2024

Bitcoin

Elon Musk

Crypto scams, hacks and exploits and how to avoid them: Crypto-Sec
<h2 class="wp-block-heading" id="deepfake-scams-bitcoin-conference-ai-drains-79k">Deepfake scams: Bitcoin conference AI drains $79K</h2>
As the Bitcoin 2024 conference was taking place on July 25-27, crypto users lost over $79,000 due to a deep-fake AI livestream of the conference. The fake livestream featured footage of Elon Musk giving a speech, but while Musk had been rumored to attend, he did not actually speak at the conference and obviously had no involvement with the video like countless other Musk related scams online.
Michael Dunworth, co-founder of crypto payments service Wyre, <a href="https://x.com/MichaelDunwort1/status/1816996181437997093" target="_blank" rel="noopener noreferrer nofollow">reported</a> the deep-fake scam through a post to X on July 26. Ive had people call me telling me Elon Musk is giving free Bitcoins away at Bitcoin 24, he stated. No wonder, they have a fake live stream with dubbed voice over, and 70k+ (fake) people watching the live stream.
According to Dunworths post, the fake livestream video was posted to a channel called Tesla, which was named after Elon Musks car company but was not endorsed by it. The real livestream of the conference, on the other hand, was posted by Bitcoin Magazines official YouTube channel.
Bitcoin consulting firm <a href="https://x.com/Thebitcoinway_/status/1817273757683335478" target="_blank" rel="noopener noreferrer nofollow">The Bitcoin Way</a> reported another version of the scam on July 27. This version was reportedly posted to a YouTube channel called KHORTEX.
<figure class="wp-block-image aligncenter is-resized"><img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcibSpLyDjWMRtjx6IsL-TjQqnMJ_nVBhtHBMcWW-r0QQVnnuLQfFln8BhwteTsGFIAuM2IJLlmCNP6wPMOTTyY-PR0Y8h-NPk1T-tKxBF6WwAfNN1SAmDkkR4MJLOpqzPyafQV1-io7om2aqK7FuFw8KA?key=8B49W-5sZqhaaReZdfZ4iw" alt="‘Elon Musk at Bitcoin 2024’ scam, Lazarus Group hacks, MOG phishing: Crypto-Sec" style="width: 100%;height:auto">
</figure>
The livestream reportedly featured an AI-generated video of Elon Musk telling viewers to send Bitcoin to a particular address, which it claimed would allow them to receive double back. A similar Elon Musk deep-fake scam <a href="https://cointelegraph.com/news/elon-musk-deepfake-ai-crypto-fraud-hong-kong" target="_blank" rel="noopener noreferrer nofollow">circulated in May</a>.
Blockchain data shows that some viewers did send crypto to the scam addresses. The Bitcoin network address associated with the scam <a href="https://www.blockchain.com/explorer/addresses/btc/bc1qaghe3w2k538gz2h0t7jl8hl0q77j29se3wxjsc" target="_blank" rel="noopener noreferrer nofollow">received</a> over 0.77 Bitcoin (BTC), worth approximately $53,000 based on the Bitcoin price at the time, from July 28-29. An additional 4.531 Ethereum (ETH) (worth approximately $26,000) was <a href="https://etherscan.io/address/0xF8136c92ADCd0Eb214E499B7176c4C82642D6141" target="_blank" rel="noopener noreferrer nofollow">sent</a> to the scammers Ethereum address and 4,136 Dogecoin (DOGE) (worth $537.34) was <a href="https://dogechain.info/address/DBEiZ1ivSYjWn6oukxW5gH1phtWS1oXM27" target="_blank" rel="noopener noreferrer nofollow">transferred</a> to the Dogecoin address. In total, viewers of the fake livestream lost over $79,000 from the scam.
Deep-fake scams are on the rise and while videos may appear to feature a trustworthy source, they can be completely fake, AI-generated content. Always confirm the source of videos to determine their authenticity before relying on any information in them and if an investment idea seems too good to be true, it probably is. Nobody is going to send you twice as much crypto back for one thing.
<h2 class="wp-block-heading" id="phish-of-the-week-mog-holder-gets-mogged-by-scammer">Phish of the week: MOG holder gets mogged by scammer</h2>
A holder of meme coin MOG lost over $148,000 from a phishing scam on July 28. The attacker drained 82 billion MOG from the victims wallet 16.4 billion of which ($29,720 based on the price at the time) went to the developer of the draining app and the other 65.6 billion ($118,880) went to the phishing scammer. Blockchain security firm PeckShield reported the attack on X.
