PSA: Another phishing spree has hit crypto — ignore all emails about airdrops

They say money never sleeps. In crypto, that means the phishers, fraudsters and other cyberbaddies are also always working


Shutterstock/Kari_Caverdos modified by Blockworks


The recent spate of cyberattacks on crypto projects continued Tuesday morning, with a number of teams urging users not to interact with malicious emails sent from official accounts.

Data provider Token Terminal, decentralized finance superapp De.Fi, authentication protocol WalletConnect and crypto media outlet Cointelegraph have all sent warnings about their respective incidents.

“Unauthorized airdrop email sent from Token Terminal — do not connect wallets,” Token Terminal told users in an email about 40 minutes after the illegitimate one.

“We are currently investigating a phishing attack involving an unauthorized email sent from us, directing recipients to an unverified site. This email was not authorized by us and may pose a risk to your security.”

Token Terminal and the other three known affected teams then told users not to click on any links in emails that “look suspicious or unexpected.”

The unofficial email promised users access to an early access airdrop for a purported new cryptocurrency tied to the platform.

“I hope this email finds you well! We’re thrilled to share some exciting news that will surely pique your interest. As a valued member of our community, we wanted to personally inform you about the upcoming TokenTerminal Beta Access Airdrop!”

“We’re on the verge of unveiling the beta version of TokenTerminal, and we want you to be among the first to explore its innovative features and capabilities. To express our gratitude for your continued support, we’ve decided to celebrate this milestone with a special airdrop exclusively for our community members.”

Loading Tweet..

A button underneath directed recipients to claim the airdrop by linking their crypto wallets. Instead of receiving an airdrop, the wallets would instead be drained and sent to the attacker. A similar email was sent to WalletConnect users.

Web3 cybersecurity unit Blockaid, which has been working with affected teams, told Blockworks that in the case of WalletConnect, the perpetrators had used the same wallet draining code utilized in the Ledger Connect Kit phishing spree in December.

Read more: ‘Wallet drainer’ code added to Ledger library has crypto on edge

Blockaid later confirmed the attacker had exploited a vulnerability in third-party email service provider Mailer Lite to carry out the phishing campaign.

It could be that other projects’ emails were successfully hijacked. So for now, it’s best to ignore any and all emails referencing token airdrops (and never connect your wallet to any protocol or service that you have not thoroughly vetted yourself!).

Updated Jan. 24, 2024 at 4:54 am ET: Added context about Mailer Lite.

Updated Jan. 23, 2024 at 9:07 am ET: Added reference to fourth victim Cointelegraph.

Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the On the Margin newsletter.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.


Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2024

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research



Aerodrome is a "MetaDEX" that combines elements of various DEX primitives such as Uniswap V2 and V3, Curve, Convex, and Votium. Since its launch on Base, it has become the largest protocol by TVL with more than $495B in value locked, doubling Uniswap's Base deployment.


The former Valkyrie CEO chats with Blockworks about what she has her eye on as Cypherpunk Holdings’ new leader


Thursday’s CPI report shows prices are coming down more quickly than analysts had anticipated, renewing hope that central bankers will cut rates in the fall


If we tokenize all assets in a speculative rush, the risk of creating illiquid markets and trapped value will manifest on a large scale


Plus, Trump is headed to the heart of Bitcoinlandia with a speaking appearance at the Bitcoin 2024 conference


Meanwhile, stocks rally after Jerome Powell finishes his Capitol Hill tour


Plus, Blinks have reshaped many people’s understanding of what blockchains are capable of