Kate Irwin

This is a segment from The Drop newsletter. To read full editions, <a href="https://blockworks.co/newsletter/thedrop" target="_blank" rel="noreferrer noopener">subscribe</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



A security flaw on CoinMarketCap’s website let an attacker briefly add a malicious pop-up onto the homepage that resulted in victims losing thousands of dollars.



The MetaMask team <a href="https://x.com/MetaMask/status/1936185313640300659">warned</a> users on Friday evening against connecting their wallets to CoinMarketCap’s website because the coin tracker’s frontend had been compromised to push a wallet drainer scam.



About an hour later, CoinMarketCap <a href="https://x.com/CoinMarketCap/status/1936197663931933117">confirmed</a> that visitors to its site should not connect their wallets when prompted.



Later that evening, CMC <a href="https://x.com/CoinMarketCap/status/1936273633611334081">explained</a> that a vulnerability in a “doodle image” on its homepage “contained a link that triggered malicious code through an API call, resulting in an unexpected pop-up for some users.”



Crypto cybersecurity firm Coinspect Security <a href="https://x.com/coinspect/status/1936231159320453579">said</a> it was able to recreate the JavaScript injection vulnerability that facilitated the CMC wallet drainer attack via an exploit in Lottie animation JSON files.



Three cybersecurity experts from other firms separately confirmed to me over the weekend that Coinspect’s assessment of the incident is accurate.



Trey Blalock, founder of cybersecurity firm Verification Labs, told me he was able to retrieve copies of CoinMarketCap’s source code using the Internet Archive’s Wayback Machine to examine the incident.



<figure class="wp-block-image"><img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdAgKFlMDIIQuCDXQw3YHtrLC8YNNFMz2gT3K9_EJZ_DSl9pLsvGPN0dQWQ2UjLFwqyymd4Qk-tG985FUw9voxCkypCSqgl2d_PUyx3bDmsTcahzcvr0D5zzFIZl4VRYgw-uUajHw?key=qdzbrQ-ATNfVznfGkYRHWA" alt=""/><figcaption class="wp-element-caption">Image of the malicious pop-up on CoinMarketCap’s site.</figcaption></figure>



“What is immediately noticeable is the heavy use of Scalable Vector Graphic (.SVG) images,” Blalock said of CMC’s site. “SVG is an excellent format for creating performant websites that look great across various display sizes, but recent security vulnerabilities have allowed attackers to embed HTML script tags inside SVG images that contain URLs to an attacker-controlled website, enabling them to execute a form of cross-site scripting.”



What can CMC and other sites do to avoid attacks like this in the future?



Blalock said companies should use security tools that test site elements and look for scripts within SVG files.&nbsp;



“This is relatively easy to do, but it is rarely done,” he said.



C/Side Security Analyst Himanshu Anand also noted that sites need to vet all third-party integrations more carefully.



“They should monitor client-side activity continuously to detect and alert on unusual behaviors like DOM (JavaScript) injections,” Anand said, adding: “Platforms should treat every external asset as a potential entry point for malicious code. Real protection means watching what actually runs in the browser, not just what’s served from your own systems.”



Nic Adams, CEO and cofounder at cybersecurity firm 0rcus, said eliminating all third-party JSON dependencies is another security strategy.



“Browser-in-the-browser style phishing has changed: Bad actors can embed interactive brand-perfect overlays that trick users into approving malicious transactions,” Adams said in a message.



CMC said late Friday night that it had fixed the issue, and vowed to keep its support team available to anyone with concerns.



On Monday, CMC <a href="https://x.com/CoinMarketCap/status/1937094379304374302">said</a> it will reimburse all 76 accounts that lost funds as a result of the attack, and said that $21,624.47 was lost in total.



But that’s not all — Cointelegraph also experienced a similar incident over the weekend on Saturday. Attackers <a href="https://x.com/blockaid_/status/1936976381490995403">used</a> the crypto news site’s frontend to inject a malicious phishing pop-up for a fake airdrop.



Cointelegraph <a href="https://x.com/Cointelegraph/status/1937077253373866301">said</a> early Monday morning its banner publishing system had been compromised, but it has since removed the unauthorized code. We don’t yet know how many might have been impacted by this incident.&nbsp;



Binance CEO CZ <a href="https://x.com/cz_binance/status/1936991040420110834">warned</a>: “Hackers are targeting information web sites now. Be careful when authorizing wallet connect.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

CoinMarketCap

76 wallets drained in CoinMarketCap frontend exploit

Casey Wagner

The IRS is looking to up its game in terms of ensuring crypto tax compliance, and it wants the industry’s help.&nbsp;



The IRS’s Digital Asset Initiative Project Office (DAIPO) issued a Source Sought Notice last month asking “industry partners and other parties” to send in solution and product ideas to help the agency improve its pricing and market data capabilities. A Source Sought Notice is issued by a government agency when they are seeking potential sources for collaboration and information.



“We are primarily interested in solutions which can provide efficiencies to aid in compliance efforts to include, but not limited to, identifying digital asset transactions and transaction patterns, bulk data analysis, computing tax consequences of digital asset activity and assessing and analyzing digital asset transactions,” the IRS said in its <a href="https://sam.gov/opp/f553a50991d7437cb4b5369bc18fce7e/view">request</a>. 



Currently, the IRS uses “various public sources” for finding digital asset prices, including CoinMarketCap and Investing.com, the agency said. The IRS is looking for additional pricing data vendors who are able to provide pricing data by the hour, minute and second.&nbsp;



The IRS also wants help with how to process and analyze blockchain data and help with asset gain and loss computations. Blockworks requested comment but did not receive a reply.



