Wallet Security

SlowMist

2026-09-19 10:45:55

SlowMist CSO 23pds warns of full iOS attack chain targeting wallet users

SlowMist Chief Information Security Officer 23pds said in a post on X that cybercriminal groups have built a complete attack chain against iOS users. According to his description, the process can start when a user clicks a link, leading to the extraction of private keys and seed phrases. When a victim opens a webpage in Safari, the attackers can exploit WebKit/JSC memory corruption to gain JavaScript-layer read and write access, bypass Pointer Authentication Code (PAC) protections to obtain native call capability, break out of the WebContent sandbox, and then escalate privileges in the kernel to gain root access. From there, they can pull data from Keychain and wallet storage. 23pds said affected versions range from iOS 13 to 26.5 and urged iOS users to update as soon as possible.

440

SafePal

2026-09-18 03:45:29

SafePal outlines how crypto users can spot and avoid social engineering scams

SafePal has published a security guide warning crypto users that many losses begin not with a technical exploit, but with a scammer persuading the victim to hand over control. The guide says social engineering attacks often rely on impersonation, urgency, fake websites, malicious software, long-term trust building, and even offline delivery tactics rather than direct wallet or system compromise. According to the guide, common setups include fake customer support messages on Telegram, Discord, X, WeChat, or by phone; phishing links distributed through email, text messages, search ads, QR codes, and direct messages; and pressure tactics built around claims that assets are being stolen or accounts are about to be frozen. SafePal also warns about scams tied to airdrops, NFT rewards, high-yield investment offers, recovery services, and unsolicited hardware devices sent through offline channels. The company breaks these attacks into three stages: building credibility, creating a reason that demands action, and then pushing the victim to visit a site, scan a QR code, download software, connect a wallet, sign a transaction, share a screen, reveal credentials, or transfer funds. SafePal says users should never share seed phrases, private keys, PINs, or wallet passwords, should not verify a sender through links or numbers provided by that sender, and should avoid approving signatures or permissions they do not understand. If a seed phrase or private key has already been exposed, the guide says the wallet should be treated as compromised and assets should be moved to a newly created wallet on a trusted device.

500

DeBot

2026-09-16 02:53:12

DeBot isolates affected wallets after security alert, asks users to stop using old addresses

DeBot said it activated emergency protections early on Sept. 16 after receiving a wallet security risk alert, according to an announcement disclosed by team member Cat and cited by ChainCatcher. The affected wallets have been temporarily isolated. The team said native tokens and stablecoins in the affected wallets will be automatically moved on a 1:1 mapped basis into newly created keyless wallets. Part of the Meme token holdings will also be transferred. DeBot added that the new wallets can still be used for normal and secure trading. During the protection period, users can continue to withdraw and transfer tokens out, but private key export has been suspended for now. DeBot said the recovery time for that function will be announced separately. As of the time the notice was published, the platform said it had not found any abnormality in user assets. It urged users to stop using old wallets immediately, avoid making any further deposits, and check any public-chain assets or some Meme coins that were not automatically migrated so they can be moved manually in time.

380

CoinDesk

2026-09-15 10:27:55

Security firms say $7.8 million wallet drain came from authorized helper contract, not Safe

Security firms traced a $7.8 million crypto wallet loss to an authorized helper contract rather than to Safe itself, according to CoinDesk. The available details point to a simple coding mistake as the opening that allowed the attacker to drain the funds. That distinction matters because the incident was not attributed to a flaw in Safe, but to a contract the wallet owner had previously approved. CoinDesk’s summary did not provide additional technical details, a timeline of the exploit beyond the report date, or the identity of the wallet owner and attacker.

280

MetaMask

2026-09-14 14:04:58

MetaMask adds wallet protections with transfer and scam alerts

MetaMask has rolled out new wallet protection features across its mobile app and browser extension, according to Decrypt. The update adds warnings for lookalike addresses, investment scams, pig butchering scams, and first-time transfer recipients. It also brings a clearer transaction confirmation page to both mobile and extension users. MetaMask is also introducing a feature called Added Protection. The tool automatically rolls back transactions if the executed result does not match the preview shown to the user. That feature is launching first on the browser extension, with mobile support set to follow later. The announcement centers on transaction safety and clearer user prompts across both versions of the wallet.

810

MetaMask

2026-09-14 14:03:11

MetaMask Rolls Out New Scam Defenses Across Mobile App and Browser Extension

MetaMask has introduced a new set of wallet security features aimed at reducing crypto scam losses across its mobile app and browser extension. Announced Monday, the update adds alerts for lookalike wallet addresses, investment and romance scams, and transfers to first-time recipients, while also making transaction review screens clearer. A separate feature called Added Protection will automatically revert transactions if the final transaction does not match what the preview showed; it will launch on the browser extension first, with mobile support coming later. Martin Peko, Staff Product Manager at MetaMask, told Decrypt the company found that many users were bypassing scam warnings because they either strongly trusted the recipient or were being coached through the process. MetaMask is also adding a route to priority support from that warning flow so uncertain users can reach a person. Peko said the wallet is working with security partner Blockaid, which uses large language models, classification models, and analysis of websites, social feeds, onchain bytecode, and transaction flows to identify phishing, scam, and malicious activity in real time. The rollout comes as U.S. authorities continue targeting services tied to investment and romance fraud, and as MetaMask prepares for Consensys’ planned split of its consumer and institutional businesses by the end of 2026.

340

BlueWallet

2026-09-13 00:45:55

BlueWallet CTO flags 45 iOS non-custodial wallet apps as high or severe risk

BlueWallet’s chief technology officer said he screened 904 iOS apps on Apple’s App Store that were labeled as non-custodial crypto wallets and closely analyzed 494 of them, according to Bitcoin News. The review ended with 45 apps being marked as having potentially severe or high-risk security issues. Of those, 23 were classified as potential severe risks and 22 as high risks. Reported issues included suspected uploading of seed phrases or private keys to servers, insufficient randomness in wallet generation, server-side key storage, the use of hardcoded encryption keys, and loading unsigned JavaScript code that could interact with sensitive wallet data. The BlueWallet executive also warned that the findings may include false positives and said apps not listed should not automatically be treated as safe. For users storing large amounts of bitcoin, he said App Store approval and an app’s reputation alone are not enough grounds to trust the software.

840

Policy Regula

2026-09-11 09:40:27

Fake AML screening sites lure crypto users into wallet approvals that drain funds

A report carried by Foresight and written by Zero Hour Technology warns that a new phishing playbook is exploiting crypto users’ compliance anxiety by posing as anti-money laundering, or AML, screening tools. According to the article, Malwarebytes disclosed on Aug. 19, 2026, that numerous fake AML check sites were actively operating, tricking users into connecting wallets and approving malicious transactions that later emptied their balances. Some pages reportedly impersonated AMLBot, while others used generic branding such as "AML Check," though the report said they were built from the same malicious template. The piece says a legitimate AML screening process is a read-only query that only needs a public wallet address to review on-chain history for links to sanctions, hacks, theft, or suspicious activity. It does not require a wallet connection, a signature, a token approval, or any payment. By contrast, the fake sites simulate a professional workflow with scan progress bars, compliance messages, fake errors, and small "verification fee" prompts before returning a reassuring "Clean, Low Risk" result. The key risk comes after the wallet is connected and the user clicks approve, granting token access that attackers can later use to move funds. The article’s advice is direct: do not connect a wallet for an AML check, do not pay any fee for such a check, and regularly review and revoke unknown token approvals.

880