Scam Alert: phishing email targets Passport owners.

[satscraper]

Attention!

Scammers are taking advantage of the Coldcard drama, sending fake emails claiming to be from Foundation Devices. These emails reference the recent Coldcard security incident and push the fake "Enhanced Entropy Protocol V2.4" for Passport users. They use urgency wording  along with Download Entropy Protocol link to deliver malware or lead you into the fake verification flow.

Foundation officials have warned that this is a scam.

[Zaguru12]

This phishing mails as actually expected, phishing attackers will now target most users who they have their details and ask of private keys or seed phrases to help protect more their assets. This information shouldn’t be limited to passport wallet users only, I expect both software and hardware wallet users getting this emails soon.

Other phishing attempts we will see in this period will be the similar emails like the one Coldcard themselves are sending now with the attackers probably going to be asking for little fees to help get the victims bitcoins back.

Or we see waves of emails asking people to drop their keys or phrases for giveaways for victims of coldcard hack. This attacks looks old but I am sue it will still get some people.

WARNING

If you’re sacred of your current wallet maybe because it’s closed source simply sweep the keys to another wallet. Don’t share your recovery seeds or keys

[Upgrade00]

This is typical scammer operation when there is a big lose case as this. Those who posted publicly that they were victims are most at risk cause they'll be getting tons of those messages and could mistakenly click on a malicious link.

I would expect experienced holders to be able to easily avoid such scam attempts and not even have their emails publicly available for targeting, but newbies could fall victim.

[BitMaxz]

It looks like they are likely squeezing most of the ColdCard users and attracting more users to a phishing site. They take advantage of what is trending nowadays because most of the traffic comes from the "coldcard" keyword.
For us, we can't easily fall into this trap, but for newbies who use Coldcard, they might fall for this.
I hope most of the newbies here verify the source first, or I think it's better to ignore all related Coldcard emails because it is currently a hot topic nowadays.

[PX-Z]

They are really wasting no time, everytime there is an incident like this where people (victims) are desperately trying to find ways to recover the lost funds which make them very vulnerable target if they randomly receive such email announcement. That's why knowledge/updates is very helpful to avoid such thing to happen.

[satscraper]

This story shows scammers know their oats. Particularly, it evidences that they know the Foundation "ported over numerous open source files from Coldcard's repo" when developing their old Passport model, and they counted on Passport owners knowing this too, and that some of them would swallow the hook. That is why scammers narrowed their target niche in this case.

[Meuserna]

This story shows scammers know their oats. Particularly, it evidences that they know the Foundation "ported over numerous open source files from Coldcard's repo" when developing their old Passport model, and they counted on Passport owners knowing this too, and that some of them would swallow the hook. That is why scammers narrowed their target niche in this case.

I'm impressed that the Foundation folks aren't gloating. They'd have every right to, but instead, they seem to be reacting to this catastrophe with class.

And you're right, scammers are trying to capitalize on this in any way they can, which is just awful.

I wish there was a better way to help people avoid scams. Sadly, all we can do is keep warning them.

[Lucius]

~snip~
I'm impressed that the Foundation folks aren't gloating. They'd have every right to, but instead, they seem to be reacting to this catastrophe with class.

There is nothing humane in mocking someone else's misfortune, because we don't know what the future holds for us regardless of how we created our seed and what device we use. I would be glad if the majority of CC users used any additional option to protect their seed, but all those who didn't do that obviously didn't understand the risks that were in front of them.

However, I read that the attack is now continuing on seeds that are protected with passphrase, and that one such wallet has already been emptied - although the two words from the dictionary (I assume) are not any protection, but only a small obstacle for most hackers.

[satscraper]

~snip~
I'm impressed that the Foundation folks aren't gloating. They'd have every right to, but instead, they seem to be reacting to this catastrophe with class.

There is nothing humane in mocking someone else's misfortune, because we don't know what the future holds for us regardless of how we created our seed and what device we use. I would be glad if the majority of CC users used any additional option to protect their seed, but all those who didn't do that obviously didn't understand the risks that were in front of them.

However, I read that the attack is now continuing on seeds that are protected with passphrase, and that one such wallet has already been emptied - although the two words from the dictionary (I assume) are not any protection, but only a small obstacle for most hackers.

Yeah, if someone decides to add extra protection to their wallet using a passphrase that extends the seed phrase, that extension should definitely not consist of dictionary words and should have sufficient entropy. That said, better protection would still be a multisig wallet with the quorum of cosigners that can be adjusted to the level of security one actually needs.