Katherine Ross

Google filed a complaint against a group of alleged scammers on Thursday.



The complaint, filed in the Southern District of New York, claims that the accused “conducted their version of the Fraud Scheme by socially engineering and conning victims into ‘investing’ in apps, available on Google Play and through other means, that purported to be cryptocurrency exchanges and other investment platforms.”



“Keeping people safe online is core to our business and we will not tolerate the misuse of our platforms to facilitate cryptocurrency scams. This litigation is a critical step in holding these bad actors accountable and sending a clear message that we will aggressively pursue those who seek to take advantage of our users,” Halimah DeLaine Prado, Google general counsel, told Blockworks in an email.



The complaint names Yunfeng Sun and Hongnam Cheung as well as their aliases Alphonse Sun, Zhang Hongnim and Stanford Fischer.&nbsp;



“Defendants created fraudulent apps that purported to be legitimate cryptocurrency exchanges and investment platforms, and made them available on Google Play,” Google said.&nbsp;



Read more: <a href="https://blockworks.co/news/crypto-fraud-financial-scam">All fraud will eventually be ‘crypto fraud.’ And that’s okay.</a>



Sun and Chueng also made “multiple misrepresentations to <a href="https://blockworks.co/tag/google">Google</a> in order to upload their fraudulent apps to Google Play, including but not limited to, misrepresentations about their identity, location and the type and nature of the application being uploaded.”



The defendants would allegedly exchange texts with victims in an attempt to “persuade the victims to download and invest through one of their apps.” They also created marketing campaigns and videos.&nbsp;



However, the complaint claims that customers who made deposits on the apps couldn’t withdraw their funds. They then faced higher withdrawal fees to access funds, which would still not allow the victims to access their deposits.&nbsp;



Read more: <a href="https://blockworks.co/news/google-adds-ens-to-search">Google quietly added ENS to Search</a>



Google said that 87 apps have been linked to the scheme.



According to the suit, “Google records indicate that at least approximately 100,000 users have downloaded the Fraudulent Apps, including at least approximately 8,700 in the United States.”



It’s not clear, based on the complaint, how much money has been lost to the alleged fraud but Google says that the financial losses have been “substantial.”



The company seeks a permanent injunction to bar the defendants from accessing or using Google services and products, and&nbsp; “creating or maintaining” Google accounts. Google also wants the defendants to pay attorney fees and “reasonable costs.”



CNBC first <a href="https://www.cnbc.com/2024/04/04/google-sues-crypto-scammers-allegedly-uploading-fake-apps-android-app-store.html">reported</a> the lawsuit. 



Updated April 4, 2024 at 10:31 am ET: Added comment from Google.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Google files lawsuit against alleged crypto scammers 

Michael McSweeney

X, formerly Twitter, has a deepfake problem, one that I believe could — and, frankly, should — end its role as the premier social platform for the crypto industry.



Scrolling through the endless chaos of X, it doesn’t take long to come across a video, usually starring a stilted Michael Saylor or Brad Garlinghouse, promising me access to a crypto airdrop. Solana co-founder Anatoly Yakovenko’s likeness has <a href="https://www.theverge.com/2024/1/3/24024262/youtube-twitter-x-crypto-solana-deepfake-scam">also been used</a>.&nbsp;



These videos are, of course, scams, putting a new and decidedly worrisome technology spin on an old problem —&nbsp;similar to the ever-prevailing threat of <a href="https://blockworks.co/news/crypto-phishing-attacks">crypto phishing attacks</a>.&nbsp;



The videos employ AI-generated voice recordings and what appear to be added lip animations to present “opportunities” to would-be crypto holders.&nbsp;



These “major announcements” share a common call to action: Scan a QR code or follow a link to receive “money.” Obviously, I didn’t click or scan by way through, but the implications are clear for anyone who has encountered the dangers of the modern internet. Interaction means security exposure, and exposure means the potential for stolen digital assets, personal information or more.&nbsp;



One account, live as of the time of writing, had scored 276,000 views for a Saylor deepfake and 139,000 views for a Garlinghouse deepfake. 



Read more from our opinion section: <a href="https://blockworks.co/news/farcaster-just-might-be-the-new-crypto-twitter">Farcaster just might be the new Crypto Twitter</a>



The fact that these posts are often tagged as advertisements —&nbsp;thereby offering them the veneer of legitimacy —&nbsp;is deeply problematic. Far worse is the reality that X is making money off the problem rather than making any kind of visible effort to confront them.



It wasn’t that long ago that X owner Elon Musk pledged to solve the spam bot problem. The reality seems to be that we’ve traded scam accounts that pretend to be Musk for scam accounts that act like crypto industry leaders — in both cases, enticing would-be victims with giveaways.



This is all playing out against the backdrop of <a href="https://www.theinformation.com/articles/musks-x-is-flooded-with-ad-spam-stolen-credit-cards-may-be-key">a wave of other types of spam advertisements</a>, as The Information detailed earlier this month. The result — fueled by an exodus of major advertisers that has slowly played out since Musk took over the now-former Twitter — is a minefield of questionable products, porn bots and these deep fake videos.



It’s a disaster. The situation further muddies the water of a platform that has, for many years, served as a central hub for inter-industry relations. And, if recent technology developments hold true, the problem will likely become worse over time.&nbsp;



News from Sam Altman’s OpenAI that the company has developed a text-to-video product may put additional tools in the hands of would-be scammers. To be sure, OpenAI appears to be taking an at least publicly cautious approach to allowing access to this tool, in what is doubtless an acknowledgement of the inherent risks. But AI-generated video tools will inevitably become widespread — opening the door to more sophisticated deep fakes like the crypto ones popping up today.



Where to from here? Should alternative social media platforms be embraced? Do crypto-enabled platforms and protocols like Lens or Farcaster hold the key to a social media without these scam videos?



