Audit reports

All Case Studies

Case Studies

About

Careers

Brand Assets

Invest

Company

Audits 

Services

Mitigate weaknesses in your smart contract and improve its functionality with a double line-to-line code analysis and a separate review by a lead auditor.

Secure the entire architecture and implementation layers of your blockchain protocol with professional security audits and testing.

Proactively detect vulnerabilities in your Web3 project by subjecting your systems to a simulated cyberattack in a secure and controlled environment.

Identify vulnerabilities in applications interacting with blockchain networks with secure code review and static security analysis.

Code review & static security analysis for crypto wallet apps.

Code review & security analysis for cross-chain crypto bridges.

Receive only relevant bug reports or undergo crowdsourced penetration testing with the help of thousands of ethical hackers curated by HackenProof.

Enhance transparency in crypto exchanges with independent on-chain proof of assets’ true collateralization.

Assess and strengthen your security practices, identify vulnerabilities, and safeguard valuable digital assets in the ever-evolving cryptocurrency landscape.

Ensure your token model robustness and efficiency and convey trust to investors and community with our thorough, independent audit of protocol economic security.

Solutions

Featured ecosystems

By Languages

Blog

Company 

Discover

Insights

Industry news

Network

Hacken news

Resources

Smart Contract Audit

Blockchain Protocol Audit 

Blockchain Penetration Testing

dApp Audit

Cross-Chain Bridge Audit

Crypto Wallet Audit

Bug Bounty

Proof of Reserves Audit

Solidity

Rust

Move

Solana

Near

Polkadot 

Cosmos 

Optimism

Ethereum (EVM) 

Avalanche

Fantom

Polygon

Aptos

zkSync

Arbitrum

Radix

Linea

MetaMask

Smart Contract Audit Solutions

Terms and Conditions 

Privacy Policy

<p>In 2021 alone, hackers stole almost <a href="https://go.chainalysis.com/rs/503-FAP-074/images/Crypto-Crime-Report-2022.pdf">$14 billion</a> worth of crypto, nearly twice the amount stolen in 2020. A significant percentage of the stolen funds was related to phishing attacks.</p>



<p>In this article: What’s behind a phishing scam, what are their forms, and how can businesses protect themselves?</p>



<h2 class="wp-block-heading">Phishing Attack Types</h2>



<h3 class="wp-block-heading"><strong>1 Spear Phishing</strong></h3>



<p>Spear phishing is an email or messenger attack targeted toward a specific individual, organization, or business. It is often intended to steal data for malicious purposes. Phishers may also plan to install malware on a targeted user’s computer.</p>



<h4 class="wp-block-heading"><strong>1.1 Public email instead of a corporate one</strong></h4>



<p>Attackers may use a public email account because creating a fake email with a public domain is much easier than a corporate one. An “official” email that ends in "@gmail.com" instead of "@companyname.com" should immediately arouse suspicion.</p>



<h4 class="wp-block-heading"><strong>1.2 Clone phishing attack</strong></h4>



<p>This attack happens when the attacker creates a replica of a legitimate email sent to the user in the past. The attacker replaces the original attachment or link with a malicious one and sends it to the victim. Since the email looks identical to those that are previously received by the victim, they are more likely to click on the link.</p>



<h4 class="wp-block-heading"><strong>1.3 Whaling attack (CEO Fraud)</strong></h4>



<p>Whaling attack also known as <a href="https://www.bbc.com/news/business-35250678" target="_blank" rel="noreferrer noopener">CEO fraud</a>, is a method used by phishers to masquerade as a senior player at an organization and directly target senior or other influential individuals at an organization, with the aim of stealing sensitive data or gaining access to their computer systems for attack purposes. A whaling attack doubles down on targeting specific individuals and posing as a senior member of an organization. Even the most <a href="https://www.theguardian.com/technology/2016/feb/29/snapchat-leaks-employee-data-ceo-scam-email" target="_blank" rel="noreferrer noopener">high-profile companies</a> become victims of whaling attacks. For example, Ubiquiti Networks lost $33 million after a payment request by a fraudulent CEO, while a Snapchat employee shared confidential payroll data after a fake email. In another example, <a href="https://blockworks.co/crypto-ceo-who-faked-paypal-partnership-pleads-guilty-for-21m-fraud/" target="_blank" rel="noreferrer noopener">Titanium Blockchain CEO</a> deceived investors for $21 million by faking a PayPal partnership.</p>



