Written by: Luccy, Rhythm Little Worker, BlockBeats

In the cryptocurrency industry, Twitter is an important platform for information exchange as the main social media. However, it has also exposed many security risks. In recent months, a new trend of theft has emerged: well-known Key Opinion Leaders (KOLs) have become the main targets of social engineering attacks, and the official social media platform X (formerly Twitter) of the project frequently experiences account theft incidents.

These carefully planned attacks not only violate personal privacy, but also threaten the security of the entire digital assets. BlockBeats will explore several recent social engineering attack cases targeting well-known KOLs, revealing how attackers use carefully designed fraudulent methods, and how KOLs and ordinary users can increase their vigilance and prevent such increasingly rampant online threats.

伪装的假记者，针对 KOL 的社工攻击

Disguised Fake Journalists, Social Engineering Attacks Targeting KOLs

According to BlockBeats incomplete statistics, the first person to encounter social engineering attacks was the editor-in-chief of the mainstream US media Forbes. After communicating with imposters and crypto Kol@0xmasiwei about friend.tech and other imitated SocialFi projects, they sent a friend.tech "identity verification" link. After verification by SlowMist security personnel, the link was found to be a phishing link.

In addition, SlowMist founder Yu Xian has confirmed that FrenTechPro, the integrated custom tool of friend.tech, is a phishing scam. After clicking on "ACTIVATE NOW", hackers will continuously attempt to steal wallet-related assets from users.

Two months later, PeckShieldAlert, a security monitoring firm, detected a similar incident.

On December 18th, Kofi (@0xKofi), a cryptocurrency data researcher and contributor to DeFiLlama, posted on social media that there were vulnerabilities in DeFiLlama's contracts and dApps that could affect users' assets. Kofi urged users to click on the link attached to the tweet to verify the safety of their assets. This is a typical example of a social engineering attack, where scam groups exploit users' fear of vulnerabilities to lower their guard against fraudulent links.

At 2am yesterday, @0xcryptowizard was subjected to a social engineering attack, sparking a discussion in the cryptocurrency community. @0xcryptowizard used "machine translation" to promote the Arbitrum inscription in Chinese on social media platforms, and attached a mint link. According to community members, the wallet was emptied instantly upon clicking the link.

Regarding this, @0xcryptowizard posted saying that scammers took advantage of his/her rest time to release phishing links. Subsequently, @0xcryptowizard added a reminder in his/her Twitter profile that "there will be no links posted in the future; if there are links in the tweets, please do not click on them."

As for the reason for the theft, @0xcryptowizard stated that it was a carefully planned online scam. The attacker, @xinchen_eth, disguised themselves as a journalist from the well-known cryptocurrency media outlet Cointelegraph and contacted the target under the guise of scheduling an interview. The attacker induced the target to click on what appeared to be a normal appointment link, which was actually a disguised page that aimed to obtain authorization for @xinchen_eth's Twitter account and gain access to its Twitter permissions.

During this process, even if there were suspicions about the link, the design and presentation of the page still made him think it was a normal Calendly appointment interface. In fact, the page did not display any Twitter authorization interface, only the appointment time interface, which led him into a misunderstanding. Looking back, @0xcryptowizard believed that the hacker may have cleverly disguised the page.

Finally, @0xcryptowizard reminds other well-known opinion leaders (KOL) to be extra careful and not to click on unknown links, even if they appear to be normal service pages. The high concealment and deception of this type of fraud is a serious security risk.

After @0xcryptowizard, co-founder of NextDAO, @_0xSea_ also experienced a social engineering attack. A scammer claiming to be from the well-known crypto media company Decrypt sent a private message to him/her to conduct an interview, with the aim of spreading some ideas to Chinese-speaking users.

However, learning from past experiences, @_0xSea_ noticed carefully that the character in the phrase "Authorize Calendlỵ to access your account" on the Calendly.com authorization page sent by the other party is "ỵ", not the letter "y". This is similar to the fake sats incident last time, where the final character was actually "ʦ" instead of "ts". Therefore, it can be inferred that this is a fake account impersonating someone else.

Well-trained encryption hacker group Pink Drainer

During the attack on @0xcryptowizard, SlowMist Cosmos identified the scam group Pink Drainer. It is reported that Pink Drainer is a Malware-as-a-Service (MaaS) that allows users to quickly establish malicious websites and obtain illegal assets through the malware.

According to Beosin, a blockchain security company, the phishing website uses a tool to steal encrypted wallets and entices users to sign requests. Once the request is signed, the attacker will be able to transfer NFT and ERC-20 tokens from the victim's wallet. "Pink Drainer" charges users for the stolen assets as a fee, which reportedly could be as high as 30% of the stolen assets.

Pink Drainer team is notorious for their high-profile attacks on platforms such as Twitter and Discord, involving events such as Evomos, Pika Protocol, and Orbiter Finance.

On June 2nd last year, hackers used Pink Drainer to invade the Twitter account of Mira Murati, the CTO of OpenAI, and posted fake news claiming that OpenAI was about to launch "OPENAI tokens" based on AI language models, and attached a link to inform netizens to check whether their Ethereum wallet address was eligible for airdrops. To prevent others from exposing the scam in the comment section, the hacker also specifically disabled the public reply function.

Although this fake news was deleted one hour after it was posted, it had already reached over 80,000 Twitter users. According to the data displayed by Scam Sniffer, hackers gained about $110,000 in illegal income from this incident.

Last year, Pink Drainer participated in a highly sophisticated phishing scam, resulting in the theft of $4.4 million worth of Chainlink (LINK) tokens. The network theft targeted a single victim who was deceived into signing a transaction related to the "increase authorization" function. Pink Drainer exploited the standard cryptographic procedure of the "increase authorization" function, which allows users to set limits on the amount of tokens that can be transferred to other wallets.

Without the victim's knowledge, this action resulted in 275,700 LINK tokens being transferred without authorization in two separate transactions. According to details from the cryptocurrency security platform Scam Sniffer, initially, 68,925 LINK tokens were transferred to a wallet marked as "PinkDrainer: Wallet 2" by Etherscan; the remaining 206,775 LINK tokens were sent to another address ending in "E70e".

Although it is currently unclear how they are inducing victims to authorize token transfers, Scam Sniffer has discovered at least 10 new scam websites related to Pink Drainer in the past 24 hours since the theft occurred.

Currently, Pink Drainer's activities are still on the rise. According to Dune data, as of the time of writing, Pinkdrainer has accumulated over $25 million in fraud and has affected tens of thousands of victims.

Project official accounts are frequently hacked

Not only that, but in the past month, there have been frequent incidents of project official accounts being hacked.

On December 22nd, the ARPG dark brush treasure chain game "SERAPH: In the Darkness" official X platform account was suspected of being stolen. Users are advised not to click on any links posted by this account for the time being.

On December 25th, the decentralized finance protocol Set Protocol's official Twitter account was suspected to have been hacked, and multiple tweets containing phishing links were posted.

On December 30th, DeFi lending platform Compound's official Twitter account was suspected to have been hacked and a tweet containing a phishing link was posted. However, commenting was not enabled. BlockBeats reminds users to pay attention to asset security and not to click on phishing links.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia