Coinbase Security Series: Phishing and Social Engineering Awareness

Hi everyone. Um I am Eli from the protocol security team over at Coinbase and uh we're here doing another base security session. Um this one's going to be on fishing and social engineering awareness. And uh with us today we have uh Heidi and Serena from Unit 0x uh which is our internal um onchain investigations team. Um and if you have any question, if anybody needs to know anything about what's happening on chain in the background, um these are the people to talk to.

Um so with that, I'm going to hand over to them. If you have any questions, please post them in the chat and uh if we have time at the end, we'll get to as many as we can. Um and uh Heidi, uh on to you.

Awesome. Thanks for that, Eli. Can you hear me? Okay. Is everything all good on soundcheck?

Awesome.

Yeah. Yeah, sounds great to me. Perfect. Um, so nice to meet you guys. Uh, today we're going to be hosting a session, as Eli said, on fishing and social engineering awareness.

So, quick, uh, intro. Uh, my name's Heidi and I'm joined here today by Serena. And, um, we do onchain investigations here at Coinbase. And, you know, onchain investigations encompasses a lot of different things. That could be looking into very benign fishing tactics, but that can be going all the way up to investigating, you know, DPRK into how they're laundering funds from recent, um, exchange hacks.

So, uh, our role here, every day it's different. Every day there's something new. We're constantly trying to stay on the edge of things, um, of what is up and coming. And so, hopefully today will give you a good kind of like peak into our lives here at the company. So, we're talking about social engineering and fishing awareness.

I want to make it very clear from the get-go that most anti-ishing trainings such as these just they don't work. Um, as much as we're going to try to cover as many different case studies today of like what to look out for, quite frankly, uh, social engineers and fishers, they are going to be constantly evolving their tactics. So, this presentation might already be out of date even today. It's just one thing to keep in mind. always just be aware.

So over $1.7 billion dollars in crypto was stolen this year due to fishing and social engineering alone. And honestly this figure is conservative at best. Um we know that some attributable attacks this year uh stem from for example by who that lost 1.5 billion and we'll talk about that in detail about how that happened.

Um, but there are various different other exploits such as just generally private key theft and wallet trainers that also contribute to this mass number. But why is fishing such a problem within crypto? Um, the way we kind of see it is it's it's split out into like there are sort of four quadrants here. One is it's there are low barriers of entry of getting into crypto um and also getting into projects. You know, potentially socially engineering your way into becoming a developer on a project team.

There's also very high rewards, right? Um, you can potentially steal a lot from a project. You can potentially steal a lot from like a a poor victim user. And then of course the third leg is the blockchain chain speed and permanence of it. So once funds are out of a victim's wallet, they're gone.

Gone. Like there's no way that you can reverse that transaction. And that's pretty enticing for an attacker. And last, but certainly not least, I really want to call out user blind faith um in, you know, blockchain security that may or may not already exist. Um and security bug bugs and fe bugs that are actually features so to speak.

And what do I mean by that? So, there's a lot of blind faith that when you're, you know, sending funds on chain and you think you're sending to the right address and you click send, um, and nothing looks weird, um, in any of sort of the input data that you're doing the right thing and everything's fine, right? You just trust it inherently. That's not always the case, right? What's also not always the case is like, oh, well, we want to like, oh, I just signed a signed a message.

It's no big deal. I just, you know, signed here that I was going to interact potentially with this sketchy bridge. No big deal. No, that's actually a problem because you probably signed away, you know, access to certain ERC20 tokens and boom, they're gone, right? And so stuff like permit, right, um, uh, a function that's used quite often, right, especially with bridges is fantastic, but it's a feature and also a bug that then, um, uh, social engineers or fishers actually like to, uh, exploit.

So that's what we're getting at here. And this is a very big area that I really want to call out that is pretty it's a pretty big issue within crypto. And some of it might be just the technical expertise that's required to actually verify and check that indeed the transaction that you're making or the message that you're signing is the one you want to actually be signing and you're fully aware of what exactly you're doing. So fishers will target you in a combination of ways. And this is like not supposed to be a laundry list, but these are some pretty big callouts of how they'll try targeting you.

they'll try spear fishing you. So that's sort of a targeted attack going directly for you. Um for example, if they know your if you have, for example, on your ex handle your ENS address, which many of us have, right? Or if you have an NFT, like they might try to target you through social media, they might target you through your Telegram, they might do all sorts of things because they actually know your wallet balance based on your ENS. Supply chain attacks is another huge one where what these uh what these attackers will do and we'll see in some case studies is they'll compromise a third-party service such as safe right and that are commonly actually used by projects right and that compromise then leads to compromise of several different projects we've seen this time and time again next obviously there's malware and device compromise so when a lot of people think about you know getting hacked immediately they think about things like malware or device compromise so that's like using some sort of remote access tool to gain access obviously to a user's environment.

