{
 "tag": "account-takeover",
 "name": "Account Takeover",
 "group": "Other",
 "incidents": [
  {
   "slug": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "title": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "json": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Linux users installing wallet apps from the Snap Store",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "linux",
    "snap-store",
    "snapcraft",
    "exodus",
    "ledger",
    "trust-wallet",
    "slowmist",
    "seed-phrase",
    "expired-domain",
    "account-takeover"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-21",
   "closedAt": "2026-01-21",
   "updatedAt": "2026-01-21T12:00:00Z",
   "summary": "SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published."
  },
  {
   "slug": "solana-owner-permission-phishing-3m-dec-2025",
   "title": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025",
   "json": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "token-owner-swap",
   "product": "Solana wallet user (single victim)",
   "tags": [
    "solana",
    "token-owner-swap",
    "owner-permission",
    "assign",
    "setauthority",
    "simulation-blind-spot",
    "okx-wallet",
    "phantom",
    "slowmist",
    "signature-phishing",
    "account-takeover",
    "misttrack",
    "whale"
   ],
   "amountUsd": 3000000,
   "victims": 1,
   "startedAt": "2025-12-05",
   "closedAt": null,
   "updatedAt": "2026-10-22T20:36:38.517Z",
   "summary": "A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner."
  },
  {
   "slug": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "title": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "json": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account."
   },
   "chains": [
    "ethereum"
   ],
   "method": "social-engineering",
   "product": "THORChain co-founder's personal wallet",
   "tags": [
    "ethereum",
    "social-engineering",
    "dprk",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "metamask",
    "zachxbt",
    "thorchain",
    "thorswap",
    "ai"
   ],
   "amountUsd": 1350000,
   "victims": 1,
   "startedAt": "2025-09-04",
   "closedAt": "2025-09-12",
   "updatedAt": "2025-09-12T12:00:00Z",
   "summary": "In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected."
  },
  {
   "slug": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "title": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025",
   "json": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Nailwal said the calls showed AI-generated videos of him, the Polygon Ventures lead and a supposed team member, used to get targets to install malware."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Startup founders in Polygon's investment network",
   "tags": [
    "multi-evm",
    "social-engineering",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "polygon",
    "malware",
    "founders",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-05-13",
   "closedAt": "2025-05-14",
   "updatedAt": "2025-05-14T12:00:00Z",
   "summary": "On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know."
  }
 ],
 "changes": [
  {
   "incident": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "incidentTitle": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-21",
   "title": "SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.",
   "sourceUrl": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-01-07",
   "title": "OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.",
   "sourceUrl": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "SlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/1996528328061382860",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "Coinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.",
   "sourceUrl": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.",
   "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-04",
   "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-14",
   "title": "CryptoSlate reported the warning and his advice to sign wallet transactions only from a separate, dedicated laptop.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-13",
   "title": "Nailwal warned on X that a hijacked Polygon Ventures Telegram account was sending founders to deepfake Zoom calls.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  }
 ]
}