David Canellis

This is a segment from the Empire newsletter. To read full editions, <a href="https://blockworks.co/newsletter/empire">subscribe</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Unless you live under a rock, you probably heard about the Kaito token drop yesterday.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Base has been humming along nicely during the Kaito airdrop, topping out at 160 TPS at a median fee of $0.02 Their scaling efforts are clearly paying off <a href="https://t.co/a6UVHkJvKY">pic.twitter.com/a6UVHkJvKY</a>&mdash; Dan Smith (@smyyguy) <a href="https://twitter.com/smyyguy/status/1892585101873033380?ref_src=twsrc%5Etfw">February 20, 2025</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Vibes were pretty positive, it turns out people like to be paid to yap (and some of us — ahem, myself — are left with FOMO after not yapping to earn). But alas, I turned to two colleagues who did <a href="https://blockworks.co/news/kaito-yap-to-earn-takeover">earn KAITO for posting</a>.&nbsp;



<a href="https://blockworks.co/newsletter/lightspeed">Lightspeed’s Jack Kubinec</a> and <a href="https://blockworks.co/newsletter/thedrop">The Drop’s Kate Irwin</a> both earned roughly $200 of KAITO. Kubinec praised the project for understanding that folks didn’t want another social media site to post on to earn their yaps, and instead kept it on X — where parts of the crypto community are the strongest.&nbsp;



Kubinec was lucky in that a <a href="https://x.com/whosknave/status/1875216410391253192">thread of his went viral</a> shortly after claiming his profile on Kaito, bumping him up to one of the top yappers briefly. However, he admitted that even his short-lived CT fame didn’t prompt him to post any more than usual.



For Irwin, the question is all about longevity. We’ve been through a few hype cycles now, and admittedly when it’s good, it’s great and when it’s bad, CT kind of feels desolate. Irwin told me that it’s hard to see people still posting about yapping and caring about it in six months.



The token, however, is holding on for now. Perhaps some of that is due to some of the shaming we’ve seen over on X.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">you&#39;re free to do what you want with your money and also I want to publicly state that I think it&#39;s lame to celebrate immediately divesting of long term builders who are rewarding us for our contributions and using tokens to bring us in as cobuilders long term &gt; short term&mdash; jesse.base.eth (@jessepollak) <a href="https://twitter.com/jessepollak/status/1892554449668768024?ref_src=twsrc%5Etfw">February 20, 2025</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Or perhaps this is finally the project that can break the cycle and we’ve finally solved the code for SocialFi. Only time will tell I guess.



And now you know.



<figure class="wp-block-image"><img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc3U1VGuuxlJWLf6NMwtCI9lQjgOSjDERfdn9I1hxS7-XpL3VgM1oTd83lw6HehD1qJdONZWCVItRR5TQtMsHriMcbnQl-GwL0Yww2l9mBmLvwrLKujaqqFJRn8Oxan7OpbjU1YNA?key=xC-bzhA2CEmj-eUhI-akgM4r" alt=""/><figcaption class="wp-element-caption">HYPE is up 550% since it launched at the end of November</figcaption></figure>



Maybe David Sacks is right. Memecoins are collectibles.



If that’s true, then crime season suddenly gets an element of Pokémon GO.&nbsp;



Like how you might wander through the park and catch Wigglytuffs and Psyducks, we could all frolic through Raydium and <s>buy dead rugpulls</s> collect souvenirs of all the memecoins that come and go.&nbsp;



It’s a pain that memecoins have sucked so much air out of the room and it’s made for a ton of myopic takes. The <a href="https://www.coindesk.com/tech/2025/02/21/kanye-west-self-proclaimed-nazi-who-said-coins-prey-on-fans-plans-yzy-token">supposed</a> Yeezy token launch isn’t helping, either.



So, here’s some eyebleach: Of the major coin launches in the past few months, HYPE — tied to a project of substance in Hyperliquid — is outperforming the pack with steady price action.&nbsp;



Around 60% of all perps <a href="https://defillama.com/perps/chains">volumes</a> on DEXs flows through Hyperliquid right now, which is a stat the market obviously appreciates.



MORPHO, the lending app on Ethereum and Base, is otherwise ahead by 135% since its own launch a week or so before HYPE.&nbsp;



That’s much better than BERA, PENGU and MOVE, which have lost between 24% and 38% since they started trading (BERA is staging a comeback as we speak). Morpho currently has $6.8 billion in <a href="https://dune.com/morpho/morpho-blue-dashboard">deposits</a>, up 160% in the past three months.



All well and good: Real projects might have a chance after all.&nbsp;



The best part is, if you zoom out this analysis to include coins launched just a few months earlier, in August and October, it would be FARTCOIN dominating the chart, even after its 84% retracement.



Sometimes, ignorance is bliss.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

airdrop

Not all new coins are pointless pump and dumps

Bezalel Eithan Raviv

The huge sums of money lost to crypto scams and frauds is probably the biggest financial looting in the history of the USA. 



The FBI <a href="https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf?trk=public_post_comment-text">recorded</a> losses over $12.5 billion in 2023, 22% more than the previous year. The agency’s Internet Crime Center received a record 880,418 complaints from Americans about potential crypto and online thefts. Considering that most of the targeted individuals do not report their cases to law enforcement, these statistics imply an even more chilling reality.&nbsp;



We need collective action to resolve this situation, from robust security solutions to innovative regulatory and policy frameworks. It’s the only way out — and many already affected are on borrowed time.&nbsp;



We call upon community leaders, politicians and policymakers to step up and protect vulnerable communities. The present circumstances necessitate proactive and enduring measures from them. This is a battle between good and evil, where regulators and crypto innovators should be allies, not adversaries.&nbsp;



Whether one likes it or not, crypto is here to stay: but it cannot persist in its current form. We must prioritize accountability and transparency to enable this groundbreaking technology to thrive and ensure that more people prosper in a secure financial landscape.



Let’s make crime illegal again.&nbsp;



<h2 class="wp-block-heading">Strategic interventions are mission-critical</h2>



Washington DC must urgently take decisive action to protect consumers from the rampant frauds plaguing the crypto realm.&nbsp;



With another <a href="https://www.grayscale.com/research/reports/anatomy-of-a-bitcoin-bull-market">bull cycle underway</a>, the influx of new users and capital only heightens the risk.&nbsp;



The US, the biggest financial superpower, is in dire need of a robust and unambiguous regulatory framework to effectively combat crypto-related crimes. The current lack thereof has left investors, traders and consumers vulnerable to significant risks. The fragmented oversight by agencies like the SEC, CFTC and IRS has created loopholes ripe for exploitation by hackers. Enforcing anti-money laundering laws in this chaotic landscape is an uphill battle.



Read more from our opinion section: <a href="https://blockworks.co/news/legislation-crypto-greatest-enemy">Petty legislation is crypto’s greatest enemy</a>



In addition to comprehensive policies, legislators must establish rigorous reporting and examination standards for both enforcement agencies and crypto businesses. This will enable stakeholders to swiftly identify and thwart illicit activities, providing real-time protection to potential victims.



Prevention must take precedence over reaction. Implementing deterrent measures that render attacks economically futile is imperative. Furthermore, equipping local enforcement agencies and security personnel with adequate training and education is crucial in effectively combating crypto crimes, both proactively and reactively.



By laying down the groundwork, legislators will pave the way for innovators and entrepreneurs to develop solutions that address security concerns at both protocol and user levels. With the technological landscape evolving rapidly, it&#8217;s paramount to instill confidence in the crypto ecosystem.



<h2 class="wp-block-heading">From cryptocurrencies to Ponzi schemes</h2>



Technology is inherently neutral; its morality is determined by its application in a specific context, just as with atomic reactors and quantum computers.



According to the <a href="https://www.washingtonpost.com/business/2023/04/21/americans-view-cryptocurrency-unreliable/">Pew Research Center</a>, more than 43% of crypto investors expressed doubts about security in the crypto industry in 2023. This statistic underscores the urgent need for legislative intervention. The devastating consequences of losing fortunes to hacks and scams affect individuals from all walks of life, including fathers, single mothers, college students, older adults and practically anyone involved in cryptocurrency investment.



Data from the <a href="https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf">FBI</a> indicates that consumers suffered losses exceeding $29 billion between 2021 and 2023. Unfortunately, many of these incidents went unreported due to insufficient infrastructure, societal stigma and a lack of confidence in the effectiveness of retributive measures.



The escalating utilization of cryptocurrencies in various illicit activities such as financial crimes, money laundering, trafficking and terrorist financing adds another layer of complexity to the situation.&nbsp;



Malicious actors leverage highly sophisticated technologies and methodologies, often staying two steps ahead of law enforcement. Tracing their actions and holding them accountable has become exceedingly challenging, demanding specialized skills and resources.&nbsp;



Since 2017, North Korean hacker groups, for example, have stolen tokens worth $3 billion, according to the UN Security Council’s <a href="https://www.reuters.com/technology/cybersecurity/un-experts-investigate-58-cyberattacks-worth-3-bln-by-north-korea-2024-02-08/">estimates</a>. North Korea was possibly involved in 17 crypto-related thefts and hacks in 2023 alone, draining over $750 million — roughly 50% of the nation’s foreign currency earnings.&nbsp;



Beyond North Korea, Iranian and Russian groups have also extensively used private crypto-assets to launder stolen funds, purchase illegal weapons, evade sanctions and so on.



Every month, thousands of new Ponzi trading platforms also surface, targeting individuals through platforms like Twitter, Facebook groups and TikTok. They entice people from social media into a trap, often starting with a seemingly harmless interaction that transitions to a communication platform like WhatsApp.&nbsp;



Once engaged, the scam begins, manipulating victims through various senses and emotions. What starts as a small investment can swiftly escalate, potentially devouring entire savings like a 401K in a matter of weeks. Victims are relentlessly pushed to invest more, with cryptocurrencies often used as an anonymous conduit, exacerbating the complexity and severity of the scam.&nbsp;



Law enforcement will issue a report on the case, but by the time they come to any sort of conclusion, the wallet will have long been emptied.



<h2 class="wp-block-heading">Crafting new policy frameworks for emerging challenges</h2>



Cryptocurrencies present unique challenges. Outdated one-size-fits-all approaches are inadequate for enhancing security and protecting users in this rapidly evolving industry.



Mere compliance is insufficient. Regulators must also uphold market integrity, demand that cryptocurrency exchanges and wallet providers enhance protections for investors&#8217; capital, inspire confidence among investors, foster innovation through awareness and safeguard the entire ecosystem. Balancing security and innovation is paramount. Overemphasizing either aspect risks undermining progress.&nbsp;



Despite the challenges, the US as a regulatory leader possesses the capacity to navigate this landscape effectively.&nbsp;



American households urge Congress to act swiftly and decisively to address the crisis by implementing strict regulations for cryptocurrencies. Entrepreneurs are ready to help.&nbsp;



If we can&#8217;t help protect people&#8217;s finances in 2024, what does that mean for the future of our financial systems?



<hr class="wp-block-separator has-alpha-channel-opacity"/>


<div class="wp-block-post-author-biography">Bezalel Eithan Raviv, an ex-member of IDF Cyber Unit 8200, is a seasoned entrepreneur with deep expertise in technology and innovation. He now leads Lionsgate Network, a blockchain analysis firm specializing in professional money recovery services for digital asset investors in the +$2.5 trillion market. Prior to this role, Bezalel founded an investment banking firm supporting AI startups and developed Halleluiah, a pioneering web3 migration pattern for global music copyrights.</div>


<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

cryptocurrency

Crypto crime is too easy

Katherine Ross

Google filed a complaint against a group of alleged scammers on Thursday.



The complaint, filed in the Southern District of New York, claims that the accused “conducted their version of the Fraud Scheme by socially engineering and conning victims into ‘investing’ in apps, available on Google Play and through other means, that purported to be cryptocurrency exchanges and other investment platforms.”



“Keeping people safe online is core to our business and we will not tolerate the misuse of our platforms to facilitate cryptocurrency scams. This litigation is a critical step in holding these bad actors accountable and sending a clear message that we will aggressively pursue those who seek to take advantage of our users,” Halimah DeLaine Prado, Google general counsel, told Blockworks in an email.



The complaint names Yunfeng Sun and Hongnam Cheung as well as their aliases Alphonse Sun, Zhang Hongnim and Stanford Fischer.&nbsp;



“Defendants created fraudulent apps that purported to be legitimate cryptocurrency exchanges and investment platforms, and made them available on Google Play,” Google said.&nbsp;



Read more: <a href="https://blockworks.co/news/crypto-fraud-financial-scam">All fraud will eventually be ‘crypto fraud.’ And that’s okay.</a>



Sun and Chueng also made “multiple misrepresentations to <a href="https://blockworks.co/tag/google">Google</a> in order to upload their fraudulent apps to Google Play, including but not limited to, misrepresentations about their identity, location and the type and nature of the application being uploaded.”



The defendants would allegedly exchange texts with victims in an attempt to “persuade the victims to download and invest through one of their apps.” They also created marketing campaigns and videos.&nbsp;



However, the complaint claims that customers who made deposits on the apps couldn’t withdraw their funds. They then faced higher withdrawal fees to access funds, which would still not allow the victims to access their deposits.&nbsp;



Read more: <a href="https://blockworks.co/news/google-adds-ens-to-search">Google quietly added ENS to Search</a>



Google said that 87 apps have been linked to the scheme.



According to the suit, “Google records indicate that at least approximately 100,000 users have downloaded the Fraudulent Apps, including at least approximately 8,700 in the United States.”



It’s not clear, based on the complaint, how much money has been lost to the alleged fraud but Google says that the financial losses have been “substantial.”



The company seeks a permanent injunction to bar the defendants from accessing or using Google services and products, and&nbsp; “creating or maintaining” Google accounts. Google also wants the defendants to pay attorney fees and “reasonable costs.”



CNBC first <a href="https://www.cnbc.com/2024/04/04/google-sues-crypto-scammers-allegedly-uploading-fake-apps-android-app-store.html">reported</a> the lawsuit. 



Updated April 4, 2024 at 10:31 am ET: Added comment from Google.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

exploit

Google files lawsuit against alleged crypto scammers 

Michael McSweeney

X, formerly Twitter, has a deepfake problem, one that I believe could — and, frankly, should — end its role as the premier social platform for the crypto industry.



Scrolling through the endless chaos of X, it doesn’t take long to come across a video, usually starring a stilted Michael Saylor or Brad Garlinghouse, promising me access to a crypto airdrop. Solana co-founder Anatoly Yakovenko’s likeness has <a href="https://www.theverge.com/2024/1/3/24024262/youtube-twitter-x-crypto-solana-deepfake-scam">also been used</a>.&nbsp;



These videos are, of course, scams, putting a new and decidedly worrisome technology spin on an old problem —&nbsp;similar to the ever-prevailing threat of <a href="https://blockworks.co/news/crypto-phishing-attacks">crypto phishing attacks</a>.&nbsp;



The videos employ AI-generated voice recordings and what appear to be added lip animations to present “opportunities” to would-be crypto holders.&nbsp;



These “major announcements” share a common call to action: Scan a QR code or follow a link to receive “money.” Obviously, I didn’t click or scan by way through, but the implications are clear for anyone who has encountered the dangers of the modern internet. Interaction means security exposure, and exposure means the potential for stolen digital assets, personal information or more.&nbsp;



One account, live as of the time of writing, had scored 276,000 views for a Saylor deepfake and 139,000 views for a Garlinghouse deepfake. 



Read more from our opinion section: <a href="https://blockworks.co/news/farcaster-just-might-be-the-new-crypto-twitter">Farcaster just might be the new Crypto Twitter</a>



The fact that these posts are often tagged as advertisements —&nbsp;thereby offering them the veneer of legitimacy —&nbsp;is deeply problematic. Far worse is the reality that X is making money off the problem rather than making any kind of visible effort to confront them.



It wasn’t that long ago that X owner Elon Musk pledged to solve the spam bot problem. The reality seems to be that we’ve traded scam accounts that pretend to be Musk for scam accounts that act like crypto industry leaders — in both cases, enticing would-be victims with giveaways.



This is all playing out against the backdrop of <a href="https://www.theinformation.com/articles/musks-x-is-flooded-with-ad-spam-stolen-credit-cards-may-be-key">a wave of other types of spam advertisements</a>, as The Information detailed earlier this month. The result — fueled by an exodus of major advertisers that has slowly played out since Musk took over the now-former Twitter — is a minefield of questionable products, porn bots and these deep fake videos.



It’s a disaster. The situation further muddies the water of a platform that has, for many years, served as a central hub for inter-industry relations. And, if recent technology developments hold true, the problem will likely become worse over time.&nbsp;



News from Sam Altman’s OpenAI that the company has developed a text-to-video product may put additional tools in the hands of would-be scammers. To be sure, OpenAI appears to be taking an at least publicly cautious approach to allowing access to this tool, in what is doubtless an acknowledgement of the inherent risks. But AI-generated video tools will inevitably become widespread — opening the door to more sophisticated deep fakes like the crypto ones popping up today.



Where to from here? Should alternative social media platforms be embraced? Do crypto-enabled platforms and protocols like Lens or Farcaster hold the key to a social media without these scam videos?



I don’t know. I believe the industry should become louder about this issue — if, for nothing else, to perhaps prompt a response from X and Musk. Remember, the Musk bot issue did go away, but by all appearances the fundamental problem —&nbsp;fake accounts masquerading as sources of authority — has metastasized.&nbsp;



This situation places an industry long dogged by its worst impulses in close proximity with a dangerous collision of technology and exploitation. The crypto industry would be wise to confront it head-on.&nbsp;



<hr class="wp-block-separator has-alpha-channel-opacity"/>


<div class="wp-block-post-author-biography">Michael McSweeney has worked in crypto media since 2014, including editorships at CoinDesk and The Block. In his spare time, he writes fiction and plays disc golf. Contact Michael at michael.mcsweeney@blockworks.co.</div>


<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

crypto twitter

Crypto deepfakes prove that X is failing as an industry platform

Today’s attack on crypto hardware firm Ledger was traced to an ex-employee who “fell victim to a phishing attack that gained access to their NPMJS account” in an email to Blockworks.



The code was then published to ConnectKit. A fix, according to Ledger, was deployed roughly 40 minutes after they were alerted but not before the malicious code was active for five hours.



The address was connected to a malicious code found in Ledger’s ConnectKit software libraries early Thursday. ConnectKit connects blockchain apps with Ledger devices.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">FINAL TIMELINE AND UPDATE TO CUSTOMERS: 4:49pm CET: Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again. The investigation continues, here is the timeline of what we know about…&mdash; Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735326240658100414?ref_src=twsrc%5Etfw">December 14, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



WalletConnect was able to disable the “rogue project.” Chainalysis posted the address and Tether CEO Paolo Ardoino said his team froze the Ledger exploiter address.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Tether just froze the Ledger exploiter address&mdash; Paolo Ardoino 🍐 (@paoloardoino) <a href="https://twitter.com/paoloardoino/status/1735315976827101274?ref_src=twsrc%5Etfw">December 14, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<a href="https://blockworks.co/tag/ledger">Ledger</a> told Blockworks that it is working with customers impacted by the attack as well as law enforcement to track the attacker.&nbsp;



The <a href="https://blockworks.co/news/ledger-wallet-vulnerability-connectkit">attack led to SushiSwap and Revoke.cash</a> taking their front-end web apps offline. As Blockworks previously reported, Revoke.cash was impacted by the attack. <a href="https://blockworks.co/tag/sushiswap">SushiSwap</a> warned users to avoid interacting with the Sushi page.