I don’t know. I believe the industry should become louder about this issue — if, for nothing else, to perhaps prompt a response from X and Musk. Remember, the Musk bot issue did go away, but by all appearances the fundamental problem —&nbsp;fake accounts masquerading as sources of authority — has metastasized.&nbsp;



This situation places an industry long dogged by its worst impulses in close proximity with a dangerous collision of technology and exploitation. The crypto industry would be wise to confront it head-on.&nbsp;



<hr class="wp-block-separator has-alpha-channel-opacity"/>


<div class="wp-block-post-author-biography">Michael McSweeney has worked in crypto media since 2014, including editorships at CoinDesk and The Block. In his spare time, he writes fiction and plays disc golf. Contact Michael at michael.mcsweeney@blockworks.co.</div>


<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Crypto deepfakes prove that X is failing as an industry platform

David Canellis

They say a hallmark of a mania is the rapid rise in the rate of fraud.&nbsp;



The exact same can be said of crypto adoption. In fact, fraud is inevitable.



Normie media is ablaze with the latest in crypto-tinged true crime. An online pastor in Colorado dumped a worthless token on his flock, screwing them out of millions of dollars because “God told him to.”



It’s the sort of Schadenfreude that just rolls off the tongue to coalesce as viral internet traffic. Hence the rush from dozens of outlets in all different languages to run with their own quirky headlines, <a href="https://www.washingtonpost.com/nation/2024/01/23/crypto-pastor-colorado-god-eli-regalado/">including</a> the Washington Post.



But this sad tale is not a crypto story. It’s a simple fraud story posing as commentary about crypto.



Separating the concept of fraud from crypto will come easy through mass adoption. Like the hyperbitcoinization that will price the whole world in disgustingly expensive satoshis after price discovery goes parabolic, mass adoption of crypto more broadly would encrypt our entire modern consciousness on blockchain rails.



Your passport metadata would exist on a blockchain. As would your presidential vote. Bank deposits are tokenized and lent out to the highest bidder. Your smart fridge feeds directly from a supermarket price oracle that tells it when your favorite kombucha is on special and orders it for you right away — with all payments settled in crypto.



Read more from our opinion section: <a href="https://blockworks.co/news/crypto-phishing-attacks">Crypto phishing attacks are everywhere. It might not get better anytime soon&nbsp;</a>



At this point, blockchain would thrum beneath every facet of our lives. The jury is still out on whether all that is even beneficial. Still, if everything ran on crypto, then the self-styled Colorado holyman dumping a useless crypto on his followers would be a run-of-the-mill affinity scam and nothing more. Other than really boring.



Over a long enough period, all fraud stories become crypto stories, on account that a stupidly high percentage of fraud would interact with crypto and blockchain if everything in our world does too.



The same effect will happen to business writ large — give this industry enough time and all companies will be “crypto companies.”&nbsp;



Think PayPal, Square, Visa, Mastercard, Western Union, Starbucks and eBay.&nbsp; All those companies are already interacting with crypto and blockchain in some way. At the very least, they’re crypto curious.



Crypto-related stuff makes up only a small fraction of those companies overall. Although, one could reasonably argue their initiatives are enough even now to consider them competitors to crypto-native companies like Circle, OpenSea, Yuga Labs and Trust Wallet.



Some anticipate great technological leaps forward by porting our lives to the blockchain, some of which may even stamp out certain kinds of fraud altogether (scan your eyeballs with the <a href="https://blockworks.co/news/worldcoin-eyeballs-scan-brooklyn">Worldcoin Orb</a> to combat identity theft, for instance).&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Colorado pastor charged for cryptocurrency scam he says he perpetrated at God&#39;s command January 18, 2024<a href="https://t.co/jLVpmMYKw2">https://t.co/jLVpmMYKw2</a> <a href="https://t.co/tb6jfhV2up">pic.twitter.com/tb6jfhV2up</a>&mdash; web3 is going just great (@web3isgreat) <a href="https://twitter.com/web3isgreat/status/1748902654565056641?ref_src=twsrc%5Etfw">January 21, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div><figcaption class="wp-element-caption">Molly White infamously catalogs fraud stories like these</figcaption></figure>



More fundamental to this thought experiment is this: Of course crypto fraud will be more common over time. Crypto is money and money is valuable, and people do all sorts of stupid and malicious things for stuff that’s valuable.



In a crypto-powered future, a story about two fraudsters <a href="https://www.nytimes.com/2023/12/16/nyregion/wine-ponzi-scheme-charges.html">bilking</a> $99 million from wine investors in a Ponzi scheme — despite having no bottles of wine at all — might include details like “the perpetrators raised the funds in various cryptocurrencies including bitcoin, ether and tether.”&nbsp;



That wouldn’t at all make the case a matter of crypto crime because everybody uses bitcoin, ether and tether all the time. For everything.



Same goes for a phony Indian cricket league on YouTube that <a href="https://www.nytimes.com/2022/07/12/world/asia/fake-indian-cricket-league-russia.html">cheated</a> Russian gamblers with fake matches. Mass adoption would mean all bets would be paid in crypto — just like your grocery bill. The crypto element wouldn’t even raise eyebrows, let alone go viral.



As crypto becomes more ubiquitous, stories like these will only become more frequent. A “crypto crime” is a crime that takes advantage of something unique about the underlying technology, whether it’s raiding a token bridge or raiding a protocol through a flash loan attack.



A crime that uses cryptocurrency instead of dollars, rupees or euros is not a crypto crime. It’s just a crime.



All told, this is where we are on the adoption scale: A cheesy online pastor selling a worthless cryptocurrency sounds about right. But it’s still a novelty.



The novelty is very close to wearing off for everyone except those 45 years or older, which, as it turns out, makes up 40% of the Washington Post audience, according to <a href="https://www.similarweb.com/website/washingtonpost.com/#demographics">Similarweb</a>. Go figure.