<h3 class="wp-block-heading"><strong>2. Malicious AirDrops</strong></h3>



<p>Airdrops campaigns can also be leveraged to carry out phishing attacks. For example, users can receive an email or social media message that some coin has been added to their wallet via an airdrop. The victim is then directed to a malicious exchange where the coin can be sold.</p>



<p>The website asks victims to connect their wallets and sign malicious transactions which can drain your wallet. A recent example of an airdrop phishing scam worth $8 million with a fake <a href="https://en.cryptonomist.ch/2022/07/13/4000-eth-stolen-uniswap-v3/?amp=1" target="_blank" rel="noreferrer noopener">Uniswap</a>. By manipulating the trade log, the scammer disguised airdrop as a tx <a href="https://etherscan.io/token/0xcf39b7793512f03f2893c16459fd72e65d2ed00c" target="_blank" rel="noreferrer noopener">coming directly from Uniswap</a>. The victim received a fake airdrop of an lp token from the attacker disguised as a transaction coming directly from Uniswap. "Uniswap" appeared as the sender of the transaction on blockscan. The victim then wanted to claim the airdrop on the fake website and gave approvals. The attacker now had access to the victims’ funds.</p>



<h3 class="wp-block-heading"><strong>3. Fake Browser Extensions</strong></h3>



<p>Crypto users use different types of browser extensions like MetaMask wallet or other crypto wallets. While the wallet browser extension serves flexibility for crypto users, it also can be a target for attackers. Cybercriminals are using fake browser extensions of crypto wallets to steal users' funds. The fake browser extensions can help in capturing log-in credentials (seed phrase or private key) of your wallet. You should be even more cautious when such extensions are promoted via Google Ads.</p>



<h3 class="wp-block-heading"><strong>4. DNS Hijacking</strong></h3>



<p><a href="https://hacken.io/education/dns-hijacking/" target="_blank" rel="noreferrer noopener">DNS hijacking</a> is one of the hardest recognizable scams which might take a keen eye for detail to notice. DNS hijacking or DNS spoofing attacks related to hijacking websites' DNS. The attackers replace the authentic website with a fake interface. Unsuspecting users can use their log-in credentials and their private keys on the fake website for swapping and trading NFTs thereby compromising their crypto assets. Decentralized exchange Curve Finance lost $612k in stablecoins after their website was DNS hijacked.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
https://twitter.com/CurveFinance/status/1557104676830601216?s=20&amp;t=Q5KyIqZT1M-pXRL5AX4QKg
</div></figure>



<h3 class="wp-block-heading"><br><strong>5. Ice Phishing (eth_sign or contract_approve)</strong></h3>



<p>Ice phishing is a Web3 clickjacking attack that tricks users into signing or delegating the approval of the user’s token to an attacker. The smart contract user interface does not make it obvious to the victim that the transaction has been tampered with. All the attacker needs to do is modify the sender's address to the attacker’s address and then wait for the victim to authorize the transaction, approving the attacker’s account. It means the “spender” can spend on the owner’s behalf.</p>



<p>In this case, the attacker was able to modify the smart contract by injecting a malicious script into the smart contract front end. Such an attack happened on the <a href="https://www.microsoft.com/security/blog/2022/02/16/ice-phishing-on-the-blockchain/" target="_blank" rel="noreferrer noopener">BadgerDAO</a> exchange late last year when attackers leveraged ice phishing to steal cryptocurrency worth $120 million.</p>



<h3 class="wp-block-heading"><strong>6. Evil twin attack</strong></h3>



<p>An evil twin phishing attack related to public Wi-Fi networks. Attackers set up a fake Wi-Fi network using the same name as a legitimate network. When victims connect to the network, they may enter their login credentials on any service, which the phishers can then use to gain access to their accounts.</p>



<h3 class="wp-block-heading"><strong>7. SEO phishing</strong></h3>



<p>Search engine phishing, commonly known as SEO poisoning or SEO Trojans, is a method where hackers work to become the top hit on a search using search engine optimizations. Clicking on the link displayed within the search engine directs you to the malicious website, identical to the original one. From there, attackers can steal your information when you interact with the site and enter sensitive data.</p>



<h1 class="wp-block-heading"><strong>How can businesses avoid crypto phishing attacks?</strong></h1>



<ul>
<li>Periodically review and revoke token allowances.</li>



<li>Social engineering and social engineering test.</li>



<li>Constant monitoring of all social media channels to identify phishing activity.</li>



