The new report from Kaspersky has revealed that while traditional phishing scams are still being used, new and more sophisticated scams are targeting crypto wallets.

Crypto wallets function in much the way traditional wallets do – they store cryptocurrency that can then be accessed and exchanged by the cryptoasset owner.

These wallets come in two forms: a hot wallet, which has permanent access to the internet, and a cold wallet, which does not have a permanent connection to the internet, coming in the form of a private key or dedicated device.

Hot Wallets 

Since hot wallets require an internet connection, their ease of creation and use make them a major target of cybercriminals. But because they are always online, users tend to not store large amounts of assets in hot wallets.

Cybercriminals are still interested in targeting these wallets, but make less of an effort – their phishing scams are simple and often target unsophisticated users.

Hackers will typically send an email message to users pretending to be a well-known crypto exchange platform, requesting a user to verify their account or confirm a purchase.

Users who click the link are redirected to a page an asked to enter their ‘seed phrase’ – a phrase of 12 or 24 words for recovering access to a crypto wallet, which functions as the main password for these wallets. This phrase cannot be changed or recovered – losing it or giving it to scammers would permanently compromise the wallet.

Because these lack sophistication in both technical or social engineering, they are typically done on a mass scale and target newer, less technical users.

Cold Wallets

As cold wallets are not always connected to the internet, and are typically stored on hardware, these tend to store larger amounts of assets.

While it would be more difficult to access cold wallets, it is not impossible, and sophisticated tactics can lead to a massive pay out if successful.

Scammers typically use social engineering at a more advanced level to target cold wallets – Kasperky picked up an email campaign aimed at cold wallet owners which used sophisticated technical techniques to dupe owners into disclosing their passwords.

The campaign sent emails to users which was addressed as being from the Ripple cryptopcurrency exchange for a giveaway offer. The link leads users to a blog page detailing the rules of the giveaway, providing another link where users can register.

Already with extra steps, the scammers copied the design of the Ripple website and went to the trouble of registering a nearly identical domain name. They also used a .net domain, while Ripple uses a .com, but as .net is a commonly used by legitimate domains, it may not have sparked any hesitation to many users keen for a crypto giveaway.

Once users follow the link to the fake registration page, they are offered to connect with a WebSocket address where they can enter the address of their XRP account – XRP being the cryptoasset on offer for the giveaway.

Next, to appear even more legitimate, users can choose an authentication method to receive the tokens – hardware wallets are the top listed and suggested method by the scammers, as shown by Kaspersky’s report.

Recommended

• DIGIT’s Movers and Shakers June 2023
• UK Data Protection Reform: EU Adequacy May Be at Risk
• Edinburgh Airport to Receive New 3D Security Scanners

Selecting the Trezor option redirects users to the official website, trezor.io, which connects devices to web apps via the Trezor API. When the user tries to connect, Trezor Connect will ask them to consent to “anonymous collection and to confirm that they want to connect to the website,” the Kaspersky report says.

The address in question is actually displayed as a Punycode on the side of the site, with scammers hoping the address goes unnoticed by users.

Connection with the other hard wallet option, Ledger, is similar, but uses a WebHID interface, according to Kaspersky, with the other steps the same.

Once users connect their hardware wallet, Kaspersky found that scammers use two different APIs for interacting with the account, and then request the funds. Scammers also create one-time “intermediate wallets” to receive and forward the funds to the scammers real accounts, helping to hide the assets’ target destination.

With all that effort, how common are crypto wallet scams in the first place?

Kaspersky’s antispam solutions said they detected and blocked 85,362 scam emails targeting cryptocurrency users in the spring of 2023, with a peak of 34,644 messages in March alone.