The request for information is part of an agency-wide <a href="https://aboutbtax.com/7o7">initiative</a> announced in April to ramp up its detection of compliance violations when it comes to complex assets such as crypto. 



“For issues known to have high, ongoing risks of noncompliance or complexity, such as digital assets and listed transactions, we will prioritize resources to increase enforcement activities, including criminal investigation as appropriate,” the IRS wrote in the April report, which was mandated as part of the Inflation Reduction Act.&nbsp;



The Source Sought Notice also comes as tax experts and investors <a href="https://blockworks.co/news/tax-experts-best-practices-irs" target="_blank" rel="noreferrer noopener">continue to wait for new guidance from the IRS and the Treasury</a> on changes in how digital assets may be taxed. The crypto industry is specifically looking out for the new Form 6045, which will include an updated definition of “broker,” potentially having a major impact on what firms and individuals are expected to report. 



The IRS and Treasury have promised changes are coming, as Congress mandated more than 18 months ago, but have not provided any updates on the timeline or expected release date.&nbsp;



Industry members and potential vendors who respond to the IRS’ request for information may be invited to participate in a series of virtual meetings between July 19 and August 4, the agency said. The deadline to submit responses is July 12.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

The IRS uses CoinMarketCap, and it’s asking the industry for other ideas

Jon Rice

CoinDesk, a leading crypto news and events company and a core component of the Digital Currency Group (DCG) empire, has been an acquisition target for Binance Capital Management (BCM) in recent weeks, according to sources with direct knowledge of the matter.&nbsp;



BCM, registered in the British Virgin Islands, has been exploring ways to buy the company through its CoinMarketCap subsidiary, a Delaware corporation. Those talks are said to be on hold at the moment.



CEO Kevin Worth confirmed that the outlet was for sale in January, although it was widely-known that DCG was shopping CoinDesk after the parent company’s well-documented travails with Genesis and its lending arm, which <a href="https://blockworks.co/news/genesis-in-chapter-11-wont-insulate-silbert-winklevoss-says">sought bankruptcy protection</a> earlier this year.



Worth told CNBC in January that the outlet had received “numerous inbound indications of interest” and that the company had contracted with Lazard, a financial advisory firm, “to explore various options to attract growth capital to the CoinDesk business.”



Early estimates of CoinDesk’s market value ranged as high as $300 million, although the actual acquisition price is expected to be significantly lower, according to another source, who pegged the value of the potential deal at closer to $75 million. Sources for this story were granted anonymity to discuss sensitive information.



Barry Silbert’s DCG acquired the company in 2016, some three years after its launch, for around $500,000. It grew to become a leader in crypto news and events, culminating in the news recently that two of its journalists, Ian Allison and Tracy Wang, had received a prestigious George Polk Award for their financial reporting.



CoinDesk’s story on the Alameda balance sheet that exposed frailties in FTX’s financial position has been widely-acknowledged as the first domino in the collapse of Sam Bankman-Fried’s empire.



One source told Blockworks last month that initial talks between CoinDesk and Binance broke down, as the exchange anticipated a mass exodus of journalists from the news company if it became the majority owner.



A different source explained that Binance had considered an acquisition through a blind trust, but that talks had “moved past” this notion over the last two weeks. However, they said, talks were resuscitated by Binance Capital Management, with the focus on using CoinMarketCap as the acquisition vehicle. Those talks were described by the source as “on the backburner” over the last week, a characterization confirmed by a second source.



According to one source, Binance considers CoinDesk a “significant force for good” in the cryptocurrency industry, but they noted that an investment in the company would be primarily driven by the fear that other investors might not step in to save the news outlet.



They suggested that an acquisition of CoinDesk by Binance itself would have a “fairly minimal” likelihood of completion, due to three factors: It might be a drag on revenue, it could involve significant oversight, and it may require further injections of cash over time.



CoinDesk CEO Kevin Worth told Blockworks &#8220;No decisions have been made about a sale of CoinDesk or other options we are exploring to attract growth capital to the business. This is an ongoing process and there is no set timeline.&#8221;



BCM acquired CoinMarketCap, the world’s most-visited crypto data aggregation website with almost 100 million visits per month according to SimilarWeb, in April 2020. On its website, CoinMarketCap claims that “There is no ownership relationship between CoinMarketCap and Binance.com” and that “CoinMarketCap and Binance are separate entities that maintain a strict policy of independence from one another.”



A source within a Binance subsidiary told Blockworks earlier this year that the exchange was interested in acquiring media properties, but was wary that their neutrality might come into question as a result of the exchange’s potential ownership. This was confirmed by a second source, who suggested that crypto-native publications did not make obvious targets.



Binance previously <a href="https://blockworks.co/news/what-does-binances-investment-in-twitter-mean-for-the-social-networks-future">invested in Twitter</a>, but a proposed $200 million investment in Forbes did not <a href="https://www.forbes.com/sites/forbespr/2022/02/10/forbes-announces-200-million-strategic-investment-from-binance/?sh=6542af0d57e2">proceed</a> when the SPAC was canceled.



The crypto media landscape continues to evolve rapidly as the bear market persists. The Block recently <a href="https://blockworks.co/news/the-block-lays-off-27">laid off 27 employees</a> following the disclosure of $27 million in secret loans made by Sam Bankman-Fried to former CEO Mike McCaffrey, who resigned after they became public.



Updated March 13 at 7:33pm ET: Comment added from CoinDesk&#8217;s Kevin Worth.

CoinMarketCap

Newsletter

Blockworks Research