Ledger, following the warnings across social media, previously updated that it was able to replace the malicious file with the genuine one.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">🚨We have identified and removed a malicious version of the Ledger Connect Kit. 🚨 A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves. Your Ledger device and…&mdash; Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735291427100455293?ref_src=twsrc%5Etfw">December 14, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“In the meantime, we’d like to remind the community to always Clear Sign your transactions — remember that the addresses and the information presented on your Ledger screen is the only genuine information,” Ledger continued.&nbsp;



The hardware firm added that users should stop the transaction “immediately” if there’s a difference between the Ledger device screen and the screen on a computer or phone.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Ledger

Ledger says attacker conducted phishing attack on former employee

Sebastian Sinclair

Authorities in McLennan County have settled a lawsuit with Lux Vending, operating as Bitcoin Depot, following the wrongful seizure of $15,000 from one of its bitcoin ATMs.&nbsp;



The lawsuit was dismissed after the county acknowledged the funds were improperly confiscated following a scam that targeted an 82-year-old Crawford woman, local media reported Thursday.&nbsp;



The scam was reported by the elderly victim who was deceived into withdrawing $15,000 in cash and depositing it into a Bitcoin machine. This reportedly followed her falling victim to a ransomware attack initiated by a malicious email link.



Legal action had originally been filed against county investigators for allegedly violating due process. They had obtained a warrant to seize the funds from a Bitcoin Depot kiosk located at a Sunoco store.



The lawsuit also aimed to have the court recognize Bitcoin Depot as the lawful owner of the seized money.



McLennan County Sheriff Parnell McNamara, who had previously stood by the actions of his officers, declined to comment on the lawsuit&#8217;s resolution or on Judge Scott Felton&#8217;s admission that the funds had been seized erroneously, <a href="https://www.kwtx.com/2023/10/12/mclennan-county-resolves-bitcoin-settlement-after-admitting-funds-seized-error/">KWTX News</a> reported.



Blockworks has reached out to the sheriff’s department but has received no response.



Sheriff McNamara had previously likened the situation to routine law enforcement procedures for recovering stolen property and returning it to rightful owners.



In a letter to Bitcoin Depot, Judge Felton clarified that the initial seizure was based on the mistaken belief that the funds belonged solely to the elderly victim.&nbsp;



Judge Felton also acknowledged county officials were not aware of Bitcoin Depot&#8217;s terms and conditions when the money was returned to the elderly woman.



An attorney representing McLennan County revealed the settlement involved no payments to Bitcoin Depot, per the reports. The company had sought official acknowledgment that it was not involved in the scam, which was the work of a third-party international fraudster.



McLennan County, located in central Texas, is part of a wider network of bitcoin ATMs operated by Bitcoin Depot. As of October, the company has <a href="https://howmanybitcoinatms.com/">6,625</a> different machines spread across the US, representing a 9.8% share of the total market, data shows.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

bitcoin atm

Texas county settles lawsuit over wrongful seizure of $15K from bitcoin ATM

South Korea&#8217;s largest crypto exchange, Upbit, has resumed deposits and withdrawals of Aptos (APT) tokens after abruptly halting the service due to a security incident.&nbsp;



Upbit said in a statement on Saturday it had detected an &#8220;abnormal deposit attempt&#8221; while monitoring <a href="https://blockworks.co/tag/aptos">Aptos</a> transactions, according to a rough translation from Google.



Following an inspection of its wallet system, the exchange confirmed stability for Aptos deposits and withdrawals has been restored and actions have been taken against the abnormal activity.



The incident gained public attention when <a href="https://x.com/definalist/status/1705916604473901076?s=20">various Upbit users</a> reported unauthorized deposits of what appeared to be Aptos tokens (<a href="https://blockworks.co/price/apt">APT</a>) in their accounts, according to X user Definalist. Blockworks has reached out to Upbit to confirm.



It was later discovered that these were not genuine Aptos tokens but “scam” tokens named ClaimAPTGift. Upbit customer service reportedly contacted users who had sold these fraudulent tokens, asking for refunds.



The problem, Definalist said, lay in Upbit&#8217;s wallet system failing to verify the types of tokens being deposited properly.&nbsp;



Normally, the system should differentiate between native Aptos tokens and other tokens within the same ecosystem. But due to a glitch, all tokens sent via a specific function were recognized as Aptos tokens, leading to the issue.



On a decentralized exchange, users can check the token address on-chain using a block explorer, <a href="https://blockworks.co/tag/etherscan">such as Etherscan on Ethereum</a>, to confirm whether a given token is authentic. A centralized platform, however, requires customers to trust the exchange’s internal naming system.



<h2 class="wp-block-heading">Crisis averted</h2>



A lucky break mitigated the severity of the incident. The scam tokens had six decimal places, while native Aptos tokens have eight.&nbsp;



If both had eight decimals, users could have received and potentially sold $25,000 instead of $250, risking a severe market disruption, Definalist said.



Upbit&#8217;s official notice also cautioned users to pay &#8220;special attention to the price differences with other exchanges&#8221; as trading resumes, acknowledging that the price may fluctuate drastically due to the incident.&nbsp;



The price of APT surged around 9% following the incident, and remains up 6% as of Monday at 3:30 am ET $5.45, Blockworks’ data shows.&nbsp;



Upbit said any delays in reflecting deposits and withdrawals would depend on block processing status and that transactions would proceed sequentially as blocks are completed.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Aptos

Upbit briefly suspends Aptos withdrawals following security incident

Casey Wagner

<div id="highlights-block_62d5eac7be550" class="highlights">
 <ul>
 <li>CFTC charged Jimmy Gale Watson, Jr., an associate of the late John McAfee, $144,736</li>
 <li>The scheme resulted in profits in excess of $2 million, the CFTC alleged in the complaint</li>
 </ul>
 
</div>



The Commodity Futures Trading Commission (CFTC) for the first time cracked down on a so-called “pump-and-dump” crypto scheme Monday.&nbsp;



A New York judge ordered Jimmy Gale Watson, Jr., an associate of the late John McAfee, to pay $144,736 in ill-gotten gains he allegedly received from the scheme.&nbsp;



Watson was an “executive advisor” to McAfee, who was an entrepreneur in the crypto space.&nbsp;



Watson is also permanently banned from trading derivatives, as well as registering with the CFTC — a requisite of certain types of institutional investing.