<hr class="wp-block-separator has-alpha-channel-opacity"/>


<div class="wp-block-post-author-biography">David is an Editor based in the Netherlands focused on data-driven journalism. Previously, he wrote for TheNextWeb&#8217;s crypto vertical before launching Protos in 2021. He&#8217;s a reformed hardline Bitcoiner passionate about permissionless and decentralized networks. Contact David at david@blockworks.co</div>


<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

All fraud will eventually be ‘crypto fraud.’ And that’s okay.

Today’s attack on crypto hardware firm Ledger was traced to an ex-employee who “fell victim to a phishing attack that gained access to their NPMJS account” in an email to Blockworks.



The code was then published to ConnectKit. A fix, according to Ledger, was deployed roughly 40 minutes after they were alerted but not before the malicious code was active for five hours.



The address was connected to a malicious code found in Ledger’s ConnectKit software libraries early Thursday. ConnectKit connects blockchain apps with Ledger devices.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">FINAL TIMELINE AND UPDATE TO CUSTOMERS: 4:49pm CET: Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again. The investigation continues, here is the timeline of what we know about…&mdash; Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735326240658100414?ref_src=twsrc%5Etfw">December 14, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



WalletConnect was able to disable the “rogue project.” Chainalysis posted the address and Tether CEO Paolo Ardoino said his team froze the Ledger exploiter address.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Tether just froze the Ledger exploiter address&mdash; Paolo Ardoino 🍐 (@paoloardoino) <a href="https://twitter.com/paoloardoino/status/1735315976827101274?ref_src=twsrc%5Etfw">December 14, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<a href="https://blockworks.co/tag/ledger">Ledger</a> told Blockworks that it is working with customers impacted by the attack as well as law enforcement to track the attacker.&nbsp;



The <a href="https://blockworks.co/news/ledger-wallet-vulnerability-connectkit">attack led to SushiSwap and Revoke.cash</a> taking their front-end web apps offline. As Blockworks previously reported, Revoke.cash was impacted by the attack. <a href="https://blockworks.co/tag/sushiswap">SushiSwap</a> warned users to avoid interacting with the Sushi page.



Ledger, following the warnings across social media, previously updated that it was able to replace the malicious file with the genuine one.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">🚨We have identified and removed a malicious version of the Ledger Connect Kit. 🚨 A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves. Your Ledger device and…&mdash; Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735291427100455293?ref_src=twsrc%5Etfw">December 14, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“In the meantime, we’d like to remind the community to always Clear Sign your transactions — remember that the addresses and the information presented on your Ledger screen is the only genuine information,” Ledger continued.&nbsp;



The hardware firm added that users should stop the transaction “immediately” if there’s a difference between the Ledger device screen and the screen on a computer or phone.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Ledger says attacker conducted phishing attack on former employee

Sebastian Sinclair

Authorities in McLennan County have settled a lawsuit with Lux Vending, operating as Bitcoin Depot, following the wrongful seizure of $15,000 from one of its bitcoin ATMs.&nbsp;



The lawsuit was dismissed after the county acknowledged the funds were improperly confiscated following a scam that targeted an 82-year-old Crawford woman, local media reported Thursday.&nbsp;



The scam was reported by the elderly victim who was deceived into withdrawing $15,000 in cash and depositing it into a Bitcoin machine. This reportedly followed her falling victim to a ransomware attack initiated by a malicious email link.



Legal action had originally been filed against county investigators for allegedly violating due process. They had obtained a warrant to seize the funds from a Bitcoin Depot kiosk located at a Sunoco store.



The lawsuit also aimed to have the court recognize Bitcoin Depot as the lawful owner of the seized money.



McLennan County Sheriff Parnell McNamara, who had previously stood by the actions of his officers, declined to comment on the lawsuit&#8217;s resolution or on Judge Scott Felton&#8217;s admission that the funds had been seized erroneously, <a href="https://www.kwtx.com/2023/10/12/mclennan-county-resolves-bitcoin-settlement-after-admitting-funds-seized-error/">KWTX News</a> reported.



Blockworks has reached out to the sheriff’s department but has received no response.



Sheriff McNamara had previously likened the situation to routine law enforcement procedures for recovering stolen property and returning it to rightful owners.



In a letter to Bitcoin Depot, Judge Felton clarified that the initial seizure was based on the mistaken belief that the funds belonged solely to the elderly victim.&nbsp;



Judge Felton also acknowledged county officials were not aware of Bitcoin Depot&#8217;s terms and conditions when the money was returned to the elderly woman.



An attorney representing McLennan County revealed the settlement involved no payments to Bitcoin Depot, per the reports. The company had sought official acknowledgment that it was not involved in the scam, which was the work of a third-party international fraudster.



McLennan County, located in central Texas, is part of a wider network of bitcoin ATMs operated by Bitcoin Depot. As of October, the company has <a href="https://howmanybitcoinatms.com/">6,625</a> different machines spread across the US, representing a 9.8% share of the total market, data shows.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Texas county settles lawsuit over wrongful seizure of $15K from bitcoin ATM

South Korea&#8217;s largest crypto exchange, Upbit, has resumed deposits and withdrawals of Aptos (APT) tokens after abruptly halting the service due to a security incident.&nbsp;



Upbit said in a statement on Saturday it had detected an &#8220;abnormal deposit attempt&#8221; while monitoring <a href="https://blockworks.co/tag/aptos">Aptos</a> transactions, according to a rough translation from Google.



Following an inspection of its wallet system, the exchange confirmed stability for Aptos deposits and withdrawals has been restored and actions have been taken against the abnormal activity.



The incident gained public attention when <a href="https://x.com/definalist/status/1705916604473901076?s=20">various Upbit users</a> reported unauthorized deposits of what appeared to be Aptos tokens (<a href="https://blockworks.co/price/apt">APT</a>) in their accounts, according to X user Definalist. Blockworks has reached out to Upbit to confirm.



It was later discovered that these were not genuine Aptos tokens but “scam” tokens named ClaimAPTGift. Upbit customer service reportedly contacted users who had sold these fraudulent tokens, asking for refunds.



The problem, Definalist said, lay in Upbit&#8217;s wallet system failing to verify the types of tokens being deposited properly.&nbsp;



Normally, the system should differentiate between native Aptos tokens and other tokens within the same ecosystem. But due to a glitch, all tokens sent via a specific function were recognized as Aptos tokens, leading to the issue.



On a decentralized exchange, users can check the token address on-chain using a block explorer, <a href="https://blockworks.co/tag/etherscan">such as Etherscan on Ethereum</a>, to confirm whether a given token is authentic. A centralized platform, however, requires customers to trust the exchange’s internal naming system.



<h2 class="wp-block-heading">Crisis averted</h2>



A lucky break mitigated the severity of the incident. The scam tokens had six decimal places, while native Aptos tokens have eight.&nbsp;



If both had eight decimals, users could have received and potentially sold $25,000 instead of $250, risking a severe market disruption, Definalist said.



Upbit&#8217;s official notice also cautioned users to pay &#8220;special attention to the price differences with other exchanges&#8221; as trading resumes, acknowledging that the price may fluctuate drastically due to the incident.&nbsp;



The price of APT surged around 9% following the incident, and remains up 6% as of Monday at 3:30 am ET $5.45, Blockworks’ data shows.&nbsp;



Upbit said any delays in reflecting deposits and withdrawals would depend on block processing status and that transactions would proceed sequentially as blocks are completed.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Upbit briefly suspends Aptos withdrawals following security incident

Casey Wagner

<div id="highlights-block_62d5eac7be550" class="highlights">
 <ul>
 <li>CFTC charged Jimmy Gale Watson, Jr., an associate of the late John McAfee, $144,736</li>
 <li>The scheme resulted in profits in excess of $2 million, the CFTC alleged in the complaint</li>
 </ul>
 
</div>



The Commodity Futures Trading Commission (CFTC) for the first time cracked down on a so-called “pump-and-dump” crypto scheme Monday.&nbsp;



A New York judge ordered Jimmy Gale Watson, Jr., an associate of the late John McAfee, to pay $144,736 in ill-gotten gains he allegedly received from the scheme.&nbsp;



Watson was an “executive advisor” to McAfee, who was an entrepreneur in the crypto space.&nbsp;



Watson is also permanently banned from trading derivatives, as well as registering with the CFTC — a requisite of certain types of institutional investing.



“Ensuring appropriate customer protections and enforcing against fraudulent schemes like this one are core principles deeply embedded in the agency’s legal and regulatory framework, history, and ethos,” the CFTC said in a statement. “Such fraudulent and manipulative schemes are particularly egregious when they target the most vulnerable market participants, here hardworking retail investors.”



The CFTC <a href="https://www.cftc.gov/PressRoom/PressReleases/8366-21" target="_blank" rel="noreferrer noopener">first charged</a> McAfee and Watson in March 2021. The CFTC alleged the two secretly accumulated positions in digital assets and deceptively promoted the tokens on social media as valuable long-term investments — before selling for a substantial profit. 



The grift resulted in profits in excess of $2 million, the CFTC claimed in the complaint. The fraud involved tokens, including verge (XVG), dogecoin (DOGE) and reddcoin (RDD).



Last Thursday, the SEC separately won a judgment against Watson for his role in McAfee’s alleged initial coin offering (ICO). Watson was fined $375,000 for his alleged participation.&nbsp;



In 2020, the SEC alleged that Watson and McAfee promoted investments in the ICO without disclosing that they were compensated for doing so.



Watson is now also banned permanently from participating, directly or indirectly, in the issuance, purchase, offer or sale of any digital asset deemed a security — a still very-much evolving classification.

For First Time, CFTC Cracks Down on Crypto’s ‘Pump-and-dump’ Schemes

Jack Kubinec

<div id="highlights-block_62bf46e463b31" class="highlights">
 <ul>
 <li>The companies assert no funds were stolen, though they cannot tell for sure</li>
 <li>The hack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook</li>
 </ul>
 
</div>



A hacker produced a phishing pop-up on Polygon and Fantom this morning warning users their funds were at risk and urging them to enter their private account keys.&nbsp;



The hacker accessed Polygon and Fantom’s remote procedure call (RPC) interfaces through the Web3 infrastructure platform Ankr by tricking a third party domain name system (DNS) provider into giving the hacker access to Polygon and Fantom’s domains.



Ankr’s DNS is hosted on a web service named Gandi, and its customer support has a section for clients who want to change the administrator’s email for a domain.


<div class="wp-block-image">
<figure class="aligncenter is-resized"><img loading="lazy" decoding="async" src="https://lh6.googleusercontent.com/1o_R5kAc11QEYSiJNBjnVw8H47zLNZwxe6yLZgnvQBcc_s_X2ZYYZjkAM5UrsuYD_Nt0IPLrT2iV6cjO2-aJby895yT0tzUKO1XZvn5sGPZTw7vuFb3LlHIB5_maJPr40CCpRLZONbepryvVA5c" alt="" width="492" height="160"/><figcaption>Customer service communication at Gandi | Source: Ankr</figcaption></figure></div>


Posing as an Ankr employee, the hacker sent Gandi a fake identity card and convinced the platform’s customer support service to change the email address for the domain registrar account from Ankr’s to the hacker’s Hotmail account.



Ankr is “still trying to understand what [Gandi] accepted as proof for this change,” Peter Stewart, integration manager at Ankr, said.



