Ornella Hernandez

Jon Rice

Many might question the wisdom of launching a public fundraising event in the crypto space at the same time as trust in the sector is bottoming out.



But Tokensoft, a token sale platform in the process of creating The Soft DAO and airdropping governance tokens to users, seems to have given the crypto community an extra reason to think twice about sharing personal information.



Recent events with FTX’s solvency crisis and eventual <a href="https://cms.blockworks.co/news/ftx-is-bankrupt-but-you-can-still-trade-crypto-there/">bankruptcy filing</a> led many crypto users to panic over their frozen funds this week. 



Now around 4,500 participants in their airdrop have a new reason for concern, after a community manager in the Tokensoft Discord channel going by the name Nick G. <a href="https://twitter.com/cryptogle/status/1591542182346997767?s=20&amp;t=WK1z3d9dUs0S8LwLuMbOaA">appeared</a> to upload a document to the IPFS containing the names, addresses, IP addresses, email addresses and Ethereum wallet addresses of thousands of users. 



Doxing users is about the worst thing a crypto company can do, short of using their funds to fuel risky trades on a Bahamian exchange.



It may be a simple mistake: The Discord user may have thought he was uploading a list of ETH addresses only, and with the intent to illustrate addresses that were allegedly “gaming the airdrop”.



Blockworks reached out to Tokensoft and had not received a response at the time of publishing.



A leading crypto security expert told Blockworks that “Doing your own research is important, but knowing what data you’re giving to a new entity is also important. Before YOLOing into angel deals or token sales, it’s important to ask people where they’re keeping your data and what their policies are for deleting it and sharing it. As an easy 101 tip, never upload images of IDs or docs, and don’t send via Telegram or email without encryption or password protection.”&nbsp;



It’s not the first time this week that crypto users were reminded that trust can be misplaced.



<h2 class="wp-block-heading">FTX makes the case for self-custody</h2>



Most FTX customers, <a href="https://cms.blockworks.co/news/ftx-re-enables-withdrawals-but-only-in-bahamas/">if not in the Bahamas</a>, were unable to withdraw funds stored on the exchange. And some crypto owners are now learning a lesson about self-custody the hard way.



Many of those customers turned to hardware-based cryptocurrency wallet providers like Ledger and Trezor as a result. According to Ian Rogers, chief experience officer at Ledger, Thursday was their customer support teams’ most active day this year.&nbsp;



“Over 40% of requests came from users who wanted to safely move their crypto from exchanges to the safety of their Ledger Nanos,” Rogers said.



Due to the sudden surge in traffic on Wednesday, Ledger Live — the app integrated with the hardware device — experienced a server outage, which left users unable to send or withdraw funds. The issues were resolved after about one hour.&nbsp;



“We had an unusual load on the device manager service, which is likely to have been users updating their device for the first time in a while or using a brand new device for the first time,” Rogers told Blockworks.



Rogers added that Ledger is “seeing its highest rate of sales ever, with 7x growth week-over-week,” especially since the first signs of the crypto bear market in spring of this year.



A representative of SatoshiLabs, which markets the Trezor crypto hardware wallet, told Blockworks that it has seen comparable spikes in sales and traffic this week that correlate with <a href="https://cryptoslate.com/248m-stablecoins-flow-out-of-coinbase-as-community-refutes-exchange-liquidity-issues/">reports</a> of a Coinbase liquidity crisis in July and the Celsius crash in June.



Trezor saw its revenue from sales triple over Wednesday and Thursday, and traffic to its e-commerce site grow by 350% over the same period, according to the company.



Josef Tetek, brand ambassador for Trezor stated that while exchanges may provide a middleman service between sellers and buyers, “their incentive is to maximize earnings even when it’s not in their customers’ best interests.”



He added that exchanges “should never need to hold your keys for you.”&nbsp;



His words reference one of the most popular refrains of the crypto world and one that holds particularly true after this week’s events: Not your keys, not your coins.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.

4,500 Doxed Tokensoft Users, a Rush on Cold Storage Wallets: Where’s the Silver Lining?

Sebastian Sinclair

<div id="highlights-block_624a3801ea639" class="highlights">
 <ul>
 <li>Trezor said Saturday its newsletter had been breached by an &#8220;insider targeting crypto companies&#8221;</li>
 <li>The domain linked to the breach, ending in the extension .us, has since been taken down, the provider said</li>
 </ul>
 
</div>



Cryptocurrency hardware wallet provider Trezor said Saturday it was investigating a data breach of its opt-in newsletter hosted on marketing platform MailChimp.



A scam email warning of a breach began circulating last week, according to <a href="https://twitter.com/BitcoinUndisc/status/1510419050182193155?s=20&amp;t=OjLsoEmQ57LLJbPRig4NTA" target="_blank" rel="noreferrer noopener">affected users</a>. Trezor then sent a warning via <a href="https://twitter.com/Trezor/status/1510548489884815361?s=20&amp;t=6Trf0ek4sukiiyD2cFGbpw" target="_blank" rel="noreferrer noopener">Twitter</a> asking its users not to open emails originating from the phishing domain &#8220;noreply@trezor.us.&#8221; 



Users took to social media to warn against the scam email impersonating Trezor and its security team, which prompted victims to download the &#8220;latest version of Trezor Suite&#8221; and change their wallet PIN.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><a href="https://twitter.com/Trezor?ref_src=twsrc%5Etfw">@Trezor</a> Just got an email from “noreply@trezor.us” targeting TrezorSuite users. If you got similar, DO NOT ACT upon it. <a href="https://t.co/4cldJ46o3N">pic.twitter.com/4cldJ46o3N</a>&mdash; pbnather (@pbnather) <a href="https://twitter.com/pbnather/status/1510506712612184068?ref_src=twsrc%5Etfw">April 3, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The provider has since managed to take down multiple phishing domains targeting users including Trezor.us, according to a <a href="https://twitter.com/Trezor/status/1510558771944333312" target="_blank" rel="noreferrer noopener">follow-up tweet</a> on Sunday.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">&#8220;MailChimp has confirmed that their service has been compromised by an insider targeting crypto companies,&#8221; Trezor said. &#8220;We have managed to take the phishing domain offline. We are trying to determine how many email addresses have been affected.&#8221;</blockquote>



The company also said it would not communicate via its newsletter until the situation is resolved.



Questions have been <a href="https://twitter.com/CryptoShine/status/1510680599614394376?s=20&amp;t=R-0PAyuIpiHEbVXfEhhFYw" target="_blank" rel="noreferrer noopener">raised</a> by the community, wondering why the provider had not already registered top-level domains (TLD) including extensions .us, .net, and .com to prevent such attacks.



Still, <a href="https://twitter.com/0fab1e/status/1510697668946718720?s=20&amp;t=R-0PAyuIpiHEbVXfEhhFYw" target="_blank" rel="noreferrer noopener">some argue</a> hackers could easily circumvent TLD registration by imitating the domain name and changing a single character, such as &#8220;Trez0r,&#8221; to dupe victims.



Trezor did not immediately respond to Blockworks&#8217; request for comment.



This type of attack does not represent a threat to the cryptographic security of the hardware wallet, nor is it the first example of a crypto wallet firm being targeted. Rival hardware wallet manufacturer Ledger suffered a data leak of its marketing database <a href="https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach" target="_blank" rel="noreferrer noopener">in July 2020</a>, which resulted in its users being the target of phishing attacks and other forms of fraud.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.