More recently, what we've been seeing is a lot of malware. It can be like something like an info stealer, which we don't cover in detail in this presentation, where, you know, they try to just steal all of your wallet logs um and try to find, you know, all of your private keys and seed phrases you might have on your laptop. But it could also be malware via contagious interviews um that are down that's downloaded or files that are downloaded that appear benign but actually include malware. And then last but certainly not least, fishers often will in combination with these other uh tactics will invoke social engineering. So that's where they try to like to convince you or manipulate you into compromising yourself or potentially even you know getting hired on a project as we will see.

in a couple of slides from now. So, now that we've gone over kind of like what these combos are and what the combos are that we're going to probably talk about in our um case studies, let's get into some case studies. And I know I've got a slew of them here and we're going to walk through them pretty quickly. So if you guys have questions about details about any of them, we can go into the details, but the point is is to kind of make you guys aware of like all of the different ways in which projects have compromised themselves in the so we're going to actually start from the most recent big cases and work our way back um from there. So of course most of you guys know CoinDCX an Indian uh crypto exchange was hacked back last month a few weeks ago.

They had 44 million stolen from their hot wallets. Now, how did this exactly happen? Like what was the root cause? The root cause was apparently the DevOps dev was moonlighting on three to four projects and had their credentials compromised. I note here three to four projects that you're moonlighting on is a lot.

And that's definitely a red flag that we may or may not talk about a little bit later, but I'm happy to cover that. Um, but oftent times when I see three to four projects being worked on at once by one particular person, that that screams you may or may not have an issue. Next, of course, we all know it already, and I won't harp on Bybit, but everyone knows about the Bybit hack that happened in February where $1.5 billion was stolen. And the way this happened was through a combination of malware and obviously a supply chain attack.

We all know that somehow like their safe like their safe instance was compromised and so therefore the signer signed off on a transaction that in reality didn't wasn't actually performed. Now, how did it actually start though? It start by started out by a safe developer accessing a semi- benign looking page of get stock price and this then ultimately installed malware and then led to um uh attackers DPRK in this particular case um being able to basically take over um specifically the bybit safe so that they were able to then manipulate it so that they could perform their attack. Now, one thing I have listed here, which is the culprit, which is trader trader. This is a subset of DPRK.

So, we'll talk a bit about those um throughout sort of these case studies, but that's one thing to also think about is supply chain attacks here. Next, of course, um you guys might have heard the noise about Nick Franklin. Now, Nick Franklin was an active uh uh Ethereum uh security researcher in the space up through March of 2025 when he ultimately was called out um by 1 in for having sent over a malicious file of a compromised 1 in. And so this malware was then reverse engineered and analyzed and sure enough it was related to citrine sleet aka apple juice. And you don't have to know what in the world that is, but basically it's another subset of DPRK malware.

Um, and so what this what this guy basically did was that he acted as a security researcher helping out various different projects. And so in total, uh, it is believed that he might have stolen upwards of $50 million plus. In fact, one area where Nick Franklin actually shows up is with Radiant Capital, interestingly enough. So, you guys might know Radiant Capital was actually hacked twice last year. Once in a Oh, once in January and the other time in um October.

In October, it had about 53 million stolen. Again, it was Citrine Fleet Apple Juice. And the way that the protocol got compromised in this instance was a dev got contacted by a person who was posing as a former contractor via Telegram. And of course, they were sent a seemingly benign PDF. Hopefully, you're catching my drift with some of this stuff.

But if you actually look at um the uh uh Radiant Capital previously, you'll actually note, and I think there are some security researchers have published this on X is that our friend Nick Franklin back here was involved in one of the multi-IGs uh that was being used to test back in the day for the protocol. So, I'll leave you guys with that like little nugget. Um and uh we'll go move on to the next case study. The next case study here is we've got is Tapioca Dow. Now, this happened also in October of 2024.

They had about almost $5 million stolen. Um, and in this case, what I really want to call out is the co-founder was tricked into downloading malware via a contagious interview. Contagious interviews are are rampant. And what they are is basically you the um project might set up a meeting with a potential VC or the VC might send them a meeting link whatever have you or it might be also just like the project wanting to hire like a dev. Anyways, regardless the attacker will send the meeting link, meeting link gets opened and you think you're using Zoom or whatever have you and boom, you've already installed malware by like accessing the page effectively.

