SlowMist,
a
leading
blockchain
security
firm,
has
released
its
“2024
Q2
MistTrack
Stolen
Funds
Analysis,”
providing
an
in-depth
look
at
the
trends
and
tactics
behind
cryptocurrency
thefts
during
the
second
quarter
of
2024.
Drawing
from
467
reported
incidents
of
stolen
funds,
the
analysis
pinpoints
critical
vulnerabilities
within
the
ecosystem
and
offers
detailed
insights
into
the
methods
used
by
cybercriminals.

Private
Key
Leaks:
The
Primary
Culprit

According
to
the
SlowMist
report,
the
most
common
cause
of
crypto
theft
is
the
mishandling
of
private
keys
and
mnemonic
phrases.
Users’
tendencies
to
store
these
critical
security
credentials
in
easily
accessible
or
insecure
platforms
have
led
to
substantial
losses.
Specifically,
the
report
details
how
many
users
store
their
keys
on
cloud
storage
services
like

 

Google
Docs,
Tencent
Docs,
Baidu
Cloud,
and
Shimo
Docs.
It
also
mentions
that
some
users
compromise
their
security
further
by
sharing
these
keys
via
messaging
platforms
like
WeChat
or
even
storing
them
on
local
hard
drives
with
insufficient
encryption
measures.

The
report
clearly
states:
“Hackers
often
use
‘credential
stuffing’
techniques,
trying
to
log
into
these
cloud
services
with
databases
of
leaked
account
credentials
found
online.”
This
exposes
users
to
significant
risks
as
once
hackers
access
these
storage
points,
they
can
easily
exfiltrate
crypto-related
information
and
subsequently
drain
the
associated
wallets.

In
addition
to
poor
storage
practices,
the
analysis
underscores
the
dangers
of
fake
wallets.
Users
frequently
download
these
applications
from
non-official
sources,
lured
by
fraudulent
advertisements
or
misleading
search
engine
results.
SlowMist’s
analysis
includes
an
examination
of
third-party
app
markets
where
numerous

fake
wallet
apps
are
distributed.
These
apps
are
often
complete
replicas
of
legitimate
software,
tricking
users
into
entering
private
keys
that
are
directly
transmitted
to
attackers.

 

Phishing:
An
Evergreen
Crypto
Threat

Phishing
remains
a
prevalent
method
of
crypto
theft,
leveraging
the
vast
reach
and
engagement
of
social
media
platforms.
The
report
elaborates
on
sophisticated
phishing
operations
where
criminals
use
social
media
profiles
that
appear
legitimate
to
distribute
phishing
links.
These
profiles
often
originate
from
compromised
accounts
or
are
purpose-built
with
purchased
followers
to
mimic
genuine
community
influencers
or
project
accounts.

“Approximately
80%
of
the
first
comments
under
tweets
from
prominent
project
accounts
are
occupied
by
phishing
scam
accounts,”
reveals
the
SlowMist
analysis.
This
tactic
demonstrates
the
strategic
use
of
social
media
by
attackers
to
maximize
the
reach
and
impact
of
their
malicious
activities.
Phishing
operations
also
extend
to
platforms
like
Discord
and

Telegram,
where
crypto
communities
actively
exchange
information,
making
them
ripe
targets
for
fraud.

Honeypot
Scams:
Deceptively
Attractive
Investments

The
third
significant
threat
identified
is
the
honeypot
scam.
In
this
scheme,
scammers
create
tokens
that
seem
promising
and
offer
high
returns,
but
these
tokens
are
programmed
to
be
unsellable.
This
type
of
fraud
is
particularly
rampant
on
decentralized
exchanges
like
PancakeSwap,
involving
tokens
primarily
on
the
Binance
Smart
Chain
(BSC).

The
report
discusses
the
mechanics
of
honeypot
scams,
explaining
how
they
attract
investors:
“After
purchasing
the
token,
its
value
keeps
rising
[…]
but
when
the
victim
tries
to
sell
the
token,
they
find
it
cannot
be
sold.”
This
scam
exploits
the
investor’s
desire
for
quick
profits,
locking
them
into
positions
where
they
can
neither
exit
nor
realize
gains.

 

Recommendations
for
Enhancing
Security

To
mitigate
these
risks,
SlowMist
emphasizes
the
importance
of
robust
security
practices.
They
recommend
using
tools
like
their
MistTrack
service
to
assess
the
risk
status
of
addresses
before
engaging
in
transactions.
For
verification
of
token
legitimacy,
the
report
suggests
using
blockchain
explorers
like

Etherscan
or
BscScan,
which
can
provide
insights
through
audit
trails
and
user
comments.

Further,
to
combat
phishing,
SlowMist
advises
the
implementation
of
browser
extensions
like
Scam
Sniffer,
designed
to
detect
and
alert
users
about
potential
phishing
sites.
Education
is
also
highlighted
as
a
crucial
defense,
urging
users
to
familiarize
themselves
with
common
cyber
threats.

The
findings
of
this
report
serve
as
a
critical
reminder
of
the
ongoing
vulnerabilities
within
the
cryptocurrency
landscape
and
underline
the
necessity
for
continuous
vigilance
and
proactive
security
measures
by
all
participants
in
the
blockchain
ecosystem.

At
press
time,
BTC
traded
at
$60,526.

Featured
image
created
with
DALL·E,
chart
from
TradingView.com

Go to Source
Author: Jake Simmons

Recommended Crypto Services, Products and Strategies: