Hackers attack 35,000 digital token holders on the Ethereum blockchain

The Ethereum platform ETH $3,372.53 Bridged Ether (StarkGate) -1.09% Market capitalization $0.3 billion VOL. 24 hours $1.32 billion has been hit by a phishing email incident that affected more than 35,000 users. The hackers gained access to a mass email service provider and sent emails with a malicious URL that led to a website that used a crypto-miner to steal funds.

(Crypto-drains are atype of malware that can quickly and automatically withdraw funds from legitimate crypto-wallets to attackers' wallets — ed.)

The attack took place on the night of June 23, when 35,794 emails were sent from the address «updates@blog[.]ethereum.org». The attackers used their own email list and added to it 3759 addresses exported from the platform’s blog. The phishing email contained a message about cooperation with Lido DAO and promised 6.8% annualized return on pledged Ethereum. The recipients were invited to go to the website and start staking by clicking the «Begin staking» button.

Clicking on the link led to a fake website stylized as a promotion. If users connected their wallets and signed the transaction, the crypto-drainer emptied their wallets, sending all the funds to the attackers.

In response to the attack, Ethereum’s security team launched an investigation to identify the hacker, understand the attack’s goals, and identify the victims. The attacker was quickly blocked, preventing further mailings.

The platform promptly notified the community on social media, warning about the malicious emails and urging them not to click on the link. Ethereum representatives also added the malicious link to all possible blocklists, which allowed them to block it for most users.

Transaction analysis showed that none of the recipients of the fraudulent email fell victim to the attack. As a precautionary measure, Ethereum is taking additional measures and planning to migrate some mail services to other providers.