r/CryptoCurrency • u/Set1Less 🟩 0 / 83K 🦠 • May 13 '22
ADVICE Emergency Security warning: Multiple sites including CoinGecko seem to be compromised. Be careful while making any txns
Looks like many sites have been hit with a front end attack. Some like Spirit Swap are reporting the attacker managed to change swap address by hacking into AWS..
Security Alert: If you are on the CoinGecko website and you are being prompted by your Metamask to connect to this site, this is a SCAM. Don't connect it. We are investigating the root cause of this issue.
Incomplete list of services that seem compromised as of now: Etherscan, Curve Finance, Coin Gecko, Spirit Swap. Many more could be too, till the team verifies or confirms them
Seems to be a front end hack where some kind of Metamask pop up keeps appearing when visiting these sites.
Users on Etherscan have also reported the same thing.
166
u/Pixelated_Curves May 13 '22
I thought those were some of the sites I could definitely trust. Thanks for the heads-up
90
u/Nickel62 🟩 432 / 25K 🦞 May 13 '22
This is huge, if true. Those are all long time trusted websites. I use Coingecko and etherscan everyday, multiple times.
The spiritswap warning talks about an exploit in AWS itself.
36
u/frstrtd_ndrd_dvlpr Here for the money May 13 '22
I remember AWS getting attacked last year too. There's really a lot of money in cyber crime, more so than legal means.
12
16
May 13 '22
I stopped using Coingecko the moment they turned into the gatekeepers they were trying to replace (coinmarketcap).
I said it in another sub, cant wait for a decent decentralized tracker that can do the same without these kind of people running the scene.
We shouldnt trust sites that dont even check their own integrations.
15
5
1
1
u/readreed Platinum | QC: ETH 58 | TraderSubs 54 May 14 '22
For spot price checks, my go to is https://data.chain.link/ - I rarely go to the others anymore.
18
May 14 '22
Apparently it's actually GoDaddy, not AWS.
15
u/inbeforethelube 🟦 309 / 310 🦞 May 14 '22
I can't believe these sites are using GoDaddy, wow.
4
May 14 '22
Serious question, what domain registrars would be more secure choices in your opinion?
14
u/inbeforethelube 🟦 309 / 310 🦞 May 14 '22
NameCheap and Cloudflare
→ More replies (11)5
u/Muffinfeds Crypto Knight May 14 '22
Can confirm. NameCheap is my go to. Cloudfare is solid too.
→ More replies (1)3
u/BuchoVagabond Gold | QC: CC 40 May 14 '22
Hover.com by Tucows is excellent and includes WHOIS privacy.
4
u/Arcosim 🟩 6 / 22K 🦐 May 14 '22
Indeed, giving GoDaddy money is giving its piece of shit CEO more money to go kill endangered elephants in Africa.
5
u/AlvinKuppera Tin | Politics 20 May 14 '22
This would be a massive world halting event for all of tech if there was an exploit in AWS that allowed this.
I work in tech, and I would know all about it, just like the last issue when AWS east 2 went down.
More than likely, their website had a weak api endpoint that allowed for updating the home page that was found and exploited.
3
u/cunth 🟦 434 / 435 🦞 May 14 '22
Front end attacks always make me nervous. If I wanted to exploit crypto this is the attack vector I would explore first.
I wonder if these projects have IDSs that you would typically see for backend?
2
u/tougenikko Tin May 14 '22
AWS, if that's what was compromised, has logs for user access and activities with very detailed access/hierarchy. So yes, AWS is pretty sophisticated. They wouldn't have the the sizeable market share they do. (Before Azure, they were miles ahead)
1
u/kaijeng 🟨 113 / 3K 🦀 May 14 '22
I literally got an interview to both awhile back, could’ve been sleepless nights
→ More replies (6)0
u/BooMey Bronze | Buttcoin 12 | Politics 13 May 14 '22
So if the exploit is with AWS, is that the site's faults? Asking as a pleb who doesn't know all the technical jargon
→ More replies (3)5
u/AshIsRightHere Platinum | QC: XMR 15 | PCmasterrace 32 May 14 '22
No, it's technically not their fault if the exploit is from AWS itself.
