{
 "tag": "phishing",
 "name": "Phishing",
 "group": "Other",
 "incidents": [
  {
   "slug": "coldcard-x-account-phishing-post-oct-2026",
   "title": "COLDCARD's X account posts fake 'security migration' phishing link",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026",
   "json": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin"
   ],
   "method": "social-engineering",
   "product": "COLDCARD hardware wallet users on X",
   "tags": [
    "bitcoin",
    "social-engineering",
    "x-account-hack",
    "coldcard",
    "hardware-wallet",
    "seed-phrase-phishing",
    "fake-security-alert",
    "fake-firmware",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-11",
   "closedAt": "2026-10-11",
   "updatedAt": "2026-10-11T12:00:00Z",
   "summary": "On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website."
  },
  {
   "slug": "whale-wallet-25m-drain-aug-2026",
   "title": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026",
   "json": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": null,
   "product": "Unidentified Ethereum whale wallet",
   "tags": [
    "ethereum",
    "whale",
    "phishing",
    "aave",
    "awbtc",
    "peckshield",
    "repeat-victim"
   ],
   "amountUsd": 25600000,
   "victims": 1,
   "startedAt": "2026-08-12",
   "closedAt": null,
   "updatedAt": "2026-08-13T12:00:00Z",
   "summary": "On 12 August 2026 an unidentified whale lost about $25.6M, including about $6.3M in aWBTC, $5.1M in DAI, $4.7M in WBTC and $2.6M in ETH, according to PeckShield. Analyst Specter called it a phishing attack and PeckShield called it a hack; the exact method has not been published. The attacker swapped the funds into DAI and ETH across four addresses. The same wallet lost about $24.2M through malicious token approvals in September 2023."
  },
  {
   "slug": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "title": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026",
   "json": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "approval-phishing",
   "product": "A crypto wallet holder using a fake exchange site",
   "tags": [
    "multi-evm",
    "approval-phishing",
    "unlimited-approval",
    "fake-exchange",
    "sweeper",
    "phishing"
   ],
   "amountUsd": 1650000,
   "victims": 1,
   "startedAt": "2026-07-03",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise."
  },
  {
   "slug": "arbitrum-dao-x-account-hijack-feb-2026",
   "title": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026",
   "json": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "arbitrum"
   ],
   "method": "fake-airdrop-site",
   "product": "Arbitrum DAO followers on X",
   "tags": [
    "arbitrum",
    "fake-airdrop-site",
    "x-account-hack",
    "fake-airdrop",
    "social-media",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-03",
   "closedAt": "2026-02-03",
   "updatedAt": "2026-02-03T12:00:00Z",
   "summary": "On 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time."
  },
  {
   "slug": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "title": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "json": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Check Point Research describes the payload as an AI-generated PowerShell backdoor."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Blockchain and crypto developers and engineering teams (Asia-Pacific)",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "konni",
    "powershell",
    "backdoor",
    "ai-generated-code",
    "blockchain-developers",
    "phishing",
    "check-point",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-22",
   "closedAt": "2026-01-22",
   "updatedAt": "2026-01-22T12:00:00Z",
   "summary": "Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported."
  }
 ],
 "changes": [
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "An unauthorized post on COLDCARD's X account links to a fake 'security migration' site; COLDCARD deletes it and warns users.",
   "sourceUrl": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "A phishing link is posted on Coldcard's X account; Coldcard warns users, deletes the post and contacts X.",
   "sourceUrl": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-13",
   "title": "PeckShield reported the theft and said the stolen aWBTC, DAI, WBTC and ETH were swapped into DAI and ETH and split across four addresses.",
   "sourceUrl": "https://u.today/crypto-hack-drains-256-million-from-unknown-victims",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-13",
   "title": "Specter described the theft as phishing; the same wallet had lost about $24.2M to malicious token approvals in September 2023.",
   "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-12",
   "title": "The whale's wallet was drained of about $25.6M in assets.",
   "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "incidentTitle": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "ForkLog reported the case alongside a separate 999,999 USDT approval-phishing theft, noting the approval gave attackers unlimited access and a sweeper drained the funds.",
   "sourceUrl": "https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026"
  },
  {
   "incident": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "incidentTitle": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-03",
   "title": "An X post by an on-chain commentator reported that a wallet holder lost $1.65M after connecting to a fake exchange and signing a malicious contract.",
   "sourceUrl": "https://x.com/RyanColeXBT/status/2073172860034789620",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "The hijacked @arbitrumdao_gov account posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "Arbitrum warned users not to click links or interact with the account until further notice and said it was working to restore access.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "incidentTitle": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-22",
   "title": "Check Point Research published its findings on KONNI's AI-generated backdoor aimed at blockchain developers.",
   "sourceUrl": "https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026"
  }
 ]
}