<li>Takedown of suspicious Google ads and malicious social media accounts.</li>



<li>Rapid identification and takedown of phishing domains and fake wallets.</li>



<li>Reporting phishing scams to <a href="https://www.ic3.gov/Home/ComplaintChoice">IC3</a>, <a href="https://safebrowsing.google.com/safebrowsing/report_phish/">Google Safe Browsing</a>, <a href="https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site">Microsoft</a>, and <a href="https://support.google.com/ads/troubleshooter/4578507?visit_id=1-636416326102495458-2898953778&amp;rd=1">Google Ads</a>.</li>



<li>Reconnaissance activities to detect flaws in the systems of the target company.</li>



<li>Check if the smart contract has been audited.</li>



<li>Email phishing testing, vishing (voice phishing) testing, and other appropriate types of testing</li>
</ul>



<p>Web3 businesses are recommended to conduct these steps themselves, or they can rely on the professional expertise of security companies like Hacken. We provide comprehensive anti-phishing services as part of our <a href="https://hacken.io/services/security-assessment/social-engineering/">social engineering package</a> for crypto projects. Hacken has already saved <a href="https://venturebeat.com/2017/12/21/how-hacken-helped-jibrel-avoid-major-losses-during-an-ico-phishing-scam/">Jibrel Network’s ICO</a> and <a href="https://hacken.io/research/hacken-news/contactless-identification-for-perfect-service-is-here-191857f7bd82/">Nucleus Vision</a> from real phishing attacks.</p>

10 types of phishing attacks &amp; how businesses can prevent them

<h2 class="wp-block-heading">What is Advanced Persistent Threat</h2>



<p>An advanced persistent threat (APT) is a broad term used to describe an attack campaign in which a team of intruders establishes an illicit, long-term presence on a network to mine sensitive data.</p>



<p>The biggest and the most notable example of this attack type is the Ronin validator hack.</p>



<p>Such attacks, in most cases, are performed by Nation states, well-funded criminal organizations, and other advanced organized groups.</p>



<p>There are a lot of talks and even confirmations that some advanced groups are actively targeting web3 projects.</p>



<p>The people behind the most concerning APTs usually live in places without extradition treaties with the U.S. and EU, making it harder for them to be prosecuted for their criminal activities. One of the most well-known APTs is Lazarus, widely linked to North Korea.</p>



<p></p>



<h2 class="wp-block-heading">Malware Types</h2>



<p>From the earlier investigations, it is known that Lazarus advanced persistent threat (APT) group targets cryptocurrency companies with trojanized Windows and macOS cryptocurrency applications.</p>



<p>The malicious apps steal private keys and exploit other security vulnerabilities to execute subsequent attacks and fraudulent transactions.</p>



<p>U.S. authorities linked Lazarus to Ronin’s $625 million hack.</p>



<p></p>



<h2 class="wp-block-heading">Phishing Methods</h2>



<p>Lazarus APT targets employees of blockchain companies, using fake job offers.</p>



<p>Lazarus APT uses various communication platforms to send phishing messages to employees of cryptocurrency companies. It targets all employees, but mostly system administrators, software developers, or IT operations (DevOps).</p>



<p>The messages often mimic a recruitment effort and offer high-paying jobs to push the recipients to download malware applications, which the U.S. government refers to as ‘TraderTraitor.</p>



<p>According to CISA, the Lazarus campaign distributes apps developed in JavaScript targeting the Node.js runtime environment using the cross-platform Electron framework. The apps are forked from various open-source cryptocurrency projects.&nbsp;</p>



<p></p>



<h2 class="wp-block-heading">How to protect yourself</h2>



<p>U.S. agencies published a comprehensive list of tactics, techniques, and procedures (TTPs) and indicators of compromise (IoC) related to Lazarus APT. Moreover, they advised blockchain companies to use various mitigations to minimize Lazarus APT’s threat to the cryptocurrency industry.</p>



<p>According to CISA, blockchain companies should implement security strategies, at least access models and defense-in-depth.</p>

Advanced Persistent Threat (APT)

<p>One of the smartest moves a company can make to validate its cyber security defenses is hiring a third-party provider of penetration testing services. If any cracks are revealed, external pentesters are more likely to find them than your in-house pentest experts.</p>



<h2>The Definition of Penetration Testing Services</h2>



<p><a href="https://hacken.io/services/penetrationtesting/">Penetration testing services</a> are measures that involve simulating cyber attacks to detect loopholes in a computer system before evildoers can exploit them. Regular pentesting, typically performed by ethical hackers, allows companies to identify and manage vulnerabilities efficiently.</p>