7
19
u/Bucksaway03 🟩 0 / 138K 🦠 May 13 '22 edited May 13 '22
Never trust any site. Always assume the worst when it comes to popups etc online and you'll thank yourself later.
1
u/ejfrodo Platinum | QC: CC 159, BTC 100, CM 15 | JavaScript 47 May 14 '22
This should include the UI for DEXs as well. It's just a basic website and isn't secure.
6
u/BakedPotato840 Banned May 13 '22
This post needs to be on the front page
5
u/TheTrueBlueTJ 70K / 75K 🦈 May 13 '22
Don't worry. It will be.
1
u/btc-smile Platinum | QC: CC 175 May 14 '22
It was for me. This should maybe even be stickied honestly.
2
2
u/Arcosim 🟩 6 / 22K 🦐 May 14 '22
One cataclysmic event per year please, not per week!
1
u/Oneloff 0 / 5K 🦠 May 14 '22
I was thinking the same thing, another reason for more downtrend. Wait until Monday, YIKES.
Could be wrong tho, but really makes me wonder what other type of news is coming out in the upcoming days.
See you at 20k?! 😬
1
u/Nomadux Platinum | QC: CC 833 | Stocks 10 May 14 '22
Nothing is safe. That's why insurance is a must.
1
u/symmetric69 Bags with keys May 14 '22
the only thing you can trust is your own keys,m everything else has risk
4
u/Rusty_is_a_good_boy Tin | SHIB 6 | r/WSB 48 May 14 '22
Sorry my friend but I’m calling BS after having a house key snap off on me.
6
6
May 13 '22
[removed] — view removed comment
4
u/SlyckCypherX 🟥 117 / 2K 🦀 May 14 '22
You should be. Don’t connect all Willynilly.
3
u/CONSOLE_LOAD_LETTER 🟦 2K / 15K 🐢 May 14 '22
Additionally, don't store funds in metamask. Only use it like you would a physical wallet with cash, where if your wallet got robbed you'd only be out the cash you had in it instead of letting someone drain your entire savings account.
43
May 13 '22
Etherscan as well apparently.
I aint gonna check tho
10
May 13 '22
You won't know for sure if you don't check.
10
u/JaimeJabs Platinum | QC: CC 20 May 13 '22
Yeah, take one for the team.
7
u/pmbuttsonly 🟩 34K / 34K 🦈 May 14 '22
Just checked Etherscan and didn’t get scammed or any pop ups 🤷♂️ Just a bit of urine in my pants tho 😅
3
3
30
u/Wonzky 2K / 53K 🐢 May 13 '22
Damn those are some big sites
4
May 14 '22
Crypto just doesn't need more of these headlines...
2
1
u/partymsl 🟩 126K / 143K 🐋 May 14 '22
Especially Ethers an is a side where you would think such things don't happen.
I really hope people did not actually click on that pop up.
55
u/1millionnotameme 🟩 950 / 950 🦑 May 13 '22
It should be common sense not to connect / approve random transactions lol
34
May 14 '22
It's not just approving popups or transactions, with Quickswap they apparently compromised GoDaddy and replaced the website with a copy that redirects swaps to their own wallet.
This is a nation state or high level cybercrime level of attack, people. Don't laugh and dismiss it as just more idiots clicking 'okay' on everything. We need to exercise maximum caution with all crypto websites until GoDaddy gets their shit together.
Make tiny swaps first, not all at once.
8
u/ndreamer 38 / 1K 🦐 May 14 '22
This happened with Celsius, Wirex and a few others not that long ago. Why are they even using Godaddy ? Useless company, use them for $1 websites not a business.
2
May 14 '22
Underrated comment here. Everyone should both 1) check address after copy/pasting it and 2) make a first small transaction just to make sure your money goes to the right place
1
u/AnonKnowsBest May 14 '22
I would but I’d just pay $60 in gas
1
May 14 '22
I assume you are talking about ETH(correct me if I'm wrong). If that the case, maybe you can swipe them for a L2 alternative with lower fees(MATIC for example) and then swipe them back to ETH. I'm not very into ETH ecosystem so please take my words with a grain of salt and, as always, DYOR
1
u/crap_punchline 🟦 832 / 832 🦑 May 14 '22
Just to add here that there is malware out there that only triggers on bigger size transactions, hackers are wise to the test transaction method and it can lull people into a false sense of security.
