Key Takeaways:
- ETHDenver is the most recent victim of hackers who continue to build phony Web3-enabled websites to steal money from unaware victims’ browser-based wallets.
- The website requests a transaction, which, if accepted, executes the malicious code and takes the users’ money.
The most recent phishing victim of a red-flagged smart contract that has taken over $300,000 of Ether is a phony website for the well-known Ethereum Denver conference.
A hacker replicated the popular conference’s website earlier this week and attempted to ask users to link their MetaMask wallets by copying the website. The fraudulent website was first discovered by Blockfence, a security company that discovered the fraudulent website more than six months ago. According to Blockfence, the smart contract has accessed over 2,800 wallets and taken over $300,000.
ETHDenver informed its Twitter followers that the website in question was harmful in a notification they posted on Twitter. In their tweets, they stated the following:
“Please be aware that there is a FAKE ETHDenver website that is asking for you to connect your wallet.”
The Blockfence CEO, Omri Lahav, explained that users would be prompted to join their wallets by clicking the “connect wallet” button on their MetaMask wallets. When a user visits a website, a transaction request is sent, which, if accepted, executes a malicious code and steals the money from the user.
The incidence was discovered during a study by Blockfence’s research team as it looked at various trends in the market. Lahav said that since its deployment in the middle of 2022, the smart contract running the scam has taken over 177 ETH:
“Since the smart contract was deployed almost six months ago, it’s possible that it was used on other phishing websites.”
When ETHDenver was scheduled to take place on February 24 and 25, hackers had gone so far as to purchase a Google advertisement to promote the URL of the malicious website. In a Google search, the phony website came up after the legitimate ETHDenver website.
Scams and hacks are still pervasive in the cryptocurrency industry. Cryptocurrency worth about $2.8 billion was stolen in 2022 due to numerous hacks and exploits.
In the past few weeks, the web hosting company NameCheap discovered that one of their third-party services had been misused to send several unsolicited emails that were expressly addressed to MetaMask users. An “email gateway issue” was how Namecheap described the occurrence.