Ankr was able to regain control of the DNS within six hours of the attack. Sources at Polygon and Ankr told Blockworks that no user funds were compromised, but also conceded they cannot conclusively determine whether any users fell victim to the phishing attack.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Attention please, attack on <a href="https://twitter.com/0xPolygon?ref_src=twsrc%5Etfw">@0xPolygon</a> is ongoing right now! Users see an RPC error asking users to urgently reset their seed on polygonapp net (looks like this is wether DNS hijack or a form of a supply chain attack). Just a scam popup to bring you to a page to put your seed. <a href="https://t.co/fZxtlkKeDN">pic.twitter.com/fZxtlkKeDN</a>&mdash; CIA Officer (@officer_cia) <a href="https://twitter.com/officer_cia/status/1542829400143568897?ref_src=twsrc%5Etfw">July 1, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“DNS is unfortunately still a centralized point of failure in the internet,” Ankr co-founder Ryan Fang told Blockworks via Telegram.&nbsp;



Fang said Ankr will continue to work with Gandi, but it will ask its DNS providers to use two-factor authentication moving forward.



The phishing attack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook — and as NFT (non-fungible token) sales reach their lowest point in a year, according to the blockchain research platform Dune.



“It was a third party outage that does not affect Polygon in any way. Meta is not using that third party either,” <a href="https://www.linkedin.com/in/mudit4/?originalSubdomain=in" target="_blank" rel="noreferrer noopener">Mudit Gupta</a>, chief information security officer at Polygon, told Blockworks.



Meta did not immediately respond to a request for comment.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Hacker Posed as Ankr Employee To Phish Polygon and Fantom Users

Bessie Liu

<div id="highlights-block_62a11c5d87f7a" class="highlights">
 <ul>
 <li>A hacker has acquired 20 million Optimism governance tokens intended for a loan</li>
 <li>The attacker has since transferred or sold about one million tokens — but that’s likely just the start</li>
 </ul>
 
</div>



The airdrop of first-time governance tokens from Ethereum scaling solution Optimism has gone awry in a major way — thanks to a third-party the collective tapped to provide liquidity.



All told, about 20 million Optimism governance tokens (OP) that were loaned to facilitate transactions were lost, with cryptocurrency market maker Wintermute taking responsibility for the lapse.



The loan was initially deployed on Wintermute’s wallets on Optimism, but Wintermute CEO Evgeny Gaevoy said in a <a href="https://gov.optimism.io/t/message-to-optimism-community-from-wintermute/2595" target="_blank" rel="noreferrer noopener">statement</a> that “we made a serious error.” 



Here’s what happened: The wallet address Wintermute used to receive the loan was inaccessible, because it relied on Ethereum layer-1 multi-signature technology that had yet to be deployed to Optimism, which runs as a layer-2. A layer-1 is the foundational function of a given blockchain, while layer-2s are built on top, typically to provide new features or liquidity.



A hacker, meanwhile, took advantage of the technological lapse to transfer the 20 million OP tokens from layer-1 to layer-2, even as Wintermute scrambled to recover the in-limbo funds. The attacker, however, had as of publication only liquidated about a million of the stolen tokens.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">More important is what they knew and when. They knew about this on May 30th. There was a 15 hour gap between the test transaction of 1 <a href="https://twitter.com/search?q=%24OP&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$OP</a> and the following transaction. They didn&#39;t notice something was wrong? They knew 1 million was dumped on 6/5. Did exchanges know about this?&mdash; Benjamin Singer (@BenjaminSinger8) <a href="https://twitter.com/BenjaminSinger8/status/1534657594836627457?ref_src=twsrc%5Etfw">June 8, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“L1 is confusing enough for most people to navigate, and L2 brings a new set of paradigms over key management and safety, even for experienced crypto users and teams,” Gaevoy said.&nbsp;



“We are not sure why they chose not to liquidate all of it at once,” Gaevoy said. “There is hope that it is a white hat exploit, in which case the remaining funds are potentially recoverable. However we are currently operating under the premise that it is not the case, since we haven’t received any communication from them and our message on the chain was left unanswered.”



The attacker still owns 19 million OP tokens. Wintermute said the company plans to buy back the tokens once the attacker sells, saying the purchase “can potentially create price volatility in the token,” but that the market maker will “make best efforts to smoothen the effect.”



The Optimism Foundation has not chosen to update its network — likely requiring a hard fork — to halt the movement of stolen OP tokens that have not yet been stolen or sold as the foundation believes that “using centralized control to attempt a partial recovery would set a significant precedent.”



Security flaws and the illicit process of attaining cryptoassets have become a common problem for many platforms, and <a href="https://cms.blockworks.co/bipartisan-crypto-bill-hits-congress-with-focus-on-cftc-jurisdiction-taxes/" target="_blank" rel="noreferrer noopener">lawmakers are eager</a> to look for solutions.



It comes down to the hallmark phrase, “Not your keys, not your coins,” Ashton Wolfe, the project lead of Crypto Fight Club, told Blockworks.



“Of course, to protect people&#8217;s assets, governments will think that continuously hammering down on regulations will fix this solution,” Wolfe said. “Unfortunately, this still hasn’t worked, because it is a very slow process, and users resent uploading private documents to these counter-parties in order to use the platform.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

In Latest Crypto Hack, 20M Tokens Lost as Market Maker Wintermute Takes Blame

<div id="highlights-block_629fb10800a8f" class="highlights">
 <ul>
 <li>No user funds were lost or stolen before the loophole was discovered</li>
 <li>Up to $200 million worth of Aurora users’ funds could have been hacked if this bug wasn’t fixed</li>
 </ul>
 
</div>



It was almost the next market-moving DeFi hack.&nbsp;



Aurora, an Ethereum Virtual machine built on the NEAR Protocol, recently paid a $6 million reward to a so-called white hat hacker for identifying a key bug. 