“Ensuring appropriate customer protections and enforcing against fraudulent schemes like this one are core principles deeply embedded in the agency’s legal and regulatory framework, history, and ethos,” the CFTC said in a statement. “Such fraudulent and manipulative schemes are particularly egregious when they target the most vulnerable market participants, here hardworking retail investors.”



The CFTC <a href="https://www.cftc.gov/PressRoom/PressReleases/8366-21" target="_blank" rel="noreferrer noopener">first charged</a> McAfee and Watson in March 2021. The CFTC alleged the two secretly accumulated positions in digital assets and deceptively promoted the tokens on social media as valuable long-term investments — before selling for a substantial profit. 



The grift resulted in profits in excess of $2 million, the CFTC claimed in the complaint. The fraud involved tokens, including verge (XVG), dogecoin (DOGE) and reddcoin (RDD).



Last Thursday, the SEC separately won a judgment against Watson for his role in McAfee’s alleged initial coin offering (ICO). Watson was fined $375,000 for his alleged participation.&nbsp;



In 2020, the SEC alleged that Watson and McAfee promoted investments in the ICO without disclosing that they were compensated for doing so.



Watson is now also banned permanently from participating, directly or indirectly, in the issuance, purchase, offer or sale of any digital asset deemed a security — a still very-much evolving classification.

CFTC

For First Time, CFTC Cracks Down on Crypto’s ‘Pump-and-dump’ Schemes

Jack Kubinec

<div id="highlights-block_62bf46e463b31" class="highlights">
 <ul>
 <li>The companies assert no funds were stolen, though they cannot tell for sure</li>
 <li>The hack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook</li>
 </ul>
 
</div>



A hacker produced a phishing pop-up on Polygon and Fantom this morning warning users their funds were at risk and urging them to enter their private account keys.&nbsp;



The hacker accessed Polygon and Fantom’s remote procedure call (RPC) interfaces through the Web3 infrastructure platform Ankr by tricking a third party domain name system (DNS) provider into giving the hacker access to Polygon and Fantom’s domains.



Ankr’s DNS is hosted on a web service named Gandi, and its customer support has a section for clients who want to change the administrator’s email for a domain.


<div class="wp-block-image">
<figure class="aligncenter is-resized"><img loading="lazy" decoding="async" src="https://lh6.googleusercontent.com/1o_R5kAc11QEYSiJNBjnVw8H47zLNZwxe6yLZgnvQBcc_s_X2ZYYZjkAM5UrsuYD_Nt0IPLrT2iV6cjO2-aJby895yT0tzUKO1XZvn5sGPZTw7vuFb3LlHIB5_maJPr40CCpRLZONbepryvVA5c" alt="" width="492" height="160"/><figcaption>Customer service communication at Gandi | Source: Ankr</figcaption></figure></div>


Posing as an Ankr employee, the hacker sent Gandi a fake identity card and convinced the platform’s customer support service to change the email address for the domain registrar account from Ankr’s to the hacker’s Hotmail account.



Ankr is “still trying to understand what [Gandi] accepted as proof for this change,” Peter Stewart, integration manager at Ankr, said.



Ankr was able to regain control of the DNS within six hours of the attack. Sources at Polygon and Ankr told Blockworks that no user funds were compromised, but also conceded they cannot conclusively determine whether any users fell victim to the phishing attack.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Attention please, attack on <a href="https://twitter.com/0xPolygon?ref_src=twsrc%5Etfw">@0xPolygon</a> is ongoing right now! Users see an RPC error asking users to urgently reset their seed on polygonapp net (looks like this is wether DNS hijack or a form of a supply chain attack). Just a scam popup to bring you to a page to put your seed. <a href="https://t.co/fZxtlkKeDN">pic.twitter.com/fZxtlkKeDN</a>&mdash; CIA Officer (@officer_cia) <a href="https://twitter.com/officer_cia/status/1542829400143568897?ref_src=twsrc%5Etfw">July 1, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“DNS is unfortunately still a centralized point of failure in the internet,” Ankr co-founder Ryan Fang told Blockworks via Telegram.&nbsp;



Fang said Ankr will continue to work with Gandi, but it will ask its DNS providers to use two-factor authentication moving forward.



The phishing attack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook — and as NFT (non-fungible token) sales reach their lowest point in a year, according to the blockchain research platform Dune.



“It was a third party outage that does not affect Polygon in any way. Meta is not using that third party either,” <a href="https://www.linkedin.com/in/mudit4/?originalSubdomain=in" target="_blank" rel="noreferrer noopener">Mudit Gupta</a>, chief information security officer at Polygon, told Blockworks.



Meta did not immediately respond to a request for comment.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Ankr

Hacker Posed as Ankr Employee To Phish Polygon and Fantom Users

Bessie Liu

<div id="highlights-block_62a11c5d87f7a" class="highlights">
 <ul>
 <li>A hacker has acquired 20 million Optimism governance tokens intended for a loan</li>
 <li>The attacker has since transferred or sold about one million tokens — but that’s likely just the start</li>
 </ul>
 
</div>



The airdrop of first-time governance tokens from Ethereum scaling solution Optimism has gone awry in a major way — thanks to a third-party the collective tapped to provide liquidity.



All told, about 20 million Optimism governance tokens (OP) that were loaned to facilitate transactions were lost, with cryptocurrency market maker Wintermute taking responsibility for the lapse.



The loan was initially deployed on Wintermute’s wallets on Optimism, but Wintermute CEO Evgeny Gaevoy said in a <a href="https://gov.optimism.io/t/message-to-optimism-community-from-wintermute/2595" target="_blank" rel="noreferrer noopener">statement</a> that “we made a serious error.” 



Here’s what happened: The wallet address Wintermute used to receive the loan was inaccessible, because it relied on Ethereum layer-1 multi-signature technology that had yet to be deployed to Optimism, which runs as a layer-2. A layer-1 is the foundational function of a given blockchain, while layer-2s are built on top, typically to provide new features or liquidity.



