[General] Crypto scams, attacks and malware

[Myleschetty]

According to a post on Saturday by the Chief Information Security Officer of the blockchain security firm SlowMist regarding Darksword, it was reported that attackers are leveraging this malware to circumvent iOS security measures when a victim accesses an infected website; the malware is set to activate on March 19, 2026 s posted by _act_ , to seize control of devices and extract private keys and other information from self-custodial Bitcoin wallets. The vulnerability is said to only impact iOS versions 18.4 to 18.7 then, but it now extends beyond the specified version. Here is what the Chief Information Security Officer of SlowMist said.

Unexpectedly, in one language, iOS users hurry to upgrade Black-gray industry has already achieved:
1. Clicking links to extract private keys and mnemonic phrases
2. Users access web pages via Safari, WebKit/JSC memory corruption to obtain JS layer read/write
3. Bypassing PAC to gain native call capabilities
4. Escaping the WebContent sandbox
5. Kernel privilege escalation to obtain root permissions, dragging away Keychain + wallet data

 Affected versions iOS 13 to 26.5 (more versions pending)

https://x.com/im23pds/status/2101265052825428144?s=20

[cryptomaniac_xxx]

https://x.com/coinbureau/status/2102279497676681616

So there is another alert with regards to Iphone users. They are being warned about a potential Safari zero-day exploit. And this loophole could exposed your crypto seed phrase and private keys.

Just be very careful if you are a Iphone users and have your crypto wallet in their. Update and patch everything, but you have to verify it first that you are getting it from legit sources.

Although this could also be a warning for everyone to do your due diligence.

[LoyceV]

They are being warned about a potential Safari zero-day exploit. And this loophole could exposed your crypto seed phrase and private keys.

A more general warning would be to limit exposure to hot wallets to the absolute minimum. Don't keep more on your phone than you need on the road.

[SatsPH]

According to this warning, North Korean hackers are targeting us with this kind of attacks,

The North Korean "WaterPlum" cyber actor group (commonly referred to as “Contagious Interview”) conducts cyberattacks by infiltrating unsuspecting job seekers’ computer networks, harvesting sensitive information, and stealing cryptocurrency. WaterPlum is victimizing individual IT professionals in Japan, the United States, Europe, and other countries.

Modus:
1. Will ask to download some files to verify your technical abilities
2. You say Yes
3. Download the link from Github, the malware masquerading as harmless in the beginning
4. You execute it as a applicant
5. Malware spread and look for everything related to crypto
6. Steal everything they can find



https://www.ic3.gov/CSA/2026/260918.pdf

The names of the malware might be different, but it has the same goal. So if you are looking for a crypto related jobs you might be a target here.

[Myleschetty]

SlowMist points out that this Safari attack reused the previously disclosed DarkSword exploit chain technique and is independent of another FomoPeek investigation involving malicious components embedded in App Store apps. Google Threat Intelligence (GTIG) disclosed DarkSword in March, stating that it is an iOS exploit chain used by multiple threat actors since November 2025.
SlowMist stated that its investigation has not yet linked the recent iPhone Safari attacks that triggered security warnings to confirmed cryptocurrency thefts. SlowMist told Cointelegraph that it has not independently confirmed any victims harmed by the specific Safari attack samples it analyzed, and its strongest technical evidence covers iOS versions 18.4 to 18.6.2. The company stated that the widely circulated claim of affecting iOS 13 to 26.5 should be considered a preliminary assessment, and it prefers to avoid claiming that iOS 26.5 is affected until reproducible technical evidence is available.

https://cointelegraph.com/news/no-confirmed-crypto-theft-iphone-safari-attack-slowmist

[JeromeTash]

According to this warning, North Korean hackers are targeting us with this kind of attacks,

The North Korean "WaterPlum" cyber actor group (commonly referred to as “Contagious Interview”) conducts cyberattacks by infiltrating unsuspecting job seekers’ computer networks, harvesting sensitive information, and stealing cryptocurrency. WaterPlum is victimizing individual IT professionals in Japan, the United States, Europe, and other countries.

So any form of cyber attack now originates from North Korea?
Someone please help me understand how people come up with such conclusions.
Is it a case of North Korea being a country full of the deadliest hackers around the world, or are their hackers just too stupid that hey cannot even cover their tracks, like, for example, mask their IP addresses?

[SatsPH]

According to this warning, North Korean hackers are targeting us with this kind of attacks,

The North Korean "WaterPlum" cyber actor group (commonly referred to as “Contagious Interview”) conducts cyberattacks by infiltrating unsuspecting job seekers’ computer networks, harvesting sensitive information, and stealing cryptocurrency. WaterPlum is victimizing individual IT professionals in Japan, the United States, Europe, and other countries.

So any form of cyber attack now originates from North Korea?
Someone please help me understand how people come up with such conclusions.
Is it a case of North Korea being a country full of the deadliest hackers around the world, or are their hackers just too stupid that hey cannot even cover their tracks, like, for example, mask their IP addresses?

I don't know if you have heard about the recent Bybit hack, but the exchange said they suspect that North Korea is behind.

Or maybe you can read the reports here, I'm not the one accusing them, and it has been in crypto space for many years. The big difference here is that the Lazarus group is state sponsored so they are sophisticated, but one mistake might reveal their true identity:

https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/

North Korean hackers stole $2.02 billion in cryptocurrency in 2025, a 51% year-over-year increase, pushing their all-time total to $6.75 billion despite fewer attacks.
The DPRK is achieving larger thefts with fewer incidents, often by embedding IT workers inside crypto services or using sophisticated impersonation tactics targeting executives.
The DPRK shows clear preferences for Chinese-language money laundering services, bridge services, and mixing protocols, with a 45-day laundering cycle following major thefts.
Individual wallet compromises surged to 158,000 incidents affecting 80,000 unique victims in 2025, though total value stolen ($713M) decreased from 2024.
Despite increased Total Value Locked in DeFi, hack losses remained suppressed in 2024-2025, suggesting improved security practices are making a meaningful difference.

Or maybe this article might answer your question as how the investigators track it to North Korea:

https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit

Almost immediately following the ByBit hack, TRM identified and tagged the compromised addresses as “Hacked” or “Stolen Funds” and established a dedicated tracking entity labeled "Bybit Exploiter Feb 2025" to monitor the movement of the stolen assets in real time.

Through blockchain intelligence, TRM Labs confirmed that North Korean hackers were responsible for the breach, linking it to previous state-sponsored crypto heists. The evidence revealed clear overlaps between the wallets used in this operation and those associated with past North Korean thefts. On February 26, 2025, the FBI officially linked the heist to North Korea.

[NotATether]

So any form of cyber attack now originates from North Korea?
Someone please help me understand how people come up with such conclusions.
Is it a case of North Korea being a country full of the deadliest hackers around the world, or are their hackers just too stupid that hey cannot even cover their tracks, like, for example, mask their IP addresses?

Obviously not, and that is a lazy reference. But we have to acknowledge that they are behind some of the most sophisticated attacks like the one on Bitget recently. They tricked them into signing a malicious contract that appeared to be real.

So they need to start using their funds, these exchanges, to bolster their contract security auditing instead of just blindly creating bounties for returning stolen funds.

[NotATether]

This guy is walking around the street dressed like a clown, trying to get people to scan the QR code for his drainer.

https://x.com/i/status/2103966377514353048

[LoyceV]

This guy is walking around the street dressed like a clown, trying to get people to scan the QR code for his drainer.

How is that supposed to work?

a 100 USDC QR code. It drains your wallet.

I'm pretty sure my wallet doesn't empty itself when I scan a QR-code. If there are wallets out there that do that, those wallets are the problem, not this guy.