The hacker, known as pwning.eth, uncovered in April a critical vulnerability in Aurora’s system, which could have jeopardized up to $200 million of funds. Virtual machines power smart contracts, or transactions executed in code on the blockchain without intermediaries, on Ethereum. Aurora paid the bounty through the Immunefi platform. 



It marks one of the largest-ever known bounty payouts in DeFi (decentralized finance) history. Last month, crypto bridge Wormhole — which connects different blockchains — <a href="https://www.theblockcrypto.com/post/148085/wormhole-announces-10-million-bug-bounty-payout" target="_blank" rel="noreferrer noopener">paid</a> $10 million to an ethical security hacker that also discovered a bug through Immunefi’s platform.



<blockquote class="wp-block-quote">“Such a vulnerability should have been discovered at an earlier stage of the [defense] pipeline and we have already started improving our methods to achieve that in the future,” Frank Braun, Aurora’s head of security, said in a statement Tuesday. </blockquote>



Added Braun: “However this event ultimately proves that our security mechanisms work.”



The bug was initially flagged via Immunefi — crucially, before any funds were stolen. <a href="https://immunefi.com/bounty/aurora/" target="_blank" rel="noreferrer noopener">Aurora&#8217;s bounty program</a> with Immunefi was launched in April 2022, with rewards ranging from $1,000 to $6 million, depending on severity. 



Jonah Michaels, a spokesperson for Immunefi, told Blockworks that at “a time of distrust in the markets, it’s important more than ever for Web3 projects to show that they take security seriously.”



On Immunefi’s platform, security researchers review code and disclose vulnerabilities. Through its programs with DeFi projects, Immunefi said it paid over $40 million in bounties to friendly hackers — claiming to have prevented over $20 billion in potential damages.



Aurora’s goal is to provide application developers the means to operate on Ethereum-compatible platforms under the governance of the decentralized Aurora DAO. Aurora’s scaling solution is currently responsible for $373 million of NEAR’s $786 million in total value locked, <a href="https://defillama.com/chain/Aurora?currency=USD" target="_blank" rel="noreferrer noopener">according to data provider DefiLlama</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

$6M Bounty Paid to White Hat Hacker Likely Averts Sizable DeFi Hack

Ornella Hernandez

<div id="highlights-block_628f85197553a" class="highlights">
 <ul>
 <li>Asset Reality specializes in investigating, tracing and attempting to recover funds</li>
 <li>New service will pool data from a number of scam victims to help trace stolen assets</li>
 </ul>
 
</div>



ConsenSys’ self-custody wallet MetaMask is partnering with Asset Reality, a platform for accessing and recovering seized crypto and digital assets, to tackle cryptocurrency fraud. The two companies will support MetaMask scam and phishing victims in attempting to recover their assets.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We’ve partnered with <a href="https://twitter.com/MetaMask?ref_src=twsrc%5Etfw">@metamask</a>! We’ll be helping victims of crypto-related fraud to recover their stolen digital assets in an industry-first approach to improving virtual asset recovery. Read more about this exciting new partnership: <a href="https://t.co/WBdRjWp1W0">https://t.co/WBdRjWp1W0</a><a href="https://twitter.com/ConsenSys?ref_src=twsrc%5Etfw">@Consensys</a> <a href="https://twitter.com/hashtag/crypto?src=hash&amp;ref_src=twsrc%5Etfw">#crypto</a>&mdash; Asset Reality | Techstars ‘21 🚀 (@asset_reality) <a href="https://twitter.com/asset_reality/status/1529809582868074496?ref_src=twsrc%5Etfw">May 26, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The main security concerns for crypto wallet users are phishing scams that cast a wide net, as well as targeted spear-phishing attacks, according to MetaMask. Bad actors most commonly pose as a friendly face offering to help users navigate crypto’s technical jargon and trick users into handing over their funds.&nbsp;



MetaMask’s strategy is to pool information from a number of victims in the hope that it will help both identify the scammer and make recovering the stolen assets less costly. To use the service, victims must <a href="https://fund-loss-investigation.metamask.io/" target="_blank" rel="noreferrer noopener">submit a ticket</a> for investigation.



Some examples of recent attacks include a <a href="https://cms.blockworks.co/metamask-issues-warning-following-icloud-phishing-scam/" target="_blank" rel="noreferrer noopener">$650,000 phishing scam</a> of a MetaMask wallet user targeted by a hacker posing as an Apple employee. MetaMask’s response, which was criticized at the time by community members, was to issue a warning to users whose data were susceptible to hackers because their iCloud backups include their password-encrypted MetaMask vault.



Earlier this week, a Moonbirds NFT holder <a href="https://twitter.com/CirrusNFT/status/1529296043547865088?s=20&amp;t=RZ-rlCczPtsuuzlqXc70ug" target="_blank" rel="noreferrer noopener">lost</a> 29 of his Ethereum-based Moonbirds, worth around $1.5 million at the time, after signing a bad transaction on a fake trading site he reached by clicking a malicious link shared by a scammer. The victim was a member of the Proof Collective, a private group of 1,000 dedicated NFT (non-fungible token) collectors and artists. Although the scammer was <a href="https://twitter.com/knownasdollar/status/1529297355396489217?s=20&amp;t=MVMqcnyASCcJ24AUrlFiBg" target="_blank" rel="noreferrer noopener">identified</a>, only an FBI report was filed.&nbsp;



Harry Denley, an information technology security analyst at MetaMask, told Blockworks that bad actors are “simply taking advantage of a nascent industry where new users are generally optimistic, excited by the potentials, and not very experienced with having full control of such valuable assets.”



