1-888-762-8736 (M-F 08:00 - 17:00 CST)
Untuk Rumah
Cybercrime & Digital Threats
Coincheck Suffers Biggest Hack in Cryptocurrency History; Experty Users Tricked into Buying False ICO
While cryptocurrency is gaining popularity as an investment vessel, recent reports of losses prove that Bitcoin, Ethereum, and its other equivalents are still volatile. Two recent incidents of cryptocurrency theft has affected the price of Bitcoin, resulting in losses for initial coin offering (ICO) investors.
First, Tokyo-based cryptocurrency exchange Coincheck suffered the biggest hack in the history of cryptocurrencies after the exchange lost $532 million in digital assets, or about $420 million in NEM tokens. The hack affected Bitcoin's value, resulting in a 5 percent drop on the morning of January 26.
Coincheck confirmed the incident in a blog post, but did not explain how the tokens were stolen. It abruptly froze most of its services, including deposits, withdrawals, and trade of almost all other cryptocurrencies except Bitcoin. The heist affected about 260,000 users, but Coincheck said that the affected users will be repaid in Japanese Yen through the Coincheck Wallet. As of this writing, Coincheck is working with Japan's Financial Services Agency to investigate the cause of the missing tokens.
On January 26 and 27, a hacker tricked Experty ICO (Initial Coin Offering) participants into sending Ethereum funds to the wrong wallet address. The hacker sent emails with a false pre-ICO sale announcement of Experty tokens to users who signed up for notifications. The actual Experty ICO is slated on January 31. The Ethereum wallet address that the perpetrator sent isn't associated with Experty, who previously announced that they would only handle sales of tokens through Bitcoin Suisse AG, a regulated crypto-financial broker based in Switzerland. An ICO is similar to an Initial Public Offering (IPO), but instead of stocks, the buyer receive tokens in an online platform.
The hacker made off with a presumed $150,000 or more from 71 transactions. Experty and Bitcoin Suisse have sent out warnings to users not to send money to the wallet address in the email sent by the hacker. Moreover, a statement from Experty and Bitcoin Suisse said that the hacker got hold of the email list by compromising the computer of one of the people who carried out Experty's Proof-of-Care review. Experty said it would give 100 EXY tokens, or the equivalent of US$120, to every person in their email database, but users who sent Ethereum to the hackers' account will not get their money back nor will they receive complimentary EXY tokens.
These recent incidents are certainly not new, and there have been a number of notable incidents involving different methods to steal cryptocurrency over the past year. In December 2017, NiceHash, a Slovenia-based cryptocurrency-mining marketplace suffered a data breach where hackers stole the contents of its Bitcoin wallet. About 4,700 bitcoins were stolen, the equivalent of US$64 million.
The popularity of cryptocurrencies like Bitcoin and Ethereum is a profitable target for cybercriminals. Not only are they employing phishing scams similar to the Experty incident, they are also using means like cryptocurrency-mining malware such as the Digmine bot, which is spread through Facebook Messenger. In another recent incident, a Satori botnet variant was used to hacked into Claymore mining rigs to mine ethereum.
While Bitcoin and other similar cryptocurrencies are relatively new technologies, it's ripe for different kinds of disruptions and threats, and has already proven to be a profitable target. With that said, there is a need for cryptocurrency security such as using a split wallet to protect bitcoins from malware. In unregulated exchanges, bitcoin is stored digitally in wallets, but it invites attention from hackers who believe that they can exploit a vulnerability.
Here are some best practices to prevent falling victim to phishing attacks:
Be cautious of individuals or organizations asking for personal information. Most companies will not ask for sensitive data from customers.
Take a close look at the sender's display name when checking the legitimacy of an email. Companies will use a single domain for their URLs and emails.
Avoid clicking links or download files even if it seems to come from a trustworthy source.
Check for mismatched URLs. An embedded URL might seem valid, but hovering above it might show a different web address.
Be on the lookout for grammatical errors and spelling mistakes.
Check if the messages contain a generic subject and greeting, as this is a clear sign of a phishing attempt.
Use the built-in protection of email clients to filter messages. One example is to set the email client to block all images unless approved.
Legitimate companies will not send out confirmation emails unless there are specific reasons for doing so. Companies will avoid sending unsolicited messages unless it is for company updates, newsletters, or advertising purposes.
Take note of unusual information in the text of the message. Mentions of operating systems and software that is not used by consumers can be an indicator of a phishing attempt.
If it seems suspicious, it probably is. Err on the side of caution when sending out personally identifiable information through messages and emails.
Like it? Add this infographic to your site:
1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
Posted in Cybercrime & Digital Threats, Cryptocurrency
The Crypto-Monetized Web: A Forward-Looking Thought Experiment
Probing the Activities of Cloud-Based Cryptocurrency-Mining Groups
TeamTNT Activities Probed: Credential Theft, Cryptocurrency Mining, and More
Malicious Docker Hub Container Images Used for Cryptocurrency Mining
Cryptocurrency Miner Uses Hacking Tool Haiduc and App Hider Xhide to Brute Force Machines and Servers
Ransomware Spotlight: Magniber
The Evolution of Windows Kernel Threats
The Future of Ransomware
Trend Micro Security Predictions for 2023: Future/Tense
Ransomware Spotlight: Cuba
Virtualization & Cloud
Securing Home Routers
Uncovering Security Weak Spots in Industry 4.0 CNC Machines
Leaked Today, Exploited for Life: How Social Media Biometric Patterns Affect Your Future
5G and Aviation: A Look Into Security and Technology Upgrades Working in Tandem
Analyzing the Risks of Using Environment Variables for Serverless Management
An Analysis of Azure Managed Identities Within Serverless Environments
Using Custom Containers in Serverless Environments for Better Security
Alexa and Google Home Devices can be Abused to Phish and Eavesdrop on Users, Research Finds
Mirai Variant Spotted Using Multiple Exploits, Targets Various Routers
A Look Into the Most Noteworthy Home Network Security Threats of 2017
Enterprises and organizations are facing a period of transition and uncertainty – malicious actors will hunker down and reuse tried-and-tested tools and techniques.
View the 2023 Trend Micro Security Predictions
2022 Midyear Cybersecurity Report
In our midyear security roundup, we highlight the most significant security stories that made a considerable impact on the threat landscape in the first half of 2022 amid a diffused labor pool and a widening digital attack surface.