seed phrase

THORSwap

2026-09-30 13:28:23

THORSwap says hijacked third-party support widget led to about $58,000 in losses

THORSwap said a third-party customer support platform used by both THORSwap and Metro Exchange, Mava, was compromised at the domain registrar level on Sept. 28, allowing malicious code to be injected into a support widget on the site. According to the project, the code could trigger a fake WalletConnect prompt, steal seed phrases or keystore data entered by users, and replace deposit addresses used for Direct Swap transactions. The incident resulted in roughly $58,000 in losses. THORSwap said about $54,200 came from compromised wallets, while another $3,500 was tied to altered Direct Swap deposit addresses. It added that affected users in the Direct Swap portion have been fully reimbursed. The team said its servers and application code were not affected and that the website is now safe again. Users who interacted with the dApp between 01:50 and 03:40 on Sept. 29, imported a seed phrase, copied or scanned a Direct Swap deposit address, or connected to the malicious WalletConnect prompt were urged to move funds to a new wallet immediately and revoke existing token approvals.

290

SlowMist

2026-09-19 11:07:07

SlowMist warns DarkSword iOS exploit is now being used in real attacks

SlowMist Chief Information Security Officer 23pds warned iOS users on Sept. 19 to update to the latest system version after saying the DarkSword iOS attack tool, which was leaked in March, is now being used by black-market operators in real-world attacks. According to the alert, attackers can trick users into opening a malicious webpage in Safari, then gradually break out of the browser sandbox and escalate privileges. The attack chain could eventually access keychain data and wallet information, allowing the theft of private keys and seed phrases. 23pds said the suspected affected range is iOS 13 to 26.5, though that scope has not been confirmed.

440

SafePal

2026-09-18 03:45:29

SafePal outlines how crypto users can spot and avoid social engineering scams

SafePal has published a security guide warning crypto users that many losses begin not with a technical exploit, but with a scammer persuading the victim to hand over control. The guide says social engineering attacks often rely on impersonation, urgency, fake websites, malicious software, long-term trust building, and even offline delivery tactics rather than direct wallet or system compromise. According to the guide, common setups include fake customer support messages on Telegram, Discord, X, WeChat, or by phone; phishing links distributed through email, text messages, search ads, QR codes, and direct messages; and pressure tactics built around claims that assets are being stolen or accounts are about to be frozen. SafePal also warns about scams tied to airdrops, NFT rewards, high-yield investment offers, recovery services, and unsolicited hardware devices sent through offline channels. The company breaks these attacks into three stages: building credibility, creating a reason that demands action, and then pushing the victim to visit a site, scan a QR code, download software, connect a wallet, sign a transaction, share a screen, reveal credentials, or transfer funds. SafePal says users should never share seed phrases, private keys, PINs, or wallet passwords, should not verify a sender through links or numbers provided by that sender, and should avoid approving signatures or permissions they do not understand. If a seed phrase or private key has already been exposed, the guide says the wallet should be treated as compromised and assets should be moved to a newly created wallet on a trusted device.

490

wallet recove

2026-09-04 09:22:17

Wallet recovery expert unlocked a supposed $1 billion ETH wallet and found about $10

A 2021 case involving a client calling himself Rusty has become a sharp example of the limits and risks of crypto wallet recovery. Rusty told wallet recovery specialist Chris Brooks that he and two others had won a lawsuit and gained access to 5,000 BTC, then worth about $53 million, along with $1 billion in ETH. Brooks and his father flew overnight to Georgia and spent a full day working on the wallets in a back office at a shopping mall. They ultimately found only about $10. The case sits at the center of a broader point made by recovery professionals: people often believe they have lost access to large crypto holdings, but in many situations the money was never in the wallet they are trying to open, or the issue stems from missing information rather than missing onchain funds. The report examines what can and cannot be recovered across mnemonic phrases, passwords, passphrases, and hardware wallets. Industry figures cited in the piece, including Bruno Krauss of ReWallet, Bitcoin educator Bennet, and Trezor analyst Lucien Bourdon, say some wallets can be recovered when users retain partial information or when software, password generation, or hardware defects create an opening. But if a truly random seed phrase is completely lost, there is usually no practical path back. They also warn that handing wallet backups to a recovery service creates a separate security problem, since anyone with the necessary seed data may be able to control the funds.