Cybercrime is a multi-billion dollar worldwide industry, he added, emphasizing the importance of hack victims coming forward, no matter how small the loss.&nbsp;



Traditional recovery, however, involves lengthy and often costly civil litigation, with no guarantee of recovering funds. According to MetaMask&#8217;s support product lead Alex Herman, digital asset recovery is difficult due to the cryptocurrency’s “pseudo-anonymous” and “immutable” nature. 



“While traditional systems opt for transactions to be reversible and accounts to be frozen, crypto has prioritized the control of the individual user and decentralized systems. Bad actors can also use obfuscation techniques to make it harder to track stolen funds,” Herman told Blockworks.&nbsp;



In the case of a scam, MetaMask will request any relevant information regarding phishing websites, vectors and funds lost, while Asset Reality will handle the case for MetaMask’s affected users. They will build an investigation into each scam operation and manage any communication with the users.



Along with recovery mechanisms in place, MetaMask and Asset Reality hope to protect users by expanding their education tools and offerings on their platform.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

MetaMask Moves To Help Crypto Scam Victims Recover Stolen Digital Assets

<div id="highlights-block_625dbcbbd85d4" class="highlights">
 <ul>
 <li>The wallet app is asking users to disable iCloud backups for MetaMask by going into Settings > Profile > iCloud > Manage Storage > Backups</li>
 <li>MetaMask&#8217;s response has drawn criticism from community members</li>
 </ul>
 
</div>



Crypto wallet MetaMask issued a warning advising users to disable their iCloud backups following an exploit of Apple&#8217;s service in an estimated $650,000 phishing scam.



The DeFi wallet provider said Sunday users who have iCloud enabled for iPhone application data were susceptible to hackers because the backups include their password-encrypted MetaMask vault.



&#8220;If your password isn’t strong enough and someone phishes your iCloud credentials, this can mean stolen funds,&#8221; MetaMask <a href="https://twitter.com/MetaMask/status/1515727239391809536" target="_blank" rel="noreferrer noopener">tweeted</a>.



The company did not immediately return a request for comment.



In one such phishing attack, hackers drained an estimated $650,000 from NFT investor Domenic Iacovone&#8217;s OpenSea account, including several Mutant Ape Yacht Club collectibles, on April 14.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Hey y’all, let’s see how amazing this community can be. My entire wallet was just stolen. Totally wiped out, MAYC 28478, MAYC 8952, MAYC 7536 Gutter cat 2280 , 2769, 2325 Also stole 100k in ape coin. Looking for all the help I can get. 100kreward <a href="https://twitter.com/BoredApeYC?ref_src=twsrc%5Etfw">@BoredApeYC</a> <a href="https://twitter.com/GutterCatGang?ref_src=twsrc%5Etfw">@GutterCatGang</a>&mdash; Domenic Iacovone (@revive_dom) <a href="https://twitter.com/revive_dom/status/1514751885126914051?ref_src=twsrc%5Etfw">April 14, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



&#8220;Got a phone call from Apple, literally from Apple (on my caller Id) called it back because I suspected fraud and it was an Apple number,&#8221; Iacovone <a href="https://twitter.com/revive_dom/status/1514752274471473152?s=20&amp;t=Mz55J5At86ofD9lN1ccoLA" target="_blank" rel="noreferrer noopener">tweeted</a>. &#8220;So I believed them, they asked for a code that was sent to my phone and two seconds later my entire MetaMask was wiped.&#8221;



MetaMask&#8217;s response has drawn criticism from community members who argue the backup feature used in iCloud should either be disabled or made tougher for hackers seeking a way into users&#8217; digital wallets.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">100% metamask will need to fix that shite <a href="https://t.co/M9E3DBt8p5">https://t.co/M9E3DBt8p5</a>&mdash; Br Br the podcast Snek (@bryanbrake) <a href="https://twitter.com/bryanbrake/status/1515767252292812801?ref_src=twsrc%5Etfw">April 17, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



MetaMask parent ConsenSys in February said it was looking to <a href="https://cms.blockworks.co/onboarding-the-next-wave-of-metamask-users-through-nfts/" target="_blank" rel="noreferrer noopener">leverage NFTs</a> (non-fungible tokens) as a means to onboard more users to its digital wallet while building out a white-label NFT platform.



While efforts are being made on that front, critics argue cases like Iacovone&#8217;s demonstrate ConsenSys&#8217; need to improve security if it aims to bring on the &#8220;next wave&#8221; of wallet users.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

MetaMask Issues Warning Following $650K iCloud Phishing Scam

Morgan Chittum

<div id="highlights-block_622a7d366e37d" class="highlights">
 <ul>
 <li>MetaMask, Trust Wallet and Math Wallet are the most commonly used wallets</li>
 <li>16% of respondents said their accounts on NFT platforms had been previously hacked</li>
 </ul>
 
</div>



From multi-million dollar rugpulls to user exploits on marketplaces, investing in NFTs can be fraught with risk.&nbsp;



New York gallery owner Todd Kramer, for example, had <a href="https://www.vice.com/en/article/y3v3ny/all-my-apes-gone-nft-theft-victims-beg-for-centralized-saviors" target="_blank" rel="noreferrer noopener">$2.2 million</a> of NFTs (non-fungible tokens) <a href="https://www.artnews.com/art-news/news/todd-kramer-nft-theft-1234614874/" target="_blank" rel="noreferrer noopener">stolen</a> in January through a phishing scam.



Half of NFT owners have lost access to at least one of their digital collectibles before, according to a March 8 <a href="https://privacyhq.com/news/nft-and-wallet-security/" target="_blank" rel="noreferrer noopener">report by research firm PrivacyHQ</a>.



The study, which polled over one thousand collectors, showed two out of three NFT investors “panic sold” one of their blockchain-based collectibles last year.&nbsp;



Justin Kan, co-founder of NFT gaming marketplace Fractal and streaming platform Twitch, told Blockworks users should follow precautions to safeguard their assets.