[Sticky Bomb]

I'll leave this here for traders who like to get in early, scammers are now getting ahead of you. Be careful!!

Scammers are really getting better at exploiting people's expectations, those who thought they got in early in GIWA mainnet allegedly bridged real ETH to scammers in the fake network, We've got to really be sure of whatever we're doing in crypto and not blindly trusting because it was listed on popular platforms.

Here’s what happened with the GIWA situation:

Scammers basically created a fake version of Upbit’s upcoming GIWA chain, along with a fake RPC and bridge

DyorSwap listed the fake network without properly verifying it, which made people believe GIWA mainnet was actually live

Users then bridged real ETH over thinking they were getting in early, but the ETH was actually being sent to attacker controlled contracts and eventually drained

Over 766 ETH (worth roughly $2M) was sent through the fake bridge

GIWA has confirmed their mainnet is NOT live and none of their official contracts were exploited

This wasn’t really a hack. Scammers created an entire fake chain and bridge, got it listed on a DEX and convinced people it was legit

https://x.com/zubic_eth/status/2104181414799560887

[NotATether]

So... what are these hardware wallet companies going to do to secure their supply chain?

I feel like these attacks just happened and were then forgotten like a few days later, which is really bad.


So basically, as you can see, a major European reseller of Ledger hardware wallets was found to be shipping tampered hardware wallets and had to pull all of them from their shelves. Similar to the one from Cryptobilis.

Europe’s Biggest Electronics Retailer Pulled Ledger From Its Shelves, and the Former Mt. Gox CEO Says His Wallet Had a Spy Chip Too.

MediaMarktSaturn, parent company of the European electronics retailer MediaMarkt, has removed Ledger hardware wallets from its stores and websites as tampering reports spread beyond Southeast Asia, according to CoinGecko. Ledger produces hardware wallets, which are small offline devices that securely store the secret keys needed to control cryptocurrencies like Bitcoin. MediaMarkt is the first major European retailer to take this action.

This decision followed a user on X who claimed that two Ledger wallets he bought at different MediaMarkt locations included unauthorized cables and cellular modules. Additionally, Mark Karpeles, former CEO of the now-defunct crypto exchange Mt. Gox, said his Ledger Flex, bought at Singapore’s Changi Airport, also had a spy chip embedded in it.

[DireWolfM14]

Or is this the end of HW wallets?

I doubt it's the end of hardware wallets, but it be a turning point.  Manufacturers will have to expand their delivery capabilities and ship directly to the end user, or risk these types of attacks.  I suspect the public will respond by not buying from resellers any longer (or at least I hope that will happen).

My prediction is that hardware wallet manufacturers will start marketing products that mimic the DIY hardware wallets in form and function.  In other words; all open source hardware and firmware, no secure elements, no persistent memory, no seeds stored on the wallet, encrypted seed entry, and random encryption to access the seed for signing transactions on a session to session basis.

[Comeacross]

While this is not completely new technology, it's not much being talk about but it is scary. I just read this report that Israeli spyware firms have developed a way to hack into phones without you clicking a link, downloading anything, or even knowing you’ve been targeted. All it takes is browsing a website or encountering an online ad for your device to be exposed to an attack capable of accessing your private messages, passwords, documents, microphone and camera. How Israeli firm’s ‘zero-click’ malware attack poses global security risk

We always advise ourselves about clicking suspicious links but this zero click means that practice is not longer enough to keep us safe.

Please, Keep your crypto offline as much as possible. Do not ever store your seed phrase in your phone in any form. (screenshot, notes, drive/cloud, email etc).

If you can afford it, use a separate device for your crypto activities. You should never use that device for random browsing. If you have a significant amount of coins, please consider using Hardware wallet.

Most of us store too much sensitive data on our devices. Although, this attack was thought to be targeting politicians and journalists but the tech has trickled down and any exploit that exists will eventually be used by regular scammers too so we should take precautions.