890

malicious ext

2026-08-28 20:46:26

Researchers Uncover 19 Malicious Chrome and Edge Extensions That Steal Crypto Wallet Keys

Cybersecurity researchers have identified 19 malicious browser extensions for Google Chrome and Microsoft Edge that can steal sensitive information from crypto wallets, including recovery phrases and private keys. Disguised as legitimate tools, these extensions quietly harvest wallet credentials without the user's knowledge, posing a direct threat to digital asset security. The researchers recommend installing extensions only from official stores and regularly checking the permissions and ratings of installed extensions. The report was originally published by U.Today and relayed by Techub News.

340

Firefox

2026-08-25 14:17:21

Socket links 40 malicious Firefox wallet extensions to campaign stealing seed phrases

Security firm Socket said it found a cluster of malicious cryptocurrency wallet extensions targeting Firefox users and tied them to an operation it calls "Offside Wallet Theft Factory." The company linked 77 extension identities to the campaign, with 40 confirmed as malicious, and said the activity ran for at least from March to August 2026. The extensions mainly impersonated well-known Web3 wallets including OKX, Rabby Wallet and TronLink, using highly convincing wallet interfaces to trick users into importing existing wallets and handing over seed phrases or private keys. Socket said roughly half of the malicious extensions directly prompted users to enter seed phrases. Another 13 were tampered Rabby builds that sent wallet account data to external servers when users saved account information, while five collected stored credentials and clipboard contents. Socket also found that at least nine of the malicious extensions had previously operated as sports score apps covering football, basketball and the NBA, building up users and reviews before later switching to wallet-stealing code through updates. It warned that anyone who entered a seed phrase or private key into the affected extensions should treat those credentials as permanently compromised and move funds to a brand-new wallet immediately.

1070

Firefox exten

2026-08-25 14:18:31

Socket links 77 Firefox extensions to wallet-theft campaign, says 40 are confirmed malicious

Security firm Socket has linked 77 Firefox extensions to a malicious operation it calls the "Overstep wallet theft factory," according to a report cited by Decrypt. Of those, 40 have been confirmed as malicious. The extensions allegedly impersonated Web3 products including OKX, Rabby Wallet and TronLink, either by presenting fake wallet interfaces that pushed users to import existing wallets or by using modified versions of legitimate wallet code to steal seed phrases and private keys as they were entered. Mozilla signing records cited by Socket show the activity ran from March 9 to Aug. 3, and several of the extensions were still live when the report was published. Socket said about half of the extensions displayed realistic wallet interfaces designed to capture seed phrases or private keys. Another 13 were modified Rabby builds that functioned normally while sending stored account data to external servers, while five were built to collect saved credentials and clipboard contents. Socket also found 37 extensions posing as password generators, dark mode toggles, VPNs, currency converters and note-taking tools, but actually running a sports scores app that shared the same hardcoded credential. Nine confirmed malicious extensions were first published as football or basketball score apps before later updates swapped in wallet-stealing code. Socket said users who entered seed phrases or private keys into any of these extensions should treat them as permanently compromised and move funds to a new wallet immediately.

1050

SafePal

2026-08-23 12:53:24

SafePal says it is selecting anti-phishing firms and independent security auditors after order system data leak

SafePal has shared a fresh update on its response to a previous data leak involving its order system. The Web3 wallet brand said it is tracking phishing websites and impersonation accounts on a daily basis and submitting takedown requests, while narrowing down a final choice from four professional anti-phishing companies to speed up removals. The company also said it is monitoring dark web forums and other channels for any signs that affected data is being sold or made public, and plans to alert impacted users immediately if such activity is detected. On the audit side, SafePal said it is choosing from three independent security firms for a full review of the order system. It added that its order and logistics processes are being reviewed at the same time to reduce the scope of retained data. Impacted users can continue to receive one-on-one help through official support channels, while updates, FAQs and scam cases will be posted on the company’s scam-protection page. SafePal also reminded users that it will never ask for seed phrases.

1130