Phantom wallet phishing attack

[_act_]

I am wondering how a wallet are still vulnerable to hackers to be able to bring up fake extension update. This happened on Phantom wallet recently.

Anyone that updated the wallet will be taken to where the person can put his seed phrase. This is how the seed phrase will be seen by the hackers and be used to steal the coins on the wallet.

https://x.com/realScamSniffer/status/1887509151557034058

[Hatchy]

I don't use phantom wallet, so I don't know much about how it works. But I will advice people to use a more secured wallet app as their storage devices.use wallets that has their official pages and when you update them it comes from their source. Though if you go through they a phishing link, you might as well get hacked. The Internet is broad so while doing anything that relates to the safety of our fund, we have to be very careful.

[joniboini]

Based on the tweet, it looks like the user needs to input their seed phrase for the attack to work. Should be easy to avoid as long as people double-check everything. Not to mention they need to visit malicious websites first, CMIIW.

This makes me remember the recent Google developer scam attacks where scammers can publish fake updates through legitimate channels because they obtain the dev data. Hopefully people will be careful with automatic updates in the future since even developers get tricked by phishing emails.

[btcltcdigger]

Any time it asks you to put the seed, especially on an "off site" is a cause for concern.
Yet, many new users are not aware of that unfortunately, so they get hooked. RIP to them

[Alpha Marine]

I legit don't understand how this is possible. How did the creators or owners of Phantom Wallet allow that to be possible? How is a third party sending links and updates to a wallet? This doesn't make sense at all. This is actually a very scary stuff because the update and links that wallets and exchanges send are suppose to be secured.
Theres also the probability of downloading an already corrupted app instead of the original app.
I would really like an explanation on all the ways something like this is possible. 

[Zaguru12]

I legit don't understand how this is possible. How did the creators or owners of Phantom Wallet allow that to be possible? How is a third party sending links and updates to a wallet? This doesn't make sense at all. This is actually a very scary stuff because the update and links that wallets and exchanges send are suppose to be secured.
Theres also the probability of downloading an already corrupted app instead of the original app.
I would really like an explanation on all the ways something like this is possible. 

It’s simple, you know the phantom wallet is mostly a Solana based wallet and as such one of the most widely used altcoin wallet for airdrops. Most at times users are asked to connect to connect to websites to participate in this airdrops and I think it is through this connection that a fake website is actually been created and people connect to this fake website it is from this scam sites that this pop message are sent to the real phantom wallet been connected and asking of seed phrase. Without connecting to the fake website there is way this pop up messages will come through or have access.

A clear example of these is actually happening now with PAWS 🐾 airdrop connecting site, the fake one is spreading and this same pop message is shown. Scammers are getting sophisticated everyday, tricks like this are not a concern for experience folks but the scare is the newbies. I always warn people to use burner wallets whenever they do airdrops and connect wallets.

[BitMaxz]

Based on the tweet, it appears that the man connected it to a random site and requested a sign message, but the sign message stated that it needed to be updated to a newer version. After he confirmed a fake modal appeared asking for a seed phrase.

The bad part is he didn't know how safe the site is to connect to. The site itself is the one who demands a seed phrase it also happen even on a Bidget wallet that is why most wallet gives you warning first like unknown site or untrusted site and asking if you are willing to connect or not.

So you need to think about it first if you get a warning when connecting to any site always do a deep research before confirming. Also, always ask trusted people or start a thread on the forum to determine whether the site you are about to connect to is legitimate.

Honestly, I don't randomly connect to any site unless the link provided is confirmed legit and I do ask people that I trust first on some exchanges and group before I connect to a site that gives me warning.

We should be always be careful to randomly access any site that we don't because scammer these days even the tactics are the same people still be fall to any of these traps.

[cryptoaddictchie]

Based on the tweet, it looks like the user needs to input their seed phrase for the attack to work. Should be easy to avoid as long as people double-check everything. Not to mention they need to visit malicious websites first, CMIIW.

Thats true. Ive heard of this when they updated the apo but for sure there are somw who caught with it since its the official app. Technically they got some fault there but if you are user who are careful, you must think first before importing any keys. Especially if theres a chance that they got compromise at the middle of something.

[DPHOR]

I was actually told to download Phantom wallet but wasn't that comfortable with the wallet so had to download Electrum wallet. I don't have more knowledge about this wallet but anyone who is downloading such wallet should be mindful not to get hacked and newbies that doesn't know much about how to avoid those phishing site would easily get hacked.
It's always important to stick to a particular wallet that you are used to than moving from wallets that wallets.

[Justbillywitt]

It's a big concern though, because not many people are as knowledgeable as you and I to know that updating a wallet, we shouldn't be asked for seed phrase. We have lots of newbies coming in to this space though. Seed phrase are only needed when you are importing your wallet and not when you are updating wallet. This is where experience should comes in handy. Because why should I put my seed phrase in updating my wallet. It's a big red flag which can easily be detected. I feel sorry for people who may have fallen for this scam. Let's just be careful out there and always remember to protect our assets at all cost.

[promise444c5]

Never share your seed phrase to any website or online generally, if it's not  setting up your wallet once again using a trusted &verified wallet app, then it probably a scam attempt especially when it's coming from a random website.. smart contracts won't ask for your seed phrase either

I was actually told to download Phantom wallet but wasn't that comfortable with the wallet so had to download Electrum wallet.

