3:
Uniswap Phishing Attack (2021): In July 2021, hackers sent phishing emails to Uniswap users, directing them to a fake website where they were asked to enter their private keys. The attackers stole approximately $8 million worth of assets from users.
OpenSea Phishing Scam (2022): In early 2022, a phishing attack targeted OpenSea users by tricking them into signing a malicious contract. The attack led to the theft of NFTs worth over $1.7 million.
Polygon Network Attack (2021): In October 2021, a phishing scam on the Polygon network resulted in the loss of approximately $500,000. Users were directed to a fraudulent website that mimicked the Polygon Bridge, where they unknowingly approved malicious transactions.
Popular Project Twitter Replies: Phishers reply to tweets from popular project accounts using fake accounts that replicate logos, names, and verification marks to spread malicious links. A friend of mine fell victim to this type of phishing attack. He was trying to claim his etherfi airdrop and accidentally clicked on a phishing link below the actual tweet. This is why most projects close the comments on tweets regarding airdrop claims and similar events.
Stealing Official Twitter/Discord Accounts: Phishers steal/hack official accounts to post phishing links. High-profile incidents include the hacking of Vitalik Buterin’s Twitter account and the official Twitter account of TON project.
Google Search Ads: I myself have fallen victim to this. That's why I always advise, as a crypto enthusiast, to never Google search a project's link. Instead, go to their official Twitter account to get the actual link. Phishers use Google Search Ads to publish malicious links. Users may perceive these links as official due to their placement in search results, leading to phishing websites.
Fake Apps: Phishers create fake apps that resemble legitimate ones. For example, downloading a fake wallet app can lead to private key leaks and asset losses. Modified Telegram installation packages have also been used to alter on-chain addresses. A Brainbox member once fell for this by downloading a fake Uniswap extension while trying to complete a Layer3 task, not knowing that Uniswap doesn’t have a wallet extension.
Project Interaction or Qualification Verification: Phishers disguise malicious websites as project interaction or qualification verification pages, asking users to input their mnemonic phrases or private keys.
Impersonating Project Customer Support or Administrators: Phishers impersonate customer support or administrators, providing fake links for users to input mnemonic phrases or private keys. Whenever you have an issue with a wallet and tweet about it, you'll often see 'project support' in your comments, telling you to DM them for help.
Malicious Smart Contracts: Scammers deploy smart contracts with hidden functions that can drain a user's wallet once they interact with it. This is one of the many reasons why I always tell people to read wallet outputs carefully before approving a transaction.
Social Engineering: Attackers use social media platforms and forums to pose as support staff or influential figures in the crypto space, persuading users to share sensitive information. This is quite common. For example, you might receive DMs from projects claiming to be looking for workers, but before they employ you, they ask you to download a 'game' to test. Another common scenario occurs in NFT group chats, where you'll get a DM from someone interested in your particular type of NFT. They might say they don't want you to list it on a marketplace to avoid taxes and will send you a link. That link is almost certainly a phishing link.
Fake Airdrops and Giveaways: Scammers often impersonate legitimate projects and announce fake airdrops or giveaways, luring users to submit their private keys or connect their wallets to malicious dApps. This type of phishing scam can be avoided by not being greedy; after all, why are you trying to reap where you didn't sow?
Education and Awareness: Users should be educated about the common tactics used in phishing attacks and how to identify them. Awareness campaigns and community alerts can help users stay vigilant.
Secure Wallet Practices: Users should never share their private keys or seed phrases. It’s crucial to use hardware wallets and enable multi-factor authentication for added security.
Verify URLs and dApps: Always verify the URL of a website or dApp before entering sensitive information. Bookmarking official websites and avoiding clicking on links from unsolicited messages can reduce the risk.
Use Reputable Platforms: Interact with well-known and audited platforms. Reputable projects often undergo security audits and have mechanisms in place to detect and mitigate phishing attempts.
Smart Contract Audits: Before interacting with a new smart contract, users should check if it has been audited by a reputable security firm. This can help identify hidden vulnerabilities or malicious code.
Community Support and Reporting: Encourage a culture of reporting suspicious activities within the community. Platforms should have robust support channels to address phishing concerns and provide guidance.
Always Use Safety Wallet Extensions: I can’t count how many times I’ve been saved by my safety wallet extensions. I advocate for using these extensions so much that I wrote a standalone article on it, which you can find here: (https://medium.com/@Dreyville_Crypt/must-have-safety-wallet-extension-75bfa7a84b52).
Lastly, Do Not Be Greedy: A significant percentage of phishing scams often originate from greed — attempting to profit where one has not invested, or trying to outsmart scammers without realizing being outsmarted oneself
Phishing attacks in Web3 pose a significant threat to the security and trust of decentralized ecosystems. By understanding the nature of these attacks and implementing robust prevention and mitigation strategies, users and platforms can protect themselves from falling victim to such scams. As the Web3 space continues to evolve, ongoing education and vigilance are paramount to safeguarding assets and maintaining the integrity of blockchain networks.
We’ve reached the end of this session, if you found this helpful, please like and share for more visibility.