MOG is a meme coin meant to celebrate the pickup-artist concept of mogging, or asserting ones dominance over another person to show ones attractiveness to a third person. The coin was launched in July, 2023. It has <a href="https://coinmarketcap.com/currencies/mog-coin/" target="_blank" rel="noopener noreferrer nofollow">increased</a> by over 3,617% since February, according to data from Coinmarketcap.
<figure class="wp-block-image aligncenter is-resized"><img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcf4duxpOcDkYT-_XLHjWLnBK61Ujhxz7w7gCvrcJQt89NelwBIGMMH9NqUAt_UjeqDiOCb5B2N1hgUiyzuMbprpywCA_3_1hB9U4SjccnAqqk7dULH-x_8ueX4QK8sQ0idgIQY8YtozkyLCwwcuz5MThw?key=8B49W-5sZqhaaReZdfZ4iw" alt="‘Elon Musk at Bitcoin 2024’ scam, Lazarus Group hacks, MOG phishing: Crypto-Sec" style="width: 100%;height:auto">
</figure>
According to PeckShield, the attacker also drained $10,000 worth of BASED tokens from the victim in a separate attack on the Base network.
In technical terms, what happened was that on the Ethereum network, the victim appears to have submitted a signed transaction message authorizing the attacker to call the Permit2 function on Uniswaps official router. Blockchain data shows that the victims account was <a href="https://etherscan.io/tx/0xb4b5db197cce18f3936515fe6f3689c214a005b1d7dc89e52fa8318a1aa59fdc#eventlog" target="_blank" rel="noopener noreferrer nofollow">set</a> as the owner and a malicious smart contract with an address ending in cbbF was set as the spender.
<figure class="wp-block-image aligncenter size-large is-resized"><img decoding="async" width="1024" height="317" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/permit-2-1024x317.jpg" alt="Permit 2" class="wp-image-34767" style="width: 100%;height:auto" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/permit-2-1024x317.jpg 1024w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/permit-2-300x93.jpg 300w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/permit-2-770x238.jpg 770w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/permit-2.jpg 1253w" sizes="(max-width: 1024px) 100vw, 1024px">
 <figcaption class="wp-element-caption">
 Phishing attacker calling Permit2 on Uniswap. (Etherscan)
 </figcaption>
</figure>
The malicious spender contract was created by a known phishing account labeled Fake_Phishing188615 on Etherscan and was <a href="https://etherscan.io/address/0x991cd82CA8972eD36BDFD3d41B7Eb51fbb04cbbF#internaltx" target="_blank" rel="noopener noreferrer nofollow">created</a> at the moment the Permit function was called.
<figure class="wp-block-image aligncenter size-large"><img decoding="async" width="1024" height="179" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/mog-1024x179.jpg" alt="MOG" class="wp-image-34766" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/mog-1024x179.jpg 1024w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/mog-300x53.jpg 300w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/mog-770x135.jpg 770w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/07/mog.jpg 1262w" sizes="(max-width: 1024px) 100vw, 1024px">
 <figcaption class="wp-element-caption">
 MOG phishing attacker creates malicious contract. (Etherscan)
 </figcaption>
</figure>
Crypto phishing is a technique that scammers use to trick users into making token approvals they didnt intend, usually by setting up a fake website that appears to be from an authoritative source. To help avoid such scams, crypto users should take care not to sign transaction messages if theyre not sure what they contain or if the website they are using is not familiar to them.
Phishing scammers usually operate from a domain name that is not the official domain name of the company they are pretending to be, so checking the URL of a site is also sometimes an effective means of avoiding these scams. However URLs can look very similar due to the use of substitute characters from languages other than English that look almost the same.
<h2 class="wp-block-heading" id="cexs-dmm-hacker-mixes-funds-with-poloniex-hacker-wallet">CEXs: DMM hacker mixes funds with Poloniex hacker wallet</h2>