A hacker, meanwhile, took advantage of the technological lapse to transfer the 20 million OP tokens from layer-1 to layer-2, even as Wintermute scrambled to recover the in-limbo funds. The attacker, however, had as of publication only liquidated about a million of the stolen tokens.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">More important is what they knew and when. They knew about this on May 30th. There was a 15 hour gap between the test transaction of 1 <a href="https://twitter.com/search?q=%24OP&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$OP</a> and the following transaction. They didn&#39;t notice something was wrong? They knew 1 million was dumped on 6/5. Did exchanges know about this?&mdash; Benjamin Singer (@BenjaminSinger8) <a href="https://twitter.com/BenjaminSinger8/status/1534657594836627457?ref_src=twsrc%5Etfw">June 8, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“L1 is confusing enough for most people to navigate, and L2 brings a new set of paradigms over key management and safety, even for experienced crypto users and teams,” Gaevoy said.&nbsp;



“We are not sure why they chose not to liquidate all of it at once,” Gaevoy said. “There is hope that it is a white hat exploit, in which case the remaining funds are potentially recoverable. However we are currently operating under the premise that it is not the case, since we haven’t received any communication from them and our message on the chain was left unanswered.”



The attacker still owns 19 million OP tokens. Wintermute said the company plans to buy back the tokens once the attacker sells, saying the purchase “can potentially create price volatility in the token,” but that the market maker will “make best efforts to smoothen the effect.”



The Optimism Foundation has not chosen to update its network — likely requiring a hard fork — to halt the movement of stolen OP tokens that have not yet been stolen or sold as the foundation believes that “using centralized control to attempt a partial recovery would set a significant precedent.”



Security flaws and the illicit process of attaining cryptoassets have become a common problem for many platforms, and <a href="https://cms.blockworks.co/bipartisan-crypto-bill-hits-congress-with-focus-on-cftc-jurisdiction-taxes/" target="_blank" rel="noreferrer noopener">lawmakers are eager</a> to look for solutions.



It comes down to the hallmark phrase, “Not your keys, not your coins,” Ashton Wolfe, the project lead of Crypto Fight Club, told Blockworks.



“Of course, to protect people&#8217;s assets, governments will think that continuously hammering down on regulations will fix this solution,” Wolfe said. “Unfortunately, this still hasn’t worked, because it is a very slow process, and users resent uploading private documents to these counter-parties in order to use the platform.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

hack

In Latest Crypto Hack, 20M Tokens Lost as Market Maker Wintermute Takes Blame

<div id="highlights-block_629fb10800a8f" class="highlights">
 <ul>
 <li>No user funds were lost or stolen before the loophole was discovered</li>
 <li>Up to $200 million worth of Aurora users’ funds could have been hacked if this bug wasn’t fixed</li>
 </ul>
 
</div>



It was almost the next market-moving DeFi hack.&nbsp;



Aurora, an Ethereum Virtual machine built on the NEAR Protocol, recently paid a $6 million reward to a so-called white hat hacker for identifying a key bug. 



The hacker, known as pwning.eth, uncovered in April a critical vulnerability in Aurora’s system, which could have jeopardized up to $200 million of funds. Virtual machines power smart contracts, or transactions executed in code on the blockchain without intermediaries, on Ethereum. Aurora paid the bounty through the Immunefi platform. 



It marks one of the largest-ever known bounty payouts in DeFi (decentralized finance) history. Last month, crypto bridge Wormhole — which connects different blockchains — <a href="https://www.theblockcrypto.com/post/148085/wormhole-announces-10-million-bug-bounty-payout" target="_blank" rel="noreferrer noopener">paid</a> $10 million to an ethical security hacker that also discovered a bug through Immunefi’s platform.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“Such a vulnerability should have been discovered at an earlier stage of the [defense] pipeline and we have already started improving our methods to achieve that in the future,” Frank Braun, Aurora’s head of security, said in a statement Tuesday. </blockquote>



Added Braun: “However this event ultimately proves that our security mechanisms work.”



The bug was initially flagged via Immunefi — crucially, before any funds were stolen. <a href="https://immunefi.com/bounty/aurora/" target="_blank" rel="noreferrer noopener">Aurora&#8217;s bounty program</a> with Immunefi was launched in April 2022, with rewards ranging from $1,000 to $6 million, depending on severity. 



Jonah Michaels, a spokesperson for Immunefi, told Blockworks that at “a time of distrust in the markets, it’s important more than ever for Web3 projects to show that they take security seriously.”



On Immunefi’s platform, security researchers review code and disclose vulnerabilities. Through its programs with DeFi projects, Immunefi said it paid over $40 million in bounties to friendly hackers — claiming to have prevented over $20 billion in potential damages.



Aurora’s goal is to provide application developers the means to operate on Ethereum-compatible platforms under the governance of the decentralized Aurora DAO. Aurora’s scaling solution is currently responsible for $373 million of NEAR’s $786 million in total value locked, <a href="https://defillama.com/chain/Aurora?currency=USD" target="_blank" rel="noreferrer noopener">according to data provider DefiLlama</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Aurora

$6M Bounty Paid to White Hat Hacker Likely Averts Sizable DeFi Hack

Ornella Hernandez

<div id="highlights-block_628f85197553a" class="highlights">
 <ul>
 <li>Asset Reality specializes in investigating, tracing and attempting to recover funds</li>
 <li>New service will pool data from a number of scam victims to help trace stolen assets</li>
 </ul>
 
</div>



ConsenSys’ self-custody wallet MetaMask is partnering with Asset Reality, a platform for accessing and recovering seized crypto and digital assets, to tackle cryptocurrency fraud. The two companies will support MetaMask scam and phishing victims in attempting to recover their assets.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We’ve partnered with <a href="https://twitter.com/MetaMask?ref_src=twsrc%5Etfw">@metamask</a>! We’ll be helping victims of crypto-related fraud to recover their stolen digital assets in an industry-first approach to improving virtual asset recovery. Read more about this exciting new partnership: <a href="https://t.co/WBdRjWp1W0">https://t.co/WBdRjWp1W0</a><a href="https://twitter.com/ConsenSys?ref_src=twsrc%5Etfw">@Consensys</a> <a href="https://twitter.com/hashtag/crypto?src=hash&amp;ref_src=twsrc%5Etfw">#crypto</a>&mdash; Asset Reality | Techstars ‘21 🚀 (@asset_reality) <a href="https://twitter.com/asset_reality/status/1529809582868074496?ref_src=twsrc%5Etfw">May 26, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The main security concerns for crypto wallet users are phishing scams that cast a wide net, as well as targeted spear-phishing attacks, according to MetaMask. Bad actors most commonly pose as a friendly face offering to help users navigate crypto’s technical jargon and trick users into handing over their funds.&nbsp;



MetaMask’s strategy is to pool information from a number of victims in the hope that it will help both identify the scammer and make recovering the stolen assets less costly. To use the service, victims must <a href="https://fund-loss-investigation.metamask.io/" target="_blank" rel="noreferrer noopener">submit a ticket</a> for investigation.