And so the issue with this is that like it's it's very very rampant and of course here in this case it it led to this particular next I want to cover trueflation and this is actually the final case study and trueflation also happened around October of 2024 about $5 billion was stolen and in this case $5 billion was stolen mainly if I recall correctly from the CEO's personal wallets. Now this was done via social engineering and what we believe is probably malware. And what's interesting, and you guys can read a whole bunch of different um reports from the CEO, he was very transparent about everything that went down. So there's like a lot of good news articles on this, but he literally just hired good devs. He thought they were great devs.

Turns out probably was DPRK. Um so again, hiring a good dev might actually be a red flag in some cases, but it's obviously, you know, you got to couple a couple of uh couple together a couple other features. So the takeaway for you, I rattled down a whole bunch of different case studies, a whole bunch of different like threat vectors that you probably are not paranoid about, but the main takeaway is is that attackers are going to try a host of means to get to you in order to get access to either your project or your wallet, but ultimately they want to gain access to your funds, right? And it only takes one person to be compromised. I want to call that out again.

It only takes one person to be compromised. And this is really important when you think about a large project because then you know uh that's that's quite scary, right? With safe for example, it just involves one developer getting compromised. So that's one thing to call out that that ultimately led to the 1.5 billion stolen earlier this year.

So, I'm going to actually uh transfer this uh presentation over um to Serena who's going to be taking who's going to be giving sort of some takeaways for you as to what you kind of should be thinking about like going forward and how to protect yourself better. So, Serena, if you want to take the stage.

Hello. Hello. Uh yeah, my name is Serena. I work in the uh trust and safety team at Coinbase. We kind of focus more on uh consumer safety.

And so basically I'm just going to talk kind of give a few uh slides about um how you as the user can protect yourself um you know within a web 3 ecosystem. Um so obviously you know we've always got to kind of um assume that someone's trying to trick you you know um is is the first thing. Uh so h how do how do we how do we protect ourselves from that? Okay so bookmark frequently uh visited DAPs. Make sure you're using a unique email address for web3 services.

um don't trust and verify and if it's urgent it's probably a scam. I think we all get kind of anxious when we're claiming you know new token air drops or or whatever. We've always got to kind of keep a level head um and make sure that we know exactly um what site we're visiting and what we are um siding and permitting. Yeah. Then next um yeah so basically we we obviously we want to kind of how we how are we going to protect ourselves.

Okay. is we know we have to be like aware. We know we have to be kind of a bit paranoid about um you know onchain transactions. Um so the first obviously is is is use MFA. So by that we mean multiffactor authentication.

Um so that's that's things like Ubi um for example um everywhere that you can um get if if you're a US-based user this is probably more applicable. Um you can get Google to protect from SIM swaps. You should always make sure that your device is up to date. or whatever whatever kind of device you're using, whether it's an iPhone, an Android, MacBook, Windows laptop, whatever it is. Um, and always make sure that you're using kind of reputable antivirus software.

Sounds quite simple, but obviously switch your devices on and off and make sure that you kind of if you are obviously hiring anyone, if you are a developer and you're hiring for your project, you know, you do a significant amount of due diligence into them like you know um there are certain red flags around uh you know people who might might potentially be DPRK like you know obviously AI generated resumes or uh LinkedIn that are kind of claim that they're experts in everything as it were. Um that's obviously not an exhaustive list. also kind of con consider kind of kill switches, whether that's a kill switch, smart contract kill switch, whether it's kind of via multisig um or or or similar, that's also a great kind of uh way to protect yourself and protect your project. iPhones obviously do have lockdown mode if you are kind of uh concerned about a potential breach. Um so that's obviously something to consider for iPhone users.

Um we also obviously want to keep um good browser hygiene. So uh you can use if you're on a desktop obviously uh you can use uh separate containers um or or browser profiles and also uh keep browser extensions to a minimum. Obviously we get a lot of um you know malicious browser extensions that end up uh you know staying on various uh play stores etc that are downloaded before we realize obviously what what's actually within these browser extensions. Um so similarly kind of ties into the next point really of being very wary of software downloads. So you know that goes for anything.

It goes for a browser extension. It goes for you know perhaps if someone reaches out to you and they've got a new opportunity for you and they ask you for whatever reason to download some kind of a new video conferencing software that should obviously ring alarm bells in in your head. Um also you know simulate and and fact check transactions like what are we do? What will this transaction do you know? Uh, obviously Heidi talked earlier about the uh the buy bit hack and obviously how that was essentially blind signing that caused that.

You know, you need to obviously think about how how you're going to uh simulate transactions so you know what you're going to sign before you sign it. Um, and last but not least on this on this slide, obviously trust your gut. You know, does something seem off? Does does the site look a bit off? Does the person who's reached out to you on X or Farcaster or or whatever, do they seem off?

Um, and and and trust trust your gut. You know, don't rush into things. do your due diligence and just make sure that you're protected and then yeah so next we'll kind of talk about um when things go wrong. So obviously you know things do go wrong even if we've done taken all those steps um you know sometimes things go wrong and then we have to obviously take steps to address what's happened. So number one obviously pause your project you know uh pause all transactions make sure that you revoke sessions and approvals um you can use tools um to obviously monitor what's going on on chain and then make sure that you're reporting any kind of fishing attempts or malicious activity to the domain block list in the wider community because it's obviously that's how we get stronger as a community is that we all help each other stay safe on chain which is the main thing and then yeah I guess that concludes our presentation um we're definitely up questions if from the floor if anyone has them.

Yeah, thank you guys so much.

Yeah, thank you for the presentation. That was great. Um I've got a couple of questions that are here um that I'm going to just go ahead and ask. Um first one for Serena on your section. Um I noticed that you had a section about how goo you can use Google Fi um to protect from SIM swaps.

How exactly does that uh protect you versus using like a different like cell phone carrier?

Yeah. So um obviously SIMJing is uh pretty common for for people in the United States. Google Fi is tied your Google number is tied to your Google account. So any kind of SIM any any service changes like SIM swaps will require you to log into that account. So that's why it's probably the best um kind of form of I guess protection against SIM swaps.

Obviously, I do recognize this is an international forum and in general, this is something that is more prevalent amongst um US-based users. Yeah, that's that's essentially why you can also um for example, lovely you can do with Google Files, you have a number lock feature as well. So, um when you do enable it, it kind of prevents any transfer of your phone number to a new device or carrier. So, even if someone contacts support saying whatever the support for your carrier is saying, hi, I've lost my phone, you know, etc., etc.

, it will then block that from happening until uh you yourself kind of verify that it's you for example. So yeah um and you can turn that on uh via your phone settings uh privacy and security and then number lock when you uh navigate to fi.google.com. So yes, that that's why I'd recommend it.

Uh obviously it's not not a personal not a Coinbase recommendation, but I think it's a good idea for definitely US-based users where where SIM swaps are quite quite common. Thank you. What's it's really funny because I I gave a presentation at a conference in 2018 about SIM swaps and how to protect yourself from them and it's crazy that's still an issue um that's not solved um by all carriers. Um uh here's another one uh for you Serena. Uh what tools do you recommend for simulating transactions?

Like as an end user, what can they use?

I can also help out with this one too. I think with uh simulating transactions, you can obviously use things like Tenderly. I mean, none of this is like, you know, Coinbase stamp of approval here. This is just like Heidi's personal thoughts. Um, you can use things like Tenderly.

Um, there are lots of different uh tools similar to Tenderly out there. Um, there are also free tools as well that I know have been developed by uh the Security Alliance as well um that you might want to use for transaction simulation. Um I know that um some wallets are actually trying to work to better kind of like parse out exactly what's do what's going on in a transaction um uh to better alert a user of anything sketchy kind of happening. Um one thing I want to call out also too is factchecking your transaction. So don't just simulate but also fact check whether or not the hashes are matching up etc.

So it could be as simple as something like that. Like literally when you're signing a transaction, make sure that what you see on your screen actually matches like what you're, you know, seeing in your ledger. It could be as dumb as that. Um, so yeah, hopefully that helps.

That's wonderful. Thank you.

Yeah. Um, let's see. Let's do another Oh, yes. Go ahead.

That's that's absolutely fine. Thanks.

Okay. Um, let's see. Let's do another one. Um, how are uh fishing attacks evolving as more users are moving to like mobile first wallets um and hardware devices instead of you know their desktop computers?

Yeah. So, uh this one's a kind of crazy question because we mainly for this presentation wanted to concentrate on like the very high ticket value compromises that we've seen in the past year to really alert devs, right? But what we didn't really cover was things like wallet drainers or what I was talking about as an aside like info steelers too. There's also other benign fishing techniques that I expect to see a lot more of besides just your general wrote impersonation like exercises, right? Um of uh variations of address poisoning.

