Featuring pig butchering and fake mining scams, a new fake approvals scam using airdropped gas tokens, npm malware from the Lazarus Group targeting crypto developers, and MetaMask's Menpo DeFi incident database at DeFi Security Summit.
Featuring the inaugural MetaMask and Wallet Guard State of Security Twitter Space, Harry Denley on smart contract security, an explainer on LavaMoat's scuttling feature, and a preview of the Menpo DeFi incident database at DeFi Security Summit.
Featuring the $10 million multichain hack targeting crypto veterans, a checklist for investigating a drained wallet, an FTC alert about phishing emails, and a Hardened JavaScript conference talk.
Featuring the scam-as-a-service that stole $27 million, MetaMask, OpenSea, and Blockaid's new transaction security feature, the multichain drainer targeting longtime crypto users, and Etherscan's move to curb address poisoning.
Featuring a surge in airdrop scams that exploited fake giveaway hype to phish users, ~2,400 wallets targeted before the Arbitrum airdrop, a Cloudflare Global API key warning for web3 teams, and EthDenver talks on Delegatable and JavaScript realms.
Featuring MetaMask disabling eth_sign by default as the Monkey Drainer phishing group shuts down, a Namecheap/SendGrid breach behind MetaMask-branded phishing emails, a Google Fi SIM-swap hack, and a fake EthDenver site tied to a phishing wallet.
Featuring address poisoning attacks that exploit lookalike wallet addresses, a deep dive on read-only reentrancy as an emerging DeFi attack vector, LavaMoat's new LavaTube object-graph tool, and RATs hidden in fake game downloads.
Featuring the Lazarus Group's new AppleJeus malware in fake crypto apps, a social engineering scam netting 14 Bored Apes worth $1.07 million, LavaMoat's bin confusion mitigation, and a year-end wrap covering PhishFort takedowns and the MobyMask launch.
Featuring LavaMoat's rollout of Snow and global scuttling to the MetaMask Extension, the case for integrating Snow into MetaMask, a Twitter Space on Snaps and self-custody after the FTX collapse, and Google Sites and Telegram trading bot scams.
MobyMask, a new initiative from the MetaMask team to help proactively protect users from phishing, uses a dynamic web of trust for sourcing phishing reporters.