<h2>Looking for the Best Penetration Testing Services</h2>



<p>How can you tell a pentesting provider is who they say they are? How can you be sure that their pentesting team doesn’t consist of inexperienced junior engineers who lack the essential skills to perform pentesting for your company?</p>



<ul><li>Stay away from the providers of cyber security testing services who offer the same low price to all clients. You’ll most probably get nothing else but an automated vulnerability scan. When evaluating the scope of work, a reliable provider always gathers the basic info about the company. The pricing quote accounts for multiple factors, such as the systems in place, the number of IP addresses used, etc.&nbsp;</li><li>The best penetration test services are performed using the expertise of hacking communities who are always in the loop about current security trends and weaknesses.&nbsp;</li><li>If an ill-equipped third-party provider promises to deliver penetration testing services in a few days, make sure you part ways with them. The average time for carrying out full-fledged manual penetration testing services is 1-3 weeks.</li><li>A solid pentest company will explain the whole process in detail from the very start and will keep you updated on each step made. If any vulnerabilities get highlighted, you will be immediately notified about them.</li><li>Look through the pentesting reports of the provider you are about to choose. If they run vulnerability scans instead of performing manual penetration testing services, their reports are likely to include a lot of false positives, which might make it challenging to decide which vulnerabilities should be mitigated in the first place.&nbsp;</li><li>A top-notch provider of penetration testing services will give you a publicly verifiable pentest certification, which will let your customers see that you care about the security of your company.</li></ul>



<p>It might seem as though there are hundreds of companies that deliver penetration testing services. In fact, only a few companies like Hacken have the required expertise to provide high-quality pentesting. Filter out the providers who offer automatic vulnerability scans that have nothing to do with real pentesting, and you will dramatically narrow your list of pentesting companies to choose from.</p>

Making the most of Web3 Penetration Testing Services

<p>During last months, there have been a lot of talks about web/mobile wallet security. In this article, we will briefly cover more specific risks, which are actual, according to recent exploits.</p>



<p></p>



<p>So, let's take a look at the main risks:</p>



<p></p>



<h2 class="has-normal-font-size">Wallet app keeps your private keys/seed phrases unencrypted on a centralized server</h2>



<p></p>



<p>Some wallets may keep your seed phrases on the centralized servers and store them unencrypted, making them visible to anyone with access to the server. </p>



<p></p>



<h2 class="has-normal-font-size">Management of the private key by the wallet source code</h2>



<p>If the private key is managed by the wallet app source code, the developer of the app can access every wallet in the app by releasing a new wallet update that has the function of sending all private keys to him.</p>



<p></p>



<hr class="wp-block-separator" />



<p>These two factors do not depend on you. The only thing you can do is use so-called "battle-tested" wallets. Those which exist for at least 1-2 years and have a crystal reputation. </p>



<p></p>



<p>Let's continue with other factors, which can be under your control:</p>



<p></p>



<h2 class="has-normal-font-size">Copying your seed phrase when creating the wallet</h2>



<p>After copying your seed phrase on your device, it goes to the clipboard. Copying seed phrases shouldn't be possible because other applications or websites can access your clipboard and steal seed phrases.</p>



<p></p>



<h2 class="has-normal-font-size">Generating and copying your private key </h2>



<p>It's pretty much the same problem as the previous one but dedicated to the private key. When copying your private key to the clipboard, it also becomes possible for other applications and websites to steal it.</p>



<h2 class="has-normal-font-size">Clipboard history on some OS</h2>



<p>Some operational systems, such as Windows and Android, have a built-in clipboard history function, so every application or website which gets access to the clipboard and its history can easily access your seed phrase or private key, which you may have copied long before.</p>



<h2 class="has-normal-font-size"><strong>Sending your seed phrase to your email when creating your wallet</strong></h2>



<p>Some of the wallet apps have a function to send your seed phrase to your email at the stage of wallet creation. It creates additional risk because, as a user, you can't be sure that a wallet application makes it in a safe and encrypted way, so it is better to avoid such functions.</p>



<hr class="wp-block-separator" />



<p></p>



<p>These factors depend only on you, so better to remember all of them to keep your wallet secure. </p>



<p></p>



<p></p>



<p>All the facts mentioned in the article have equal importance in your wallet security. </p>



<p></p>



<p>Most of these factors are not appropriately considered in wallet security, but they are of critical importance in your wallet security.</p>

Get our latest updates and expert insights on Web3 security