“There [are] a high level of rugpulls and scams [in NFTs],” Kan said. “[But] hopefully as the space matures, companies will be able to provide protocols that will be able to [offer] this kind of security for their users.”&nbsp;



“You should have a burner wallet when you&#8217;re minting, have a cold wallet for storage of your NFTs, and you should be aware of phishing attacks.”



Per the survey, 16% of respondents said their NFT platforms had been hacked, but roughly 90% said they were able to recoup losses in some capacity. 



MetaMask, Trust Wallet and MathWallet are the most popular NFT wallets — with MetaMask believed to be the safest.



“Don&#8217;t [click on] links,” Kan said. “We [recommend] typing out Fractal.is in your browser. Now, people in Web2 are going to [say], ‘That&#8217;s insane that you have to do all these protections.’ But I think it&#8217;s the cost of having true ownership of [something.] You kind of have to rebuild the space from the ground up.”



Security concerns, however, didn’t seem to slow the exponential growth of the industry last year. NFT sales reached $17.7 billion in 2021, up from $82.5 million in 2020, according to a <a href="https://nonfungible.com/reports/2021/yearly-nft-market-report-pro" target="_blank" rel="noreferrer noopener">Thursday report</a> from NonFungible.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Report: 50% of NFT Holders Have Lost Access to Their NFTs

Ben Strack

<div id="highlights-block_622108a13a7ee" class="highlights">
 <ul>
 <li>The Financial Conduct Authority added 172 firms to its list of unregistered crypto businesses during the six-month period</li>
 <li>More people checked the safety of cryptocurrency using the FCA’s ScamSmart Warning List tool than any other investment opportunity</li>
 </ul>
 
</div>



Reports of potential crypto scams shot up in the middle of 2021, according to the UK’s Financial Conduct Authority (FCA), as the regulator seeks to further crack down on actors causing investor harm.



The FCA had roughly 16,400 reports of possible scams between April and September of 2021, according to agency findings published Thursday — up from 12,400 over the same period the year prior.



<a href="https://www.investopedia.com/terms/b/boilerroom.asp" target="_blank" rel="noreferrer noopener">Boiler rooms</a> were the most commonly reported scam, where fraudsters cold-call investors offering them worthless, overpriced or even non-existent shares or bonds.



The three other most common reports were of cryptocurrency scams, FCA impersonation scams and recovery rooms — where fraudsters offer to help investors who were scammed or lost money on an investment get their money back for an upfront fee.



Overall, the FCA stopped 32 new firms, or 25%, from entering the consumer investments market between April and September.



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="683" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg" alt="" class="wp-image-18181" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=386 386w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=392 392w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=329 329w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=1200 1200w" sizes="(max-width: 1024px) 100vw, 1024px" /></figure>



Of the more than 16,000 scam inquiries, about 3,000 were related to cryptocurrencies — up 14% from the previous six months.



The FCA also offers a ScamSmart Warning List tool, which allows people to check the safety or risks of an investment opportunity. Cryptocurrency represents 34% of the checks, the most of any investment opportunity. The checks on crypto grew to 4,320&nbsp; — a 49% from the prior six months.



“The watchdog is swimming against an increasingly treacherous tide of scams and suspect investments,” said Susannah Streeter, senior investment and markets analyst at Hargreaves Lansdown.



<blockquote class="wp-block-quote">“Given the volatile rise of coins and tokens over the pandemic, it seems many more fraudulent operations have been launched, to take advantage of consumers’ fear of missing out on the crypto rollercoaster.”</blockquote>



The number of consumers in the UK holding cryptocurrency was estimated to be 2.3 million, according to <a href="https://www.fca.org.uk/publications/research/research-note-cryptoasset-consumer-research-2021" target="_blank" rel="noreferrer noopener">an FCA report</a> published in June.



The FCA’s cryptoasset team — responsible for supervising firms’ compliance with money laundering regulations — opened more than 300 cases relating to potential unregistered businesses in the space during the six-month period. The regulator noted that many of these businesses are likely involved in scams.&nbsp;



The FCA added 172 firms to its <a href="https://register.fca.org.uk/s/search?predefined=U" target="_blank" rel="noreferrer noopener">list of unregistered crypto businesses</a> during the period and made 10 referrals to the Advertising Standards Authority (ASA).



Crypto businesses that were already trying to register with the FCA have until March 31 to register with the regulator to continue trading. The regulator is also evaluating new applications separately.&nbsp;



The FCA is considering firms’ anti-money laundering and counterterrorist financing measures when assessing applications. Crypto market maker Wintermute announced in a Twitter post Monday that it is now registered with the FCA. But dozens of firms with temporary registrations — including <a href="https://www.revolut.com/system-status?sprediki2006/2006-19spred.htm/" target="_blank" rel="noreferrer noopener">Revolut</a>, a $33 billion neobank that includes crypto among its service offerings — are still awaiting a decision from the FCA.



“A significantly high number of businesses” are not meeting the required standards, according to <a href="https://www.fca.org.uk/news/press-releases/temporary-registration-regime-extended-cryptoasset-businesses" target="_blank" rel="noreferrer noopener">a March 2021 press release</a>, resulting in many businesses withdrawing their applications.



The latest data follows the UK government <a href="https://cms.blockworks.co/uk-government-seeks-to-boost-regulation-of-crypto-ads/" target="_blank" rel="noreferrer noopener">revealing plans in January</a> to strengthen its rules on crypto advertisements to protect consumers from misleading claims. The proposal called for bringing cryptoasset advertising under the rules of the FCA — the same standards that stocks, shares and insurance products are held to.



“It’s clear that education needs to be sharpened up pretty pronto with so many vulnerable consumers being lured in,” Streeter said. “It’s very welcome that crypto assets will soon fall under the FCA’s watch as part of new legislation.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.