{ "tag": "social-engineering", "name": "Social engineering and fake support", "group": "Drain methods", "incidents": [ { "slug": "coldcard-x-account-phishing-post-oct-2026", "title": "COLDCARD's X account posts fake 'security migration' phishing link", "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026", "json": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026.json", "status": "live", "severity": "medium", "threatStatus": "contained", "verification": "verified", "chains": [ "bitcoin" ], "method": "social-engineering", "product": "COLDCARD hardware wallet users on X", "tags": [ "bitcoin", "social-engineering", "x-account-hack", "coldcard", "hardware-wallet", "seed-phrase-phishing", "fake-security-alert", "fake-firmware", "phishing" ], "amountUsd": null, "victims": null, "startedAt": "2026-10-11", "closedAt": "2026-10-11", "updatedAt": "2026-10-11T12:00:00Z", "summary": "On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website." }, { "slug": "waterplum-contagious-interview-advisory-sep-2026", "title": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets", "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026", "json": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026.json", "status": "live", "severity": "critical", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-lure", "note": "The attackers reportedly use AI face-swapping software during online job interviews, then turn off their cameras and blame network problems." }, "chains": [ "multi-evm" ], "method": "social-engineering", "product": "Crypto, AI and NFT developers and job seekers", "tags": [ "multi-evm", "social-engineering", "dprk", "waterplum", "contagious-interview", "fake-job-interview", "npm", "vscode", "beavertail", "invisibleferret", "ottercookie", "stoatwaffle", "infostealer", "ai" ], "amountUsd": 10710000, "victims": 7000, "startedAt": "2026-09-18", "closedAt": null, "updatedAt": "2026-10-22T21:53:35.016Z", "summary": "On 18 September 2026 Japanese, US, Australian and German authorities warned that the North Korean group WaterPlum, linked to the 'Contagious Interview' campaign, infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto or NFT firms and recruiters, they get targets to run code during fake interviews and coding tests, including malicious npm packages and VS Code projects, then steal private keys, seed phrases and passwords. Funds or credentials were taken from over 7,000 wallets, and more than 1.7 billion yen (about $10.71M) went to North Korea. The advisory does not say the campaign has stopped." }, { "slug": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026", "title": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers", "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026", "json": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json", "status": "closed", "severity": "medium", "threatStatus": "contained", "verification": "verified", "chains": [ "bitcoin", "multi-evm" ], "method": "social-engineering", "product": "Trezor, BitBox and CoinTracking newsletter subscribers", "tags": [ "bitcoin", "multi-evm", "social-engineering", "email-phishing", "seed-phishing", "hardware-wallet", "trezor", "bitbox", "cointracking", "brevo", "newsletter" ], "amountUsd": null, "victims": null, "startedAt": "2026-09-09", "closedAt": "2026-09-11", "updatedAt": "2026-09-11T12:00:00Z", "summary": "An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses." }, { "slug": "cow-swap-dns-hijack-apr-2026", "title": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals", "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026", "json": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum" ], "method": "front-end-hijack", "product": "CoW Swap (swap.cow.fi) users", "tags": [ "ethereum", "front-end-hijack", "cow-swap", "dns-hijack", "registrar", "social-engineering", "approval-phishing", "dex" ], "amountUsd": 1200000, "victims": null, "startedAt": "2026-04-14", "closedAt": "2026-05-13", "updatedAt": "2026-05-13T12:00:00Z", "summary": "On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered." }, { "slug": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "title": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026", "json": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026.json", "status": "live", "severity": "critical", "threatStatus": "contained", "verification": "verified", "ai": { "role": "agent-attack", "note": "TRM Labs investigator Nick Carlsen, a former FBI analyst, assessed it highly likely that the attackers used AI to pick targets and design the exploit, as The Next Web reported citing Bloomberg; this is an expert assessment, not confirmed." }, "chains": [ "solana" ], "method": "durable-nonce", "product": "Drift Protocol (Security Council multisig)", "tags": [ "solana", "durable-nonce", "drift", "multisig", "security-council", "social-engineering", "admin-takeover", "cctp", "wormhole", "admin-key", "dprk", "tornado-cash", "laundering", "ai" ], "amountUsd": 285000000, "victims": null, "startedAt": "2026-04-01", "closedAt": "2026-04-01", "updatedAt": "2026-10-22T21:53:35.016Z", "summary": "On Apr 1, 2026, an attacker took admin control of the Solana perps exchange Drift and drained its vaults of at least $270 million; SlowMist lists $285 million. Weeks earlier, Security Council signers had been led into 'unauthorized or misrepresented' approvals. Because those transactions used durable