Safeguarding your crypto funds against theft

Crypto theft exists for a reason — it is arguably the most profitable and hardly traceable due to the nature of blockchain. Malicious attempts to get hold of your digital assets might look legit at some point, but they are easy to spot if you pay extra attention.

With the surge in phishing within the crypto community and the feedback we have received, we’ve compiled some of the common scams that traders have fallen for. In the unfortunate event that you encounter phishing attempts, the below tips should help you better protect yourself from scammers.

Common scams

Phishing email

The oldest phishing method (yet with the highest number of people falling for) is through emails, where phishers engineer attacks to steal user data and login credentials to get hold of traders’ digital assets. These attempts are usually masqueraded as a trusted entity or impersonated as messages from an official, customer service or network administrator. When the victim clicks to open the email, it might lead to the installation of malware that can access all your usernames or passwords stored within.

We’ve seen that scammers send phishing emails disguised as OKX using this email address <do-not-reply@www-okex.com>. Once a user clicks “confirm”, he is then directed to a phishing “OKX” website and tricked to login with the 16-digit key for Google Authenticator private key. At this point, the victim has completely leaked his username, password and Google Authenticator code.

Tips: Setting up an anti-phishing code for emails to prevent phishing emails.

Phishing website

Another conventional phishing method is a fake website. Scammers set up phishing websites that mimic the exchange’s sign-in pages to trick traders into disclosing their confidential information, such as usernames and passwords.

How to tell if the website is legitimate? Phishers are very sophisticated in designing phony websites today. Typically, these websites look 99% similar to the genuine website, complete with logo and other graphics of the original one. But don’t be fooled by a site that looks real, just because you see the logo doesn’t mean the website is legitimate. Instead, you should look at the website address carefully — whether there are spelling errors, redundant symbols before or after the company name, or if the page address is “https://”.

For instance, scammers posting fake “OKX” links on social media trigger users to open the fake website, then ask them to login and enter their 16-digit key for Google Authenticator private keys and that’s how your assets are hacked.

Tips: Enable Google Authenticator or mobile verification to prevent phishing attacks. If you’re unsure about the website, DO NOT sign in.

Phishing attack

In the crypto world, a lot of websites ask traders to check the URL bar for the correct SSL certificate and URL before logging in, but it couldn’t guarantee that the website is safe, as hackers also evolve along the way. When users leak their login details on phishing websites, hackers can then use API to withdraw funds or perform abnormal trades to steal users’ assets. If a user is under phishing attack, the server log would record the phishing process. Users are often misled to use API and then have their assets stolen.

Tips: Do not use any APIs if not necessary

Impersonating Officials

On social media platforms and communities (such as Telegram), scammers often impersonate customer support team members to text traders. As users are eager to solve their problems, they might be misled to open phishing websites and hence their data might be compromised.

How to effectively protect your assets — the practical ways

To avoid falling in the hands of crypto criminals, traders need to stay secure and flexible in order to benefit from the volatile market.

Two-Factor Authentication (2FA)

You might not have realized but most of us regularly use two-factor authentication (2FA) online. It is widely used to protect the data of your online accounts. The most common form of two-factor authentication is when you log into your account, you will receive a one-time security code via SMS on your registered phone, so that your account is better protected as you need both passwords and your phone in order to access your account.

Google Authenticator

A more secure way is the Google Authenticator, which scans barcodes on participating websites to create 2FA codes that serve as a second level of protection when users log in to keep their account safer. The benefits of Google Authenticator, besides not having an SMS message hijacked, are that you have all of the codes in a central location and that they’re available all of the time, even when your phone is offline.

Never too vigilant

Although no security product can claim to be perfectly safe, it’s good to be extra vigilant (especially when dealing with cryptocurrencies), so your assets out of reach for scammers.