Some examples of recent attacks include a <a href="https://cms.blockworks.co/metamask-issues-warning-following-icloud-phishing-scam/" target="_blank" rel="noreferrer noopener">$650,000 phishing scam</a> of a MetaMask wallet user targeted by a hacker posing as an Apple employee. MetaMask’s response, which was criticized at the time by community members, was to issue a warning to users whose data were susceptible to hackers because their iCloud backups include their password-encrypted MetaMask vault.



Earlier this week, a Moonbirds NFT holder <a href="https://twitter.com/CirrusNFT/status/1529296043547865088?s=20&amp;t=RZ-rlCczPtsuuzlqXc70ug" target="_blank" rel="noreferrer noopener">lost</a> 29 of his Ethereum-based Moonbirds, worth around $1.5 million at the time, after signing a bad transaction on a fake trading site he reached by clicking a malicious link shared by a scammer. The victim was a member of the Proof Collective, a private group of 1,000 dedicated NFT (non-fungible token) collectors and artists. Although the scammer was <a href="https://twitter.com/knownasdollar/status/1529297355396489217?s=20&amp;t=MVMqcnyASCcJ24AUrlFiBg" target="_blank" rel="noreferrer noopener">identified</a>, only an FBI report was filed.&nbsp;



Harry Denley, an information technology security analyst at MetaMask, told Blockworks that bad actors are “simply taking advantage of a nascent industry where new users are generally optimistic, excited by the potentials, and not very experienced with having full control of such valuable assets.”



Cybercrime is a multi-billion dollar worldwide industry, he added, emphasizing the importance of hack victims coming forward, no matter how small the loss.&nbsp;



Traditional recovery, however, involves lengthy and often costly civil litigation, with no guarantee of recovering funds. According to MetaMask&#8217;s support product lead Alex Herman, digital asset recovery is difficult due to the cryptocurrency’s “pseudo-anonymous” and “immutable” nature. 



“While traditional systems opt for transactions to be reversible and accounts to be frozen, crypto has prioritized the control of the individual user and decentralized systems. Bad actors can also use obfuscation techniques to make it harder to track stolen funds,” Herman told Blockworks.&nbsp;



In the case of a scam, MetaMask will request any relevant information regarding phishing websites, vectors and funds lost, while Asset Reality will handle the case for MetaMask’s affected users. They will build an investigation into each scam operation and manage any communication with the users.



Along with recovery mechanisms in place, MetaMask and Asset Reality hope to protect users by expanding their education tools and offerings on their platform.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Asset Reality

MetaMask Moves To Help Crypto Scam Victims Recover Stolen Digital Assets

<div id="highlights-block_625dbcbbd85d4" class="highlights">
 <ul>
 <li>The wallet app is asking users to disable iCloud backups for MetaMask by going into Settings &gt; Profile &gt; iCloud &gt; Manage Storage &gt; Backups</li>
 <li>MetaMask&#8217;s response has drawn criticism from community members</li>
 </ul>
 
</div>



Crypto wallet MetaMask issued a warning advising users to disable their iCloud backups following an exploit of Apple&#8217;s service in an estimated $650,000 phishing scam.



The DeFi wallet provider said Sunday users who have iCloud enabled for iPhone application data were susceptible to hackers because the backups include their password-encrypted MetaMask vault.



&#8220;If your password isn’t strong enough and someone phishes your iCloud credentials, this can mean stolen funds,&#8221; MetaMask <a href="https://twitter.com/MetaMask/status/1515727239391809536" target="_blank" rel="noreferrer noopener">tweeted</a>.



The company did not immediately return a request for comment.



In one such phishing attack, hackers drained an estimated $650,000 from NFT investor Domenic Iacovone&#8217;s OpenSea account, including several Mutant Ape Yacht Club collectibles, on April 14.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Hey y’all, let’s see how amazing this community can be. My entire wallet was just stolen. Totally wiped out, MAYC 28478, MAYC 8952, MAYC 7536 Gutter cat 2280 , 2769, 2325 Also stole 100k in ape coin. Looking for all the help I can get. 100kreward <a href="https://twitter.com/BoredApeYC?ref_src=twsrc%5Etfw">@BoredApeYC</a> <a href="https://twitter.com/GutterCatGang?ref_src=twsrc%5Etfw">@GutterCatGang</a>&mdash; Domenic Iacovone (@revive_dom) <a href="https://twitter.com/revive_dom/status/1514751885126914051?ref_src=twsrc%5Etfw">April 14, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



&#8220;Got a phone call from Apple, literally from Apple (on my caller Id) called it back because I suspected fraud and it was an Apple number,&#8221; Iacovone <a href="https://twitter.com/revive_dom/status/1514752274471473152?s=20&amp;t=Mz55J5At86ofD9lN1ccoLA" target="_blank" rel="noreferrer noopener">tweeted</a>. &#8220;So I believed them, they asked for a code that was sent to my phone and two seconds later my entire MetaMask was wiped.&#8221;



MetaMask&#8217;s response has drawn criticism from community members who argue the backup feature used in iCloud should either be disabled or made tougher for hackers seeking a way into users&#8217; digital wallets.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">100% metamask will need to fix that shite <a href="https://t.co/M9E3DBt8p5">https://t.co/M9E3DBt8p5</a>&mdash; Br Br the podcast Snek (@bryanbrake) <a href="https://twitter.com/bryanbrake/status/1515767252292812801?ref_src=twsrc%5Etfw">April 17, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



MetaMask parent ConsenSys in February said it was looking to <a href="https://cms.blockworks.co/onboarding-the-next-wave-of-metamask-users-through-nfts/" target="_blank" rel="noreferrer noopener">leverage NFTs</a> (non-fungible tokens) as a means to onboard more users to its digital wallet while building out a white-label NFT platform.



While efforts are being made on that front, critics argue cases like Iacovone&#8217;s demonstrate ConsenSys&#8217; need to improve security if it aims to bring on the &#8220;next wave&#8221; of wallet users.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Domenic Iacovone

MetaMask Issues Warning Following $650K iCloud Phishing Scam

Morgan Chittum

<div id="highlights-block_622a7d366e37d" class="highlights">
 <ul>
 <li>MetaMask, Trust Wallet and Math Wallet are the most commonly used wallets</li>
 <li>16% of respondents said their accounts on NFT platforms had been previously hacked</li>
 </ul>
 
</div>



From multi-million dollar rugpulls to user exploits on marketplaces, investing in NFTs can be fraught with risk.&nbsp;



New York gallery owner Todd Kramer, for example, had <a href="https://www.vice.com/en/article/y3v3ny/all-my-apes-gone-nft-theft-victims-beg-for-centralized-saviors" target="_blank" rel="noreferrer noopener">$2.2 million</a> of NFTs (non-fungible tokens) <a href="https://www.artnews.com/art-news/news/todd-kramer-nft-theft-1234614874/" target="_blank" rel="noreferrer noopener">stolen</a> in January through a phishing scam.