nonces, they stayed valid until the attacker chose to submit them. The funds were bridged to Ethereum, including more than $230 million in USDC via Circle's CCTP. No code bug was needed. The lesson for teams is that any durable-nonce signing request is high risk." }, { "slug": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "title": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL", "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "json": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "ai": { "role": "agent-target", "note": "The autonomous AI agent acted on an X reply asking it for 4 SOL and sent about 53 million tokens instead; the bot called it an accident, and the decimal-error explanation is speculation, not confirmed." }, "chains": [ "solana" ], "method": "agent-hijack", "product": "Lobstar Wilde, an experimental AI trading agent on X", "tags": [ "solana", "agent-hijack", "ai-agent", "ai-trading-bot", "lobstar", "x-replies", "social-engineering", "memecoin", "ai" ], "amountUsd": 250000, "victims": 1, "startedAt": "2026-02-22", "closedAt": "2026-02-22", "updatedAt": "2026-02-22T12:00:00Z", "summary": "On 22 February 2026 Lobstar Wilde, an experimental AI trading agent with its own Solana wallet built by an OpenAI developer, answered an X reply asking for 4 SOL for a relative's medical treatment. Instead of a small amount it sent about 53 million LOBSTAR tokens, roughly 5% of supply and about $250,000 at the time, and the recipient sold them. The bot called it an accident; a decimal error was suggested by an X user but not confirmed by the creator. Agents that can send funds in response to public replies need hard per-transfer caps and human approval." }, { "slug": "iotex-iotube-bridge-key-compromise-feb-2026", "title": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026", "json": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "IoTeX ioTube bridge (Ethereum side)", "tags": [ "ethereum", "key-leak", "iotex", "iotube", "bridge", "social-engineering", "validator-key", "malicious-upgrade" ], "amountUsd": 4400000, "victims": null, "startedAt": "2026-02-21", "closedAt": "2026-02-24", "updatedAt": "2026-03-28T12:00:00Z", "summary": "On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users." }, { "slug": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026", "title": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech", "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026", "json": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-lure", "note": "The victim reported an apparent deepfake video of a crypto CEO on the call; Mandiant could not verify it forensically but notes UNC1069's known use of AI tools to edit images or video and of Gemini for tooling and research." }, "chains": [ "multi-evm" ], "method": "social-engineering", "product": "Crypto and DeFi fintech staff on macOS", "tags": [ "multi-evm", "social-engineering", "dprk", "unc1069", "masan", "cryptocore", "deepfake", "zoom", "fake-meeting", "clickfix", "telegram", "calendly", "macos", "mandiant", "gemini", "ai" ], "amountUsd": null, "victims": 1, "startedAt": "2026-02-09", "closedAt": "2026-02-09", "updatedAt": "2026-02-09T12:00:00Z", "summary": "Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount." }, { "slug": "konni-ai-generated-backdoor-blockchain-developers-jan-2026", "title": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor", "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026", "json": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-malware", "note": "Check Point Research describes the payload as an AI-generated PowerShell backdoor." }, "chains": [ "multi-evm" ], "method": "social-engineering", "product": "Blockchain and crypto developers and engineering teams (Asia-Pacific)", "tags": [ "multi-evm", "social-engineering", "dprk", "konni", "powershell", "backdoor", "ai-generated-code", "blockchain-developers", "phishing", "check-point", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-01-22", "closedAt": "2026-01-22", "updatedAt": "2026-01-22T12:00:00Z", "summary": "Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported." }, { "slug": "meteora-fake-otc-escrow-1-5m-jan-2026", "title": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam", "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026", "json": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "solana" ], "method": "social-engineering", "product": "Meteora treasury (OTC buyback of MET)", "tags": [ "solana", "social-engineering", "otc", "escrow", "impersonation", "treasury", "meteora", "usdc" ], "amountUsd": 1500000, "victims": 1, "startedAt": "2026-01-17", "closedAt": "2026-01-17", "updatedAt": "2026-04-30T12:00:00Z", "summary": "On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel." }, { "slug": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025", "title": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks", "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025", "json": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-malware", "note": "Kaspersky says generative AI has let BlueNoroff speed up malware development and refine its attack techniques; it describes the fake calls as replaying videos of earlier victims, not deepfakes." }, "chains": [ "multi-evm" ], "method": "social-engineering", "product": "Web3 and crypto executives, founders and blockchain developers", "tags": [ "multi-evm", "social-engineering", "dprk", "bluenoroff", "lazarus", "ghostcall", "ghosthire", "snatchcrypto", "fake-meeting", "fake-job-interview", "telegram", "github", "macos", "kaspersky", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2025-10-28", "closedAt": "2025-10-28", "updatedAt": "2025-10-28T12:00:00Z", "summary": "Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given." }, { "slug": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "title": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend", "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "json": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-lure", "note": "The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account." }, "chains": [ "ethereum" ], "method": "social-engineering", "product": "THORChain co-founder's personal wallet", "tags": [ "ethereum", "social-engineering", "dprk", "deepfake", "zoom", "fake-meeting", "telegram", "account-takeover", "metamask", "zachxbt", "thorchain", "thorswap", "ai" ], "amountUsd": 1350000, "victims": 1, "startedAt": "2025-09-04", "closedAt": "2025-09-12", "updatedAt": "2025-09-12T12:00:00Z", "summary": "In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected." }, { "slug": "ai-video-mev-bot-tutorials-drainer-contracts-aug-2025", "title": "YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken", "url": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025", "json": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025.json", "status": "closed", "severity": "high", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-lure", "note": "SentinelLABS says several tutorial videos appear to be AI-generated from audio and visual tells, though the most successful one (about $902,000 taken) does not appear to be." }, "chains": [ "ethereum" ], "method": "social-engineering", "product": "Ethereum users following YouTube 'MEV bot' tutorials", "tags": [ "ethereum", "social-engineering", "mev-bot", "fake-trading-bot", "youtube", "remix", "smart-contract-scam", "ai-generated-video", "sentinelone", "ai" ], "amountUsd": 900000, "victims": null, "startedAt": "2025-08-05", "closedAt": "2025-08-05", "updatedAt": "2025-08-05T12:00:00Z", "summary": "SentinelLABS reported in August 2025 that scammers use YouTube tutorials to get people to deploy a 'free' Ethereum arbitrage bot contract through Remix, fund it with ETH and press Start. Hidden code sends the ETH to an attacker wallet, and the top attacker address alone received 244.9 ETH (about $902,000). The videos ran on aged channels with manipulated comments, and SentinelLABS says several appear to be AI-generated. Versions of the scam have run since at least early 2024 and were described as ongoing." }, { "slug": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025", "title": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac", "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025", "json": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-lure", "note": "Huntress says the Zoom meeting contained several deepfakes of known senior leaders of the victim's company, used to make the call look genuine before the fake 'extension' install." }, "chains": [ "multi-evm" ], "method": "social-engineering", "product": "Crypto foundation staff on macOS", "tags": [ "multi-evm", "social-engineering", "dprk", "bluenoroff", "ta444", "lazarus", "deepfake", "zoom", "fake-meeting", "telegram", "calendly", "macos", "cryptobot", "infostealer", "huntress", "ai" ], "amountUsd": null, "victims": 1, "startedAt": "2025-06-11", "closedAt": "2025-06-18", "updatedAt": "2025-06-18T12:00:00Z", "summary": "Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen." }, { "slug": "polygon-cofounder-deepfake-zoom-calls-may-2025", "title": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account", "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025", "json": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-lure", "note": "Nailwal said the calls showed AI-generated videos of him, the Polygon Ventures lead and a supposed team member, used to get targets to install malware." }, "chains": [ "multi-evm" ], "method": "social-engineering", "product": "Startup founders in Polygon's investment network", "tags": [ "multi-evm", "social-engineering", "deepfake", "zoom", "fake-meeting", "telegram", "account-takeover", "polygon", "malware", "founders", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2025-05-13", "closedAt": "2025-05-14", "updatedAt": "2025-05-14T12:00:00Z", "summary": "On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know." } ], "changes": [ { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-10-21", "title": "Another 18,800 ETH (about $46M) went to Tornado Cash, a two-day total of 44,510 ETH (about $109M); about 56,569 ETH stayed in exploiter-labelled wallets per Arkham.", "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-10-20", "title": "The Drift exploiter sent about $61M in ETH to Tornado Cash.", "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "coldcard-x-account-phishing-post-oct-2026", "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link", "severity": "medium", "status": "live", "threatStatus": "contained", "date": "2026-10-11", "title": "An unauthorized post on COLDCARD's X account links to a fake 'security migration' site; COLDCARD deletes it and warns users.", "sourceUrl": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/", "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026" }, { "incident": "coldcard-x-account-phishing-post-oct-2026", "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link", "severity": "medium", "status": "live", "threatStatus": "contained", "date": "2026-10-11", "title": "A phishing link is posted on Coldcard's X account; Coldcard warns users, deletes the post and contacts X.", "sourceUrl": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account", "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026" }, { "incident": "waterplum-contagious-interview-advisory-sep-2026", "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-19", "title": "BleepingComputer reported the advisory's figures: 30,000+ infected devices, 7,000+ wallets hit and over 1.7 billion yen stolen.