Web3 Security CertiK X Account Compromised in Phishing Scam

On January 5, CertiK, a blockchain security and smart contract audit firm, fell victim to a cyber attack. This incident occurred on the company’s official X (formerly Twitter) account, where a phishing link was posted after a bad actor hacked into the protocol’s social media profile. CertiK announced that a “verified account associated with well-known media” managed to hack into one of their employee’s X accounts, which led to the posting of links to phishing scams. The company quickly addressed the breach by removing the phishing link within 14 minutes, and there were no significant losses from the exploit​​​​.

The phishing attack was initially detected due to a direct message received by the CertiK employee, which showed signs of being dangerous. Blockchain detective ZachXBT highlighted that the account contacting CertiK had not posted since April 2020, indicating it was likely compromised. CertiK, responding to the incident, encouraged those affected by the exploit to contact them, emphasizing the challenges in combatting phishing attacks that exploit human trust and vulnerabilities​​​​.

This security breach is particularly notable given CertiK’s role in blockchain security. Just a day before the incident, CertiK had released its 2023 Hack3D security report, which highlighted a 50% decline in crypto losses, marking it as a significant milestone in blockchain security. The compromised CertiK account posted tweets about a fake vulnerability in Uniswap V3’s smart contract code, directing users to a fraudulent website impersonating Revoke.cash. Revoke.cash confirmed that Uniswap was not compromised, but this incident raised questions about CertiK’s own security practices​​​​.

The official CertiK Discord site was also hacked, replaced with a fake Discord promoting phishing links. CertiK subsequently regained control of its account and removed the fake tweets. However, the breach underscores the ongoing vulnerability of the crypto industry to hackers, with stolen funds exceeding $3.8 billion in the last year. CertiK’s investigation into the breach revealed it as part of a “large scale ongoing attack” using social engineering through Calendly, a scheduling app​​.

The recent hacking of CertiK’s X account, a Web3 security firm, to promote a cryptocurrency wallet drainer, highlights a notable irony and concern in the blockchain security landscape. This breach, achieved through social engineering, utilized a compromised account associated with a prominent media outlet. The attackers, impersonating a journalist, lured a CertiK employee with a phishing link disguised as a scheduling site, ultimately compromising the company’s account. This incident underscores the sophisticated nature of modern phishing scams, which exploit human trust and vulnerabilities, and poses critical questions about the robustness of security measures within blockchain and crypto-related firms.

The use of social engineering in this attack reflects a growing trend in the cyber world, where even security-savvy individuals and organizations are vulnerable. This breach is particularly striking given CertiK’s role in ensuring the security of blockchain technologies. The event not only points to the need for heightened vigilance and advanced security protocols in the Web3 space but also serves as a reminder of the relentless and evolving nature of cyber threats in the blockchain ecosystem. The irony of a Web3 security firm falling victim to such an attack highlights the universal susceptibility to sophisticated cyber threats and emphasizes the importance of continuous improvement in security practices across the industry

Image source: Shutterstock