Um and I really want to call that address poisoning because this stuff evolves so fast. And I actually I got I I cheated a little bit here and had these in the the appendix because I thought we might want to cover stuff like this. But what exactly is address poisoning? Address poisoning is where an attacker will pretend to um make it look like you either sent or received from an address that you've previously interacted with, right? Yet that address it might match like the the first couple of characters of that address might match the last couple of characters, right?

But in reality, that address is literally just a um a spoof address, right? It's not actually the one that you indeed to send to. Um and this is accomplished by a lot of different tools that exist out there. Uh you can read up on those on those in your free time. Um but vanity addresses are pretty popular, right?

It's very easy to actually create one of these addresses if you have enough computing power. Um but as you can see here in this transaction or sorry this um screenshot of this wallet that where transactions like we started seeing this by the way a lot in the end of 2022 this like uh address poisoning uh this address poisoning sort of uh start to rise up. Um where you see here uh on the third row you see a send that happens January 18th to the 0x5 ECF address and you see that one USDC was sent right. Um, I'm guessing transaction fees are really high cuz why was 573 actually sent in the end? But like that's a whole separate question for another day.

Um, but if you see then right above it, you see another send happening. But you see the USDC value is zero, right? Yet 287 was sent. What in the world happened here? Right?

That was probably the Gatsby, right? This was a address poisoner who made it seem like the user was indeed transferring the actual real USDC. um uh from the like victim's quote unquote address to their destination address when in reality that destination address was a spoof address. Now, Block Explorers, people such as ourselves, we wised up to this pretty fast, right? And we were like, "Oh, this is really easy.

They're transferring zero USDC. We know how to like get rid of this. Like, we just, you know, filter out these spam transactions." No, these guys then escalated. They were like, "No, you know what?

I'm going to actually just launch a fake USDC and see if I can get around that because like all of these different wallets that exist out there, they're not going to be able to handle all of our inundations, right? And sure enough, we can see that here this this happened with the Oiler exploiter. This was like a little bit later in 2023, like what was maybe March or April. Like you can see these this legit transaction of die being sent, but then the spoofer literally like a block or two later sends out a very similar transaction literally mimicking it, right? And it looks like indeed the oiler exploiter indeed sent that 10 million some odd die to that spoof address.

The hope is is that you're accidentally going to copy paste that spoof address. Right? That's the whole deal with this thing. And the problem is is that people actually do just copy paste. And so that's why it's really useful to have things like address lists where you can actually save, you know, an address you've previously sent to without falling victim.

Um it's nice because uh tools like Ether Scan, Soul Scan as well, they're starting to filter out this noise. Um but we're going to continue seeing new iterations of this. We're already seeing uh iterations um of of similar activity um using things like um base names too to impersonate, right? It's just this is basically like the onchain version of impersonations. Um so yeah, hopefully like that that that's like a long-winded, you know, answer to your question.

I'm sorry, Eli, but like this is an area that I think, you know, people kind of need to wise up to a little bit as well that we're always seeing new developments here.

Yeah. And another interesting thing that I notice on a lot of these spoofing addresses, uh, the way that Ethereum addresses are formatted, um, there's a code in how they capitalize or lowercase the letters. So that's another thing that can like really even if you you notice like, oh, sometimes the E is capitalized and it's not capitalized. If you see that, that's a red flag. Um,

yeah, but it kind of goes back to the issue of like userdev blind faith, right? Because like this is something that you need to be really aware of. And I I'll be honest with you guys, like when I was testing like when I was trying to explain this to some people, I was like, you know what, you're not fully understanding this. Let me actually generate up a vanity address to prove to you what the problem is here. And the problem is is people fall for it.

even people knowing of this scam will fall for it by accident because they're not aware of like oh it's capitalized here it's not. The other thing too with uh the various tools that I was talking about it's it you just have to change a couple of parameters to make sure that you get the proper uh capitalization. You just had to hash through a little bit more. So yeah.

Yeah. Such an interesting type of tech and thanks for like adding this appendix just it's like you knew I was going to ask a question about it. Um and I think that we hit time. So thank you both so much for uh doing this presentation uh through the security session for us. Um I think we just leave the call now.

So um thank you also everyone for joining and watching this afterwards. Um yeah, have a great one.

Thanks so much. Thanks guys.

Thank you.