Half of NFT owners have lost access to at least one of their digital collectibles before, according to a March 8 <a href="https://privacyhq.com/news/nft-and-wallet-security/" target="_blank" rel="noreferrer noopener">report by research firm PrivacyHQ</a>.



The study, which polled over one thousand collectors, showed two out of three NFT investors “panic sold” one of their blockchain-based collectibles last year.&nbsp;



Justin Kan, co-founder of NFT gaming marketplace Fractal and streaming platform Twitch, told Blockworks users should follow precautions to safeguard their assets.



“There [are] a high level of rugpulls and scams [in NFTs],” Kan said. “[But] hopefully as the space matures, companies will be able to provide protocols that will be able to [offer] this kind of security for their users.”&nbsp;



“You should have a burner wallet when you&#8217;re minting, have a cold wallet for storage of your NFTs, and you should be aware of phishing attacks.”



Per the survey, 16% of respondents said their NFT platforms had been hacked, but roughly 90% said they were able to recoup losses in some capacity. 



MetaMask, Trust Wallet and MathWallet are the most popular NFT wallets — with MetaMask believed to be the safest.



“Don&#8217;t [click on] links,” Kan said. “We [recommend] typing out Fractal.is in your browser. Now, people in Web2 are going to [say], ‘That&#8217;s insane that you have to do all these protections.’ But I think it&#8217;s the cost of having true ownership of [something.] You kind of have to rebuild the space from the ground up.”



Security concerns, however, didn’t seem to slow the exponential growth of the industry last year. NFT sales reached $17.7 billion in 2021, up from $82.5 million in 2020, according to a <a href="https://nonfungible.com/reports/2021/yearly-nft-market-report-pro" target="_blank" rel="noreferrer noopener">Thursday report</a> from NonFungible.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Fractal

Report: 50% of NFT Holders Have Lost Access to Their NFTs

Ben Strack

<div id="highlights-block_622108a13a7ee" class="highlights">
 <ul>
 <li>The Financial Conduct Authority added 172 firms to its list of unregistered crypto businesses during the six-month period</li>
 <li>More people checked the safety of cryptocurrency using the FCA’s ScamSmart Warning List tool than any other investment opportunity</li>
 </ul>
 
</div>



Reports of potential crypto scams shot up in the middle of 2021, according to the UK’s Financial Conduct Authority (FCA), as the regulator seeks to further crack down on actors causing investor harm.



The FCA had roughly 16,400 reports of possible scams between April and September of 2021, according to agency findings published Thursday — up from 12,400 over the same period the year prior.



<a href="https://www.investopedia.com/terms/b/boilerroom.asp" target="_blank" rel="noreferrer noopener">Boiler rooms</a> were the most commonly reported scam, where fraudsters cold-call investors offering them worthless, overpriced or even non-existent shares or bonds.



The three other most common reports were of cryptocurrency scams, FCA impersonation scams and recovery rooms — where fraudsters offer to help investors who were scammed or lost money on an investment get their money back for an upfront fee.



Overall, the FCA stopped 32 new firms, or 25%, from entering the consumer investments market between April and September.



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="683" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg" alt="" class="wp-image-18181" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=386 386w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=392 392w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=329 329w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/03/chart-1024x683.jpeg?w=1200 1200w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



Of the more than 16,000 scam inquiries, about 3,000 were related to cryptocurrencies — up 14% from the previous six months.



The FCA also offers a ScamSmart Warning List tool, which allows people to check the safety or risks of an investment opportunity. Cryptocurrency represents 34% of the checks, the most of any investment opportunity. The checks on crypto grew to 4,320&nbsp; — a 49% from the prior six months.



“The watchdog is swimming against an increasingly treacherous tide of scams and suspect investments,” said Susannah Streeter, senior investment and markets analyst at Hargreaves Lansdown.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“Given the volatile rise of coins and tokens over the pandemic, it seems many more fraudulent operations have been launched, to take advantage of consumers’ fear of missing out on the crypto rollercoaster.”</blockquote>



The number of consumers in the UK holding cryptocurrency was estimated to be 2.3 million, according to <a href="https://www.fca.org.uk/publications/research/research-note-cryptoasset-consumer-research-2021" target="_blank" rel="noreferrer noopener">an FCA report</a> published in June.



The FCA’s cryptoasset team — responsible for supervising firms’ compliance with money laundering regulations — opened more than 300 cases relating to potential unregistered businesses in the space during the six-month period. The regulator noted that many of these businesses are likely involved in scams.&nbsp;



The FCA added 172 firms to its <a href="https://register.fca.org.uk/s/search?predefined=U" target="_blank" rel="noreferrer noopener">list of unregistered crypto businesses</a> during the period and made 10 referrals to the Advertising Standards Authority (ASA).



Crypto businesses that were already trying to register with the FCA have until March 31 to register with the regulator to continue trading. The regulator is also evaluating new applications separately.&nbsp;



The FCA is considering firms’ anti-money laundering and counterterrorist financing measures when assessing applications. Crypto market maker Wintermute announced in a Twitter post Monday that it is now registered with the FCA. But dozens of firms with temporary registrations — including <a href="https://www.revolut.com/system-status?sprediki2006/2006-19spred.htm/" target="_blank" rel="noreferrer noopener">Revolut</a>, a $33 billion neobank that includes crypto among its service offerings — are still awaiting a decision from the FCA.



“A significantly high number of businesses” are not meeting the required standards, according to <a href="https://www.fca.org.uk/news/press-releases/temporary-registration-regime-extended-cryptoasset-businesses" target="_blank" rel="noreferrer noopener">a March 2021 press release</a>, resulting in many businesses withdrawing their applications.



The latest data follows the UK government <a href="https://cms.blockworks.co/uk-government-seeks-to-boost-regulation-of-crypto-ads/" target="_blank" rel="noreferrer noopener">revealing plans in January</a> to strengthen its rules on crypto advertisements to protect consumers from misleading claims. The proposal called for bringing cryptoasset advertising under the rules of the FCA — the same standards that stocks, shares and insurance products are held to.



“It’s clear that education needs to be sharpened up pretty pronto with so many vulnerable consumers being lured in,” Streeter said. “It’s very welcome that crypto assets will soon fall under the FCA’s watch as part of new legislation.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>