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/", "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026" }, { "incident": "waterplum-contagious-interview-advisory-sep-2026", "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-18", "title": "Japan, the US, Australia and Germany issued a joint advisory on WaterPlum covering activity from December 2025 to July 2026.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/", "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026" }, { "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026", "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers", "severity": "medium", "status": "closed", "threatStatus": "contained", "date": "2026-09-11", "title": "Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.", "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing", "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026" }, { "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026", "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers", "severity": "medium", "status": "closed", "threatStatus": "contained", "date": "2026-09-10", "title": "Brevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.", "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing", "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026" }, { "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026", "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers", "severity": "medium", "status": "closed", "threatStatus": "contained", "date": "2026-09-09", "title": "Trezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.", "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing", "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026" }, { "incident": "cow-swap-dns-hijack-apr-2026", "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-05-13", "title": "Halborn's April review put user losses at about $1.2M and said the DNS registrar had been social-engineered.", "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026", "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026" }, { "incident": "meteora-fake-otc-escrow-1-5m-jan-2026", "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-04-30", "title": "OurCryptoTalk reported the loss, disclosed in Meteora's Q1 2026 Token Holder Report, with the USDC moved through KuCoin and recovery considered unlikely.", "sourceUrl": "https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss", "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026" }, { "incident": "cow-swap-dns-hijack-apr-2026", "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-04-14", "title": "CoW DAO said swap.cow.fi had been hit by a DNS hijacking, paused its backend and APIs, and told users to stay away from the site.", "sourceUrl": "https://cointelegraph.com/news/cow-swap-dao-domain-hijacking", "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026" }, { "incident": "cow-swap-dns-hijack-apr-2026", "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-04-14", "title": "A researcher estimated about $500K drained from a few addresses; CoW DAO told users to revoke all approvals made on CoW Swap after 14:54 UTC.", "sourceUrl": "https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise", "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-04-03", "title": "SecurityWeek reported Elliptic's $286M estimate and a likely North Korean link; about $225M had been swapped to Ethereum.", "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-04-01", "title": "About a minute after a legitimate insurance-fund test withdrawal, the attacker submitted two pre-signed transactions, took admin control and drained the vaults.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-04-01", "title": "Attackers executed pre-signed durable-nonce transactions to take Drift's admin key, created a fake CVT collateral market, raised the circuit breaker and drained six assets in about 10 seconds.", "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-03-30", "title": "A new durable nonce account tied to a member of the updated multisig appeared.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-28", "title": "IoTeX's review said bridge contracts moved to multisig governance and sensitive keys to hardware security modules; Chainalysis linked the attacker to the group behind the Infini exploit.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-03-27", "title": "Drift executed a planned Security Council migration to replace a member.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-03-23", "title": "Four durable nonce accounts were created, two tied to Security Council members and two controlled by the attacker.