Tag: Negative

Scammers Target Crypto Firms, Stealing $11.8 Million Through Fake Job Offers

Scammers posing as recruiters for cryptocurrency companies have successfully defrauded victims of $11.8 million (S$15.1 million) by leveraging fake job offers to compromise their employers’ systems, according to a joint advisory issued by the Singapore Police Force and the Cyber Security Agency of Singapore.

The agencies detailed the modus operandi of the scam in a statement released on Friday. The scheme typically begins with a victim being approached on LinkedIn by an individual claiming to be a recruiter for a cryptocurrency firm. Communications then shift to email, where the scammer uses a spoofed domain that closely mimics a legitimate company’s address. The process often involves several interviews conducted via Google Meet, during which the interviewer consistently keeps their camera off.

Following the interviews, the victim is directed to a fake website to complete a technical coding assessment. Crucially, this assessment is performed on a company-issued device, leading the victim to unknowingly download malicious software.

This malware is designed to capture a session token, a string that allows a service to keep a user logged in. By presenting this token, which signifies an already authenticated session, the attackers bypass multi-factor authentication and gain access to the victim’s Bitbucket account, a platform used for storing and managing source code.

Once inside, the attackers can alter the employer’s software systems and access internal servers. The agencies stated that the compromised credentials are then used to circumvent transaction limits and approval checks, ultimately enabling the theft of funds. The advisory does not name any specific companies involved, disclose the destination of the stolen funds, or attribute the attacks to any particular group.

This tactic is not new, with researchers having previously identified a long-running operation dubbed “Contagious Interview.” This operation involves fake recruiters directing Web3 developers toward malicious code, including over 300 booby-trapped packages uploaded to the npm registry. Another group, known as TraderTraitor, has employed similar fake job offers to infiltrate corporate cloud systems rather than targeting individual cryptocurrency wallets, a strategy one researcher suggested is due to the concentration of funds within these systems. Other attackers have impersonated recruiters from prominent companies like Coinbase and Uniswap to trick targets into executing commands.

While some of these campaigns have been attributed to North Korean hackers, the underlying playbook is not exclusive to them. The Russian-speaking group Crazy Evil, for instance, established a fabricated Web3 company, ChainSeeker.io, and advertised blockchain analyst roles to lure applicants into downloading malware designed to drain their digital wallets.

The Singapore agencies have provided advice for both individuals and companies. Individuals are urged to verify recruiters through official channels, treat interviewers who refuse to turn on their cameras as a red flag, and never execute code from unverified sources. For organizations, the recommendations include securing API keys and internal credentials, strengthening multi-factor authentication, and monitoring for unfamiliar devices and unusual network activity. In cases where a compromise is suspected, the agencies advise isolating affected systems, revoking active sessions, resetting credentials, and reviewing access logs.

A data breach at ShipMonk, Trezor’s shipping partner, has exposed the personal information of 13,689 Trezor customers, the company disclosed on Thursday, August 13, 2026. The incident involved unauthorized access to systems containing customer names, phone numbers, email addresses, and home addresses for some affected individuals.

Trezor’s Core Security Remains Intact
Trezor stated that its own systems were not compromised, and crucially, no Trezor devices, private keys, or wallet backups were accessed. The breach affected customers who placed orders between May 10 and August 8 and had them shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal. Of the total affected, 11,742 customers had their full details exposed, while an additional 1,947 customers had their names, cities, and email addresses compromised.

Trezor attributed the limited scope of the data exposure to its policy requiring partners to delete or anonymize order data 90 days after delivery. In its 13 years of operation, Trezor has not previously experienced a breach that exposed customer phone numbers and shipping addresses. Customers who have not received a notification email from Trezor are reportedly not affected.

Broader Threat Landscape and Industry Precedents
This incident occurs against a backdrop of increasing security threats targeting cryptocurrency holders. Hardware wallet firms have recently warned of a surge in phishing attempts, exacerbated by significant exploits such as the Coldcard breach, which reportedly coincided with losses approaching $130 million. CertiK reported 52 physical attacks on crypto holders globally in the first half of 2026, an increase from 39 in the same period the previous year, with home invasions becoming the most common method.

The precedent set by a similar breach at rival Ledger in January 2020, where data from its e-commerce partner Global-e coincided with widespread phishing and threats against customers, underscores the potential downstream risks associated with third-party vendor data exposures. Some reports suggest that a portion of Bitcoin moved from long-term holder wallets following the Coldcard exploit originated from Ledger and Trezor owners seeking more secure multi-signature setups, according to Casa.

Trezor’s Mitigation Efforts
In response to such risks, Trezor is accelerating the rollout of an Anonymous Delivery option. This service will feature locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers. The option is slated for implementation in the European Union by September and in the United States by the end of 2026.

Key uncertainties remain regarding the exact timeline of the unauthorized access to ShipMonk’s systems and the potential malicious use of the exposed customer data. Trezor advises customers to remain vigilant against phishing attempts and to never enter their wallet backup information online.

Why This Matters

The breach at Trezor’s shipping provider, ShipMonk, exposed personal data of Trezor customers, highlighting the persistent risks associated with third-party vendor security in the hardware wallet ecosystem. This incident underscores the evolving landscape of physical and digital threats targeting cryptocurrency holders, necessitating vigilance against phishing and physical attacks.