On July 27, on-chain sleuth ZachXBT reported that funds from the May 31 DMM hack have now been <a href="https://x.com/zachxbt" target="_blank" rel="noopener noreferrer nofollow">intermingled</a> with those from the Poloniex hack from November 2023, implying that these two hacks must have been performed by the same individual or group. ZachXBT suspects that both attacks were performed by the Lazarus Group.
Earlier today remaining dust from the Poloniex November 2023 hack and DMM Bitcoin May 2024 hack consolidated into the same address further showing the Lazarus Group ties, he stated.
In crypto transactions, the term dust refers to very small amounts of crypto that may be left over in a wallet after larger transactions have been made. Zach mentioned two different wallet accounts in the post, one of which contains approximately $0.10 worth of ETH and another which holds less than $0.01 worth.
The DMM hack was the largest exploit against a central exchange in 2024 so far. Over $300 million was lost in the attack.
Also read: <a target="_blank" href="https://cointelegraph.com/news/japanese-exchange-dmm-loses-bitcoin-private-key-hack" rel="noopener noreferrer nofollow">Japanese exchange DMM loses $305M in Bitcoin via private key hack</a>
<h2 class="wp-block-heading" id="ransomware-microsoft-discovers-esxi-backdoor">Ransomware: Microsoft discovers ESXi backdoor</h2>
Microsoft reportedly discovered a new vector of attack being used by crypto-ransomware attackers. It <a href="https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/" target="_blank" rel="noopener noreferrer nofollow">released</a> the findings of its research through a blog post on July 29. The vulnerability affected ESXi servers, although it has now been eliminated through a patch.
ESXi server software, produced by VMWare, runs directly on an enterprise-grade device, bypassing its operating system. This kind of software is often called bare metal.
Microsoft found that a flaw in the ESXi server code allowed ransomware attackers to take control of the device and encrypt its contents, crashing its operations and making recovery impossible without obtaining the attackers decryption key. Researchers observed multiple attacks that relied on this vulnerability, including some that installed the notorious Akira and Black Bast ransomware programs.
To carry out the attack, hackers only needed to enter the commands, net group ESX Admins /domain /add and net group ESX Admins username /domain /add. Entering these commands would give the attackers full administrative access to the device, allowing them to encrypt all of its contents.
These commands worked because the domain group ESX Admins by default had full administrative access, even though the group did not exist by default and no validation process checked to see whether it existed.
Ransomware is a type of malicious attack that involves the attacker stealing files and locking and damaging a device in an attempt to cause ongoing harm to a company. The attacker then demands payment in cryptocurrency in return for repairing the damage or restoring the device. Because of the irreversible nature of blockchain transactions, cryptocurrency networks are <a href="https://cointelegraph.com/news/the-role-of-cryptocurrencies-in-the-rise-of-ransomware" target="_blank" rel="noopener noreferrer nofollow">favored as a means of payment</a> by ransomware attackers.
Also read:<a target="_blank" href="https://cointelegraph.com/magazine/wazirx-exchange-hackers-fake-tether-scams-asia-express/" rel="noopener noreferrer nofollow"> WazirX hackers prepped 8 days before attack, swindlers fake fiat for USDT: Asia Express</a>

‘Elon Musk at Bitcoin 2024’ scam, Lazarus Group hacks, MOG phishing: Crypto-Sec

Table of Contents

Cointelegraph

Other articles published on Jul 31, 2024

XRP's Bollinger Bands Tighten to Record Levels, Indicating Possible Breakout

Peter Schiff Slams Michael Saylor's Bitcoin Excitement

Investors Eye Volatile Cryptocurrencies

Internet Computer Price Sets Out For 12% Surge

T-Mobile Reports Q2: Beats EPS Expectations by $0.21

Democrat Ro Khanna Champions Bitcoin’s Bipartisan Future During Congress

Join our free newsletter for daily crypto updates!