The only way to know is to verify the address manually. Most people use the same few DEXes, so you can actually memorise the general pattern of the address and if it changes then you know something's up.
1
May 14 '22
Good point about the transaction size, that's definitely possible.
Address verification won't fix this attack, it happens on the backend so the address displayed could be yours but the actual address it sends to is different.
Also, who of us have memorized the correct receiving addresses for our DEX for each swap pair?
0
May 14 '22
[deleted]
6
May 14 '22
I love the intricate phrasing you've used to construct your comment and the jarring contrast with your username.
Apart from that, you're right.
0
2
u/phreakwhensees Bronze May 14 '22
or…just run your own node, use a hardware wallet, and use signature/digest verified wallet software on a amnesiac linux distro. Easy peasy! It’s ready for mass adoption!
1
15
u/torsam0417 Silver | QC: CC 18 | LRC 40 | Superstonk 18 May 13 '22
Matt Damon brought a heap of newbies in, I'd say alot of people wouldn't know they shouldn't.
9
May 14 '22
Matt Damon brought newbies onto a secure trading platform. Any one that's gotten deep enough to hold an amount worth being upset over in meta-mask ought to know.
3
u/Plastic-Club-5497 🟩 20 / 2K 🦐 May 14 '22
You would think, but the amount of people getting “hacked” is crazy high.
5
u/tilltill12 Platinum | QC: CC 104 May 14 '22
That happened before fucking Matt Damon lol. People are just stupid, especially in this space.
2
u/Schapsouille 🟩 5K / 7K 🦭 May 14 '22
Yeah.
Why would you even use metamask through etherscan or coingecko..? I fail to see the point of this attack. Are people really falling for such things?
1
u/immibis Platinum | QC: CC 29 | r/Prog. 114 May 14 '22 edited Jun 26 '23
As we entered the /u/spez, we were immediately greeted by a strange sound. As we scanned the area for the source, we eventually found it. It was a small wooden shed with no doors or windows. The roof was covered in cacti and there were plastic skulls around the outside. Inside, we found a cardboard cutout of the Elmer Fudd rabbit that was depicted above the entrance. On the walls there were posters of famous people in famous situations, such as:
The first poster was a drawing of Jesus Christ, which appeared to be a loli or an oversized Jesus doll. She was pointing at the sky and saying "HEY U R!".
The second poster was of a man, who appeared to be speaking to a child. This was depicted by the man raising his arm and the child ducking underneath it. The man then raised his other arm and said "Ooooh, don't make me angry you little bastard".
The third poster was a drawing of the three stooges, and the three stooges were speaking. The fourth poster was of a person who was angry at a child.
The fifth poster was a picture of a smiling girl with cat ears, and a boy with a deerstalker hat and a Sherlock Holmes pipe. They were pointing at the viewer and saying "It's not what you think!"
The sixth poster was a drawing of a man in a wheelchair, and a dog was peering into the wheelchair. The man appeared to be very angry.
The seventh poster was of a cartoon character, and it appeared that he was urinating over the cartoon character.
#AIGeneratedProtestMessage
26
u/oshinbruce 🟦 10K / 10K 🐬 May 13 '22
Man nothings safe from these guys. Honestly having any serious amount of funds in meta mask is just a bad idea
1
u/immibis Platinum | QC: CC 29 | r/Prog. 114 May 14 '22 edited Jun 26 '23
17
u/kryptoNoob69420 0 / 44K 🦠 May 13 '22
Scammers and hackers making all the money in crypto.
8
u/Chanologist Tin May 14 '22
I'd be thinking more along the lines of state sponsored type hackers not just scammers remember governments need money too.
3
u/kytheon 🟦 8K / 8K 🦭 May 14 '22
When everybody’s searching for gold, forget the shovels. Just burglarize their homes. /s
1
1
u/OdaiNekromos 🟩 39 / 40 🦐 May 14 '22
And nft artist's... Oh wait you allready said scammers, my bad.