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-02", "title": "IoTeX opened the ioTube Claims Portal: full stablecoin payout for losses up to $10,000, larger claims paid over 12 months.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-24", "title": "The IoTeX chain came back online at 06:06 UTC.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "incidentTitle": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2026-02-22", "title": "The Lobstar Wilde agent replied to a request for 4 SOL and transferred about 53 million LOBSTAR tokens, worth about $250,000, to the requester's wallet.", "sourceUrl": "https://www.theblock.co/post/390722/ai-agent-created-by-openai-dev-accidentally-sends-entire-memecoin-holdings-to-reply-guy", "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-21", "title": "At 01:51 UTC the attacker upgraded an ioTube Validator contract to a malicious version.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-21", "title": "IoTeX detected the incident at 08:01 UTC, alerted the community at 09:39 UTC, and validators suspended the IoTeX chain at 10:03 UTC.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026", "incidentTitle": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2026-02-09", "title": "Mandiant published its analysis, naming seven malware families including WAVESHAPER, HYPERCALL and SUGARLOADER.", "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering", "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026" }, { "incident": "konni-ai-generated-backdoor-blockchain-developers-jan-2026", "incidentTitle": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2026-01-22", "title": "Check Point Research published its findings on KONNI's AI-generated backdoor aimed at blockchain developers.", "sourceUrl": "https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/", "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026" }, { "incident": "meteora-fake-otc-escrow-1-5m-jan-2026", "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-01-17", "title": "Meteora sent $1.5M USDC to a scammer-controlled 'escrow' address during an attempted OTC buyback of MET; SlowMist logs it as social engineering.", "sourceUrl": "https://hacked.slowmist.io/?c=Solana", "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026" }, { "incident": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025", "incidentTitle": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2025-10-28", "title": "Kaspersky disclosed the GhostCall and GhostHire campaigns and their targets.", "sourceUrl": "https://www.kaspersky.co.uk/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools", "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025" }, { "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-09-12", "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.", "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user", "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025" }, { "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-09-12", "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.", "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/", "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025" }, { "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-09-04", "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.", "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/", "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025" }, { "incident": "ai-video-mev-bot-tutorials-drainer-contracts-aug-2025", "incidentTitle": "YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken", "severity": "high", "status": "closed", "threatStatus": "active", "date": "2025-08-05", "title": "SentinelLABS' report (updated 5 August 2025) listed three attacker addresses and more than $900,000 taken.", "sourceUrl": "https://www.sentinelone.com/labs/smart-contract-scams-ethereum-drainers-pose-as-trading-bots-to-steal-crypto/", "url": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025" }, { "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025", "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2025-06-18", "title": "Huntress published its analysis, attributing the attack to BlueNoroff (TA444).", "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis", "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025" }, { "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025", "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2025-06-11", "title": "Huntress was contacted about the intrusion on the employee's Mac.", "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis", "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025" }, { "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025", "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2025-05-14", "title": "CryptoSlate reported the warning and his advice to sign wallet transactions only from a separate, dedicated laptop.", "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/", "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025" }, { "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025", "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2025-05-13", "title": "Nailwal warned on X that a hijacked Polygon Ventures Telegram account was sending founders to deepfake Zoom calls.", "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/", "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025" } ] }