Broader Context

This factual news is placed within the context of increasing physical attacks on crypto holders and previous breaches at rival hardware wallet providers. The incident highlights the critical need for robust third-party vendor security and proactive customer protection measures, as demonstrated by Trezor’s introduction of an Anonymous Delivery option.

Whale Investor Suffers Second Major Crypto Heist, Losing Over $26 Million

A prominent cryptocurrency investor, known by the wallet address TLBL, has been hit by a second significant digital asset theft, losing more than $26 million. This latest incident follows a phishing attack two years ago that saw the same holder lose $24 million.

The recent exploit appears to stem from a compromised private key, raising critical questions for large-scale crypto holders about the efficacy of enhanced security measures when a wallet has already been a target.

On August 13, blockchain analytics firm Lookonchain reported that over $26 million in assets were drained from three wallets associated with TLBL. The firm indicated that the whale “appears to have had its private key compromised.” The stolen assets included aWBTC, DAI, WBTC, ETH, aUSDC, sDAI, USDS, cbBTC, and various other tokens.

Lookonchain’s analysis estimates the total value of assets lost across TLBL’s two major thefts to be approximately $50.3 million. The initial incident, occurring two years prior, involved the theft of 9,579 stETH, valued at $15.54 million, and 4,851 rETH, worth $8.51 million, through a phishing scheme.

The latest loss, however, differs in its apparent method. Security firm PeckShield stated the victim lost around $25.6 million, with significant portions including approximately $6.3 million in aWBTC, $5.1 million in DAI, $4.7 million in WBTC, and $2.6 million in ETH. PeckShield reported that the attacker had already converted a portion of the stolen funds into 20 million DAI and roughly 3,000 ETH, collectively valued at about $5.64 million, distributing them across four separate addresses.

Minor discrepancies in the reported figures between Lookonchain and PeckShield are attributed to variations in asset valuations used in their respective analyses. Nevertheless, both sources confirm a substantial draining of TLBL-linked wallets, with Lookonchain identifying a compromised private key as the likely cause.

In a separate development this week, Lookonchain also highlighted a smaller incident involving address poisoning. In this scenario, a victim inadvertently copied a wallet address directly from their transaction history without verification, subsequently sending funds to a lookalike address controlled by an attacker, resulting in a $100,000 loss. While distinct from the method used against TLBL, this case underscores a persistent vulnerability: crypto wallets remain a significant weak point in digital asset security.

TLBL’s second major loss occurs amidst a record-breaking period for cryptocurrency theft. A report by Blockaid, published on August 2, revealed that hackers stole $1.1 billion across 212 incidents in the first half of 2026. Privileged key misuse, the same category implicated in the TLBL incident, accounted for approximately $790 million of that total, representing about three-quarters of all funds stolen during that period.

Monthly incident counts saw a sharp rise, increasing from 18 in January to 57 in June. Blockaid also found that hackers linked to North Korea were responsible for roughly 55% of all funds stolen in the first half of the year, amounting to about $609 million. However, current data related to TLBL’s case does not specifically connect it to this group.

AI Accelerates Discovery of Critical Zoom Vulnerabilities

Artificial intelligence is rapidly streamlining the process of identifying significant security flaws. In a stark demonstration, a researcher has reportedly leveraged publicly available AI models to discover vulnerabilities within the video conferencing platform Zoom and construct a functional exploit in under 24 hours.

Dubbed “Zoomsday” in a report released Tuesday by Israeli cybersecurity firm A Security, the researcher utilized fewer than 20 AI prompts to uncover weaknesses in Zoom’s annotation tool. These flaws could allow an individual within a meeting to gain control of another participant’s device without any action from the victim.

“Once the malicious code is executing on the victim’s device, the threat actor can stealthily exfiltrate personal data, activate the microphone or camera for surveillance, or deploy additional malware,” A Security stated. “In a large conference call, this translates to a room full of potential targets accessible from a single message, leaving no one safe.”

According to A Security, the attack was successfully tested across Zoom’s applications for Windows, macOS, Linux, Android, and iOS. The firm characterized the exploit as “nation-state-grade,” emphasizing that developing such a tool previously demanded specialized expertise, extensive time, and substantial financial investment.

The identified vulnerabilities are cataloged as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415. CVEs serve as public identifiers for security weaknesses.

“Exploits of this nature are essentially weapons. Governments control their export, and criminal organizations are willing to pay millions for them,” the report noted. “Acquiring such capabilities has historically necessitated nation-state infrastructure, elite teams, and months of dedicated work.”

A Security further detailed that the exploit allows attackers to join or host meetings, target any participant, and compromise their machine with “no required action from the victim and no visual cue indicating the compromise.”

“The attack proved effective in both directions: a compromised presenter could reach every participant, and any participant could reach the presenter,” the firm explained.

A Security reported the initial flaw to Zoom on June 10, two days after its discovery. Zoom subsequently released patches between June 22 and July 20. However, users were still required to update their software, as Zoom’s server-side safeguards were insufficient to filter malicious messages within end-to-end encrypted meetings.

“As detailed on our Zoom Security Bulletin page, we have already addressed this issue,” a Zoom spokesperson told Decrypt. “We consistently advise users to maintain the latest version of Zoom to benefit from our most recent features and updates.”

This report emerges as AI tools are increasingly employed across the technology sector for bug detection, including the identification of 271 vulnerabilities in Mozilla Firefox in April and flaws within the Zcash network in May. Concurrently, AI models from OpenAI, Anthropic, and Meta have demonstrated the ability to bypass security measures and compromise other companies’ systems.