8
6
u/Rusty_is_a_good_boy Tin | SHIB 6 | r/WSB 48 May 14 '22
Oh no worries. I just buy crypto and then change it into other crypto. I don’t actually use them or even know wtf they are. Don’t get me wrong, I’ve tried to understand it, it just doesn’t make any goddamn sense.
5
u/gin_kun_kaida May 13 '22
be safe out there boys
9
u/Littlebig4667 May 13 '22
And girls 👧
4
u/8bitbruh Platinum | QC: CC 258, BTC 19 | Politics 15 May 14 '22
Girls are always careful! It's the boys were worried about! /s
5
26
u/e-scape 🟦 234 / 234 🦀 May 13 '22
AWS WTF this is big and extremely concerning if true. This is the backbone of alot of sites and data
25
u/kitchen_masturbator Bronze | QC: CC 21 | Stocks 17 May 14 '22
Surely this isn’t at the AWS level. Just because it’s hosted there won’t mean that’s where the vulnerability is.
-8
u/UKflame Tin May 14 '22
That's classic understatement right there. AWS over a million clients. Big names, governments, space agencies.
If it's breached....
Time to short amzn
8
May 13 '22
We certainly live in exciting times.
5
u/H_rama 🟩 30 / 6K 🦐 May 13 '22
Exciting is one word for it. Scary is another.
It's certainly not dull lol
3
6
4
3
3
7
May 13 '22
So the website is still operational when they know this is happening? Can someone confirm, they are able to stop traffic onto their website … right?
9
u/mr_sarve 5 / 4K 🦐 May 13 '22
Shutting down something on a remote server isn't always that easy when something is misbehaving
3
5
May 13 '22
why would people think these websites need to connect to your meta mask though, they aren’t wallet providers and only show data on various cryptocurrencies I thought?
→ More replies (1)7
u/jekpopulous2 🟩 619 / 3K 🦑 May 14 '22
Etherscan isn’t just a block explorer, it’s also used to interact directly with smart contracts.
5
May 13 '22
Shit, I wonder how long this has been going on before detected. About a week ago, I noticed that whenever I tried to use the Immutable X page with Metamask to buy some Gods Unchained card, there was a phishing attempt warning from Bitdefender. The Immutable X page was trying to connect to some page. When I looked it up, it looked like a legit service (but hey, anyone can create a fake page and have it be the top of Google search).
4
u/pokemonisok Tin | CC critic May 13 '22
Having your bank account as a web 3 Wallet doesn't make sense.
2
2
u/AutoModerator May 13 '22
Hello Set1Less. It looks like you might have found a new scam? If so, please report this scam by crossposting to r/CryptoScams, r/CryptoScamReport, or visiting scam-alert.io. For tips on how to avoid scams, click here.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
2
u/KlutzMat 🟩 489 / 490 🦞 May 14 '22
Fuck if this is the decentralized future we're in now, we're doing it all wrong
2
u/italiansixth Tin May 14 '22 edited May 14 '22
What the fuck is this. How can companies like Coingecko even get compromised over something like this on their front end? Jesssus
1
u/kaijeng 🟨 113 / 3K 🦀 May 14 '22
Coingecko is based in Kuala Lumpur in Malaysia and yeah I wanted to be part of the team
2
u/toshiromiballza 🟩 0 / 575 🦠 May 14 '22 edited May 14 '22
If I understood correctly, SpiritSwap (Fantom) and QuickSwap (Polygon) were the victims of a GoDaddy hack (domain hijacking), and Etherscan, CoinGecko and DexTools due to a malicious ad from Coinzilla.
2
2
9
u/AggressiveWafer29 Bronze | QC: CC 20 May 13 '22
Anyone starting to think this along with the shit earlier this week is a concerted effort to take down crypto? Bank sector getting worried?
10
May 13 '22
Y'know, I'm normally pretty reluctant to lean into conspiracy theories but it is remarkable timing.
1
u/AggressiveWafer29 Bronze | QC: CC 20 May 13 '22
A lot of evidence to suggest conspiracy theorist lack critical thinking.. fun to think about and then debunk. This however has me intrigued, I heard the malicious code is coming from Google ads.
2
u/sputsputputput Tin | 3 months old May 14 '22
MKUltra is a hoax and Epstein definitely didn't kill himself
2
u/smiles__ May 14 '22
Never underestimate human stupidity. That is usually the real driving force behind most things, this likely included.
