crypto security4 articles
Trezor Customers Hit by Phishing Wave After Marketing Platform Botches SSO Security
Trezor has warned approximately 347,000 customers that they received phishing emails after its third-party marketing platform, Brevo, was hacked via a SAML Single Sign-On (SSO) vulnerability that allowed an attacker to gain unauthorized access to multiple accounts. The phishing emails, titled "Critical Security Alert: STM32 Entropy Vulnerability," directed users to a malicious website where entering their wallet backup could result in lost funds; around 2,500 users clicked the link before the site was taken down within 20 minutes. This breach follows a separate recent incident in which Trezor's shipping provider ShipMonk exposed the personal data of tens of thousands of customers, raising concerns about an increased risk of targeted phishing attacks against Trezor users.
Liquid Network Hackers Return Most of the $320M Bitcoin They Nicked, Hold Rest as Leverage
Hackers stole approximately 4,000 Bitcoin (~$320 million) from the Blockstream-developed Bitcoin sidechain Liquid Network by draining its federation wallet, prompting the suspension of all network transactions. The alleged "white-hat" hackers returned 3,400 Bitcoin (~$262.6 million) after urging Liquid to patch the underlying vulnerability, with around 598 Bitcoin (~$47 million) still outstanding. The network remains paused while Blockstream and federation members work on security fixes and prepare for a safe restart.
Someone Just Walked Off With 95% of Liquid Network's Bitcoin and Wants a Pat on the Back
Hackers drained approximately 4,000 BTC ($320 million) from the Liquid Network's federation wallet, representing around 95% of its holdings, while claiming to be white-hat security researchers. The individuals communicated via on-chain messages, asking Blockstream to contact them and promising to return "most" of the Bitcoin once the underlying vulnerability is patched. The exact method used to drain the wallet remains under investigation, as no Peg-out Authorization Keys appear to have been compromised.
Drainer-as-a-Service: How Crypto Wallet Theft Became a Subscription Business
Crypto drainers have evolved into sophisticated "Drainer-as-a-Service" (DaaS) platforms, where operators maintain the technical infrastructure while affiliates drive victims to fake crypto or DeFi websites, tricking them into approving malicious wallet transactions that instantly transfer their assets. An analysis of the "Lucifer DaaS" operation reveals it functions much like a legitimate SaaS business, complete with software updates, affiliate commissions, automated deployment tools, and operational resilience strategies such as migrating to decentralized hosting after takedowns. Users can protect themselves by being cautious of unsolicited wallet connection requests, unexpected approval prompts, urgent claims, and suspicious links received via social media or messaging platforms.