.png){kind=logo}
The police and cybersecurity agency are warning the public of a new cryptocurrency scam that has become more common globally. Cyber criminals are using what is called "crypto drainers" - a type of malware used to target victims.
It is a new cryptocurrency scam. If you have a crypto wallet or a account in one of the crypto exchange or platforms, please be very aware.
This is going to be an easier money scheme for cybercriminal than Ransomware.
1) The crypto wallet you transfer to is not traceable.
2) You don't even need to contact the victim
3) Crypto fund can be quite huge
The modus operandi of these crypto drainers can be distilled into the following steps:
Launch a Phishing Campaign: Cybercriminals will promote a fake crypto airdrop1 by publicizing the campaign through social media platforms or emails. These cybercriminals have also been observed to compromise verified X (formerly known as Twitter) accounts to increase the reach and credibility of their campaigns.
Direct Victims to a Phishing Website: A phishing link will then be provided to direct unsuspecting victims attempting to claim the allegedly free tokens to a phishing website that resembles a token distribution platform. The website will prompt them to provide their crypto wallet details to receive the tokens.
Wallet Connection: When unsuspecting victims connect their crypto wallets to the website, they will be requested to authenticate their accounts using their private keys or seed phrases. Once a connection has been established with their crypto wallets, the foundation is now laid for cybercriminals to begin exfiltrating cryptocurrencies out from the victims’ wallets.
Malicious Smart Contract Interaction: The victims will then be induced to interact with a malicious smart contract3 under the pretext that it is a necessary step to claim the airdrop or incentives. However, the contract contains embedded malicious functionalities such as manipulating ‘approve’ or ‘permit’ allowances for cybercriminals. Once executed, it enables cybercriminals to drain the victims’ cryptocurrency wallet without further interactions (or authorizations) required from the victims.
Asset Transfer and Obfuscation: Upon successfully infiltrating and attaining the necessary controls over the victims’ crypto wallet, cybercriminals will begin to swiftly drain the wallet. The cybercriminals will also leverage sophisticated techniques such as cryptocurrency mixers or orchestrate a series of transfers to obfuscate the stolen assets trails, making it difficult to trace and attempt recoveries.
Safeguarding Yourself from Crypto Drainers
Despite the sophistication and possible scale of crypto drainer-related campaigns, there are measures that owners of crypto wallets can take to safeguard themselves from such scams.
These measures (non-exhaustive) include:
Using a hardware wallet for enhanced security.
Being wary of attractive offers such as free crypto airdrops that appear too good to be true.
Verifying the legitimacy and functions of smart contracts before interacting with them.
Limiting the use of high allowances and regularly reviewing and revoking them by using blockchain explorers or wallet interfaces.
Understanding the implications of approving or signing transactions before doing so.
Researching the background/history of a project or cryptocurrency before connecting your wallet and ensuring that any connections are performed after verifying the validity of the website.
Connecting a newly created or empty crypto wallet when uncertain about a project or token.
Comments