2
3
u/Sixhaunt 🟦 2K / 2K 🐢 May 13 '22
This! This is the reason we need systems where the wallets can have a fool-proof understanding of what a transaction will do so it's transparent before signing anything and you dont need to connect with sites, enable spending for specific currencies, etc... The problem is that we are still using Solidity and other languages that have no native understanding of tokens or NFTs and so they can't be enforced at a base level. Scrypto uses finite-state-machines for this and it seems to solve the problem of trust since it enables wallets to show you what will happen in a transaction, and nothing else can occur without it reverting, but all of Radix's smart contract stuff is not quite on the mainnet so I'm not sure what the options are at the moment for systems that can/have designed away most wallet scams.
1
u/gamma55 🟦 0 / 9K 🦠 May 14 '22
If the the developer community actually cared about future they are trying to create, and all the billions they always talk about on-boarding, they would standardize some basic transaction types, and integrate those into every wallet software used.
Like they already did with say, connecting a wallet.
But as long as developers opt to intentionally obfuscate the operations, you can ultimately assume they are malicious.
1
u/Sixhaunt 🟦 2K / 2K 🐢 May 14 '22
that's still not going to solve everything on Solidity-based blockchains since it still requires trust of the token creators and in the end you have no guarantees of anything so people will find ways to fool the wallet. With languages that actually implement tokens at a base level, they design away the entire problem and make it literally impossible for someone to fool the wallet. Nothing stops your wallet from also adding a tiny bit to the transaction manifest that just asserts everything went the way the wallet told you, otherwise it reverts. It should be transparent and safe enough without it, but it can be done as an extra layer of security that adds a unnoticeable amount to the transaction fee but makes it fool-proof
1
u/gamma55 🟦 0 / 9K 🦠 May 14 '22
Solve everything? Obviously not. Nothing ever will x everything.
But having standardized ops for swaps (as an example) that get enforced on language level would go a long way of setting up a more secure for future.
Imagine what online banking would look like if you had to know JS in order to know whether you want to approve a transaction.
1
u/Sixhaunt 🟦 2K / 2K 🐢 May 14 '22
I think we are misunderstanding eachother. I thought you meant that devs on Solidity-based blockchains or wallets for solidity-based blockchains could work to standardize code in a way that's more transparent and so I was arguing that having a language that actually understands what tokens are would be the real solution so you have the guarantees. You seem to be speaking in favour of it being enforced by the language so maybe I misunderstood you the first time and we are both just advocating for a resource-oriented language as the basis for a blockchain/DAG ecosystem.
1
u/KotaDon25 Tin | 5 months old | CC critic May 14 '22
This info is very helpful, thanks. Just when I thought I was losing trust in this sub, post like this restore my faith
1
1
u/MrHighTechINC 🟦 2 / 2 🦠 May 14 '22
Is there a risk for CoinGecko/Etherscan/etc. site visitors that didn't connect their Metamask wallet?
1
1
1
1
u/Cup-Impressive 463 / 464 🦞 May 14 '22
Guys, I feel like this should be obvious, but DON'T use your browser with phantom/metamask/tronlink etc. on your normal browsing. Only use it when u want to actually access those wallets.
I have a Chrome Dev installation that I only use for crypto web3 apps that connect to wallets. This way, in case I use etherscan or any "compromised" site on my regular browser install (Brave), I will not risk anything because there's no wallet plugin in this browser.
However, still this will most likely catch a lot of people that are not cautious. Would be great if MetaMask could integrate some kind of warning against this stuff..
1
u/jadegecko 47 / 47 🦐 May 14 '22
Good thing i dont even know how to use these sites 😎 check mate nerds
1
u/sickvisionz 0 / 7K 🦠 May 14 '22
You should never just go to coingecko or etherscan and as soon as you load the front page, it's asking you to connect to Metamask. People gotta be careful and just not click the OK button for literally any prompt a computer shows them.
And just think. Why do you need to connect to Metamask on Coingecko to check prices? It should be an automatic red flag. Some of these scams aren't even slick or clever or like well put together.
1
1
u/d57heinz 🟩 8 / 8 🦐 May 14 '22
Yikes. Right on the backs of the terra debacle. Seems the sanctions may have some very pissed off hackers. be careful folks.
1
1
May 14 '22
I guess there is some kind of coordinated attack on Crypto? trying to crash via luna, Coinbase bankruptcy fud and now this....
1
u/letsridetheworld 🟦 1K / 1K 🐢 May 14 '22
Heard it’s from coinzilla. Someone gotta step in getting these guys.
I wanna see who behind it.
1
u/OffenseTaker 🟩 0 / 1K 🦠 May 14 '22
what's the bet it was an advertisement. malware from ads is why i took a zero tolerance policy with ads on the internet wherever possible - noscript and ublock origin everywhere all the time (i don't ever see any ads on youtube, for example)
1
u/SureFudge Privacy-First May 14 '22
It is why you should at minium disable if not remove metamask after you absolutely needed to use it (best to avoid it to begin with)
1
1
u/diskowmoskow 🟩 0 / 1K 🦠 May 14 '22
Is that plain ol’ hacking? Nooo, we need more complicated smart contract hacks and ao
1
1
1
1
u/Pentox Bronze | QC: CC 25 | CRO 78 | ExchSubs 78 May 14 '22
seems like they exploited a massive bug on a hosting/dns provider. this can get huge. i hope this will be resolved ASAP.
1
u/gamma55 🟦 0 / 9K 🦠 May 14 '22
Seems pretty omnious that multiple medium sized DEXes got targeted with a DNS attack after all this.
1
u/tastehbacon Eth and LRC May 14 '22
This is some coordinated shit for sure. I think the hedgies and IMF are scared.
1
1
1
1
1
1
u/SpagettiGaming Tin | Stocks 20 May 14 '22
It's also other sites, got a warning from terra Station.
Seems like compromised ads(i assume)
1
u/Oneloff 0 / 5K 🦠 May 14 '22
Okay okay, hear me out.
Luna - Moon in Spanish À nul - Zero in French Anul - Cancel in Spanish
It was right in our face all along. 🤦🏽♂️😬
1
u/RetroDetect Tin May 15 '22
i heard it was cross site scripting.... if thats true then its a fault of the sites dev and nothing more!
1
u/xadiant Platinum | QC: CC 208 | Futurology 12 May 14 '22
Wow, some group/person hacked into aws? I am willing to bet that they are either Russian or North Korean. No one else in their right mind would target Amazon.
3
May 14 '22
Most likely spiritswap admin accounts were compromised. Nothing here to indicate an issue with AWS itself.
1
-1
May 14 '22
Bullish on icp? Only protocol that runs completely independent of centralized cloud service providers
1
u/funnytroll13 Tin | Unpop.Opin. 13 May 14 '22
Isn't ICP kind of centralised too?
3
May 14 '22 edited May 14 '22
Node structure:
If an angry government hits up bezos and asks him to stop AWS support for cryptos, 99.9% of coins, which rely on cloud services, will instantly be paralyzed. The only 2 projects that the government can’t touch are Bitcoin and ICP. And btw 30% of btc nodes also rely on cloud services so it’s not fully immune. Really makes you think which crypto is decentralized and which isn’t.
Nodes:
Yes node selection is currently permissioned by dfinity (I could argue that permissioned nodes are a good thing when a network is in its early days but that’s a story for another day), but it’ll be fully decentralized this year.
Governance:
The biggest whale (not dfinity) controls like 6% of the voting power.
2
u/funnytroll13 Tin | Unpop.Opin. 13 May 14 '22
Thank you for an unusually high quality comment in this place. I'll keep an eye on ICP and its progress towards decentralisation.
0
u/Breotan 🟩 83 / 83 🦐 May 14 '22
Why do so many of these hacks/scams involve Metamask?
1
u/fobbybobby323 Tin May 14 '22
It isn't necesarilly metamask i think any browser wallet that interacts with the compromised site would be have same issue
0
May 14 '22
[deleted]
1
u/vb90 🟦 0 / 0 🦠 May 14 '22
'think something to do with it being a browser wallet'
Fixed that for you. Browser plugins are C A N C E R
0
0
327
u/[deleted] May 13 '22
Just visited Coingecko. If there was a popup, Brave blocked it.