Phantom wallet and Electrum wallet differs entirely,it's worth knowing that Electrum is a bitcoin only wallet which means you  can't use any altcoin on it,  Phantom is the opposit, it doesn't support BTC because it uses the  solana blockchain but it supports tokens and altcoins that uses the solana network

[Patikno]

I am wondering how a wallet are still vulnerable to hackers to be able to bring up fake extension update. This happened on Phantom wallet recently.

Anyone that updated the wallet will be taken to where the person can put his seed phrase. This is how the seed phrase will be seen by the hackers and be used to steal the coins on the wallet.

https://x.com/realScamSniffer/status/1887509151557034058

I thought at first this type of scam really made a fake extension or add-ons, but it seems they are phishing by displaying a fake Pop-up, which looks similar to the phantom display itself. If I see the Pop-up, then it is clear that it feels strange if the phantom wallet asks to re-enter our Seed-phrase, from that it should have been realized that it was odd or strange. From this, we can learn that we must be careful and skeptical of anything when surfing, because there are so many scammers lurking, and if necessary ask these strange things to a trusted community and one of them is like this forum.

[Wiwo]

I am wondering how a wallet are still vulnerable to hackers to be able to bring up fake extension update. This happened on Phantom wallet recently.

Anyone that updated the wallet will be taken to where the person can put his seed phrase. This is how the seed phrase will be seen by the hackers and be used to steal the coins on the wallet.

https://x.com/realScamSniffer/status/1887509151557034058

Some time ago I received a DM from a user who sent me a link to pointing it to a comment I made and when I clicked the link in the PM I was taken to a page where I was asked for my username and password immediately I know something fishy is wrong and I to take a deeper look at it, and I discovered the hackers were making attempts to take my account from since then I am very skeptical about using links.

I have heard several hackers attacks, but the best thing to do to avoid all of those attempts is to gain an advantage over wallet owners' seed phrase which is something very important and the ultimate secret to total wallet control, this format is an old format used by ecamners and hacker's.

[khaled0111]

I legit don't understand how this is possible. How did the creators or owners of Phantom Wallet allow that to be possible? How is a third party sending links and updates to a wallet? This doesn't make sense at all.

No system or software is completely secure or immune to attacks.
If I'm not mistaken, something like that occurred with Electrum too where users received a pop-up message asking them to update their wallet app.
However, in this case, users are more likely to realize that this is a phishing attack as soon as they are asked to enter their wallets seed on the phishing website.

[PX-Z]

I legit don't understand how this is possible. How did the creators or owners of Phantom Wallet allow that to be possible? How is a third party sending links and updates to a wallet? This doesn't make sense at all. This is actually a very scary stuff because the update and links that wallets and exchanges send are suppose to be secured.

Right, i hope devs can explain what actually happened and what part of the code was taken advantage of (loophole), fix it, so it shouldn't happened again in the future. This attack is more like hackers doing behind not just a scammer wants to get the funds of those wallet owners.

[joniboini]

Ive heard of this when they updated the apo but for sure there are somw who caught with it since its the official app. Technically they got some fault there but if you are user who are careful, you must think first before importing any keys. Especially if theres a chance that they got compromise at the middle of something.

Oh for sure. Developers need to be even more careful with their security, especially after so many scam campaigns targeted towards them lately. But you can only blame them for things they can improve. They can't guarantee people to input their seeds phrase to some websites. Especially if they put a notice saying their wallet won't ask for a private key or something similar whenever the user needs to make a transaction.

[Odohu]

I am wondering how a wallet are still vulnerable to hackers to be able to bring up fake extension update. This happened on Phantom wallet recently.

Anyone that updated the wallet will be taken to where the person can put his seed phrase. This is how the seed phrase will be seen by the hackers and be used to steal the coins on the wallet.

https://x.com/realScamSniffer/status/1887509151557034058

If you are prompted to update your wallet from the main application, how will it lead to the hacker's fake link? I'm trying to understand how this will be possible because if it happens that way, then it could be a case of serious compromise. The normal thing would be that when the prompt to update the up pops up, it should take one straight to the official platform where the latest updates can be downloaded and installed. The only people that would have face challenge of the hackers are those installing for the first time, who might not know the official platform to use for their downloading.

[hugeblack]

Unfortunately, this is one of the bad aspects of Airdrops, where you link your wallet to a random site, and therefore you must be careful when clicking on any messages from that sites, as many of these sites do not require you have a balance in your wallet so, create a wallet with a balance and try to avoid clicking on random links as possible.

[tbct_mt2]

Unfortunately, this is one of the bad aspects of Airdrops, where you link your wallet to a random site, and therefore you must be careful when clicking on any messages from that sites, as many of these sites do not require you have a balance in your wallet so, create a wallet with a balance and try to avoid clicking on random links as possible.

This can make your devices and your wallets compromised when you use your device connecting to strange websites and use your wallets interacting with unknown smart contracts.

As the advice goes like, use a device that you don't store your main fund, and use wallets with testnet or very small fund for airdrop tasks. If you lose something to phishing websites or scam smart contracts, the value of loss won't be too much.

How to tell if a smart contract is safe to interact with.

[hugeblack]

As the advice goes like, use a device that you don't store your main fund, and use wallets with testnet or very small fund for airdrop tasks. If you lose something to phishing websites or scam smart contracts, the value of loss won't be too much.

Yes but many don't do it to avoid paying the transaction fees, it's funny how some risk $1000-5000 to save $5-20 in fees.
It is also better to create a hardware wallet for cold storage.