Solana Investors Lose $500K in X Phishing Attack
A threat actor has stolen an estimated $500,000 by targeting Solana meme coin investors and popular X pages. The hack attacked 15 accounts, including those of Brett, Kick Streaming, and Alex Bania, through phishing emails disguised as official communications from the X team. According to a post by blockchain investigator ZachXBT, the attacker tricked users by sending fake copyright infringement notices that created a sense of urgency, prompting victims to visit phishing sites. Once on these fraudulent pages, users were deceived into resetting their passwords and two-factor authentication (2FA) details, allowing the hacker to steal their credentials. 1/3 A threat actor has stolen ~$500K over the past month by compromising 15+ X accounts (Kick, Cursor, Alex Blania, The Arena, Brett, etc) from sending targeted phishing emails which impersonated the X team to steal credentials and then launch meme coin scams. pic.twitter.com/HEWQdVICgJ— ZachXBT (@zachxbt) December 24, 2024Solana Users Targeted After gaining control of the account, the hacker would use the compromised page to promote a new coin, often sharing a contract address and encouraging followers to invest their Solana (SOL). This tactic lured unsuspecting victims into transferring funds, believing they were investing in a legitimate project. All the account takeovers (ATO) were traced back to a single deployer address, which was used to execute each of the scams. The attacker tried to obscure the origin of the funds by shifting assets between the Solana and Ethereum networks. Recently, hackers have increasingly targeted X due to its widespread use by projects to promote themselves to users and investors. X user @loo_here joined the discussion and responded to ZachXBT’s thread on the situation. “That X phishing email is downright nasty. So many people [are] dependent on X for their projects I’m sure they just panic and click without thinking,” @loo_here wrote. That X phishing email is downright nasty. So many people dependent on X for their projects I’m sure they just panic and click without thinking…. Thanks for bringing attention to this.Would be worth @X adding a code only known to the account holder to show that their emails…— loo (@loo_here) December 24, 2024The user also suggested that X could improve security by adding a code known only to the account holder to verify the legitimacy of emails or implementing other preventive countermeasures. ZachXBT urged users to avoid reusing email addresses across different services and recommended implementing security keys for 2FA on critical accounts to enhance protection. Cybercriminals Target High-Profile Figures and Brands In early December, the official X account of the Cardano Foundation was hacked, leading to the spread of misleading claims about a fake U.S. Securities and Exchange Commission (SEC) lawsuit and the promotion of a fraudulent SOL-related token. The spread of false information created confusion within the Cardano community and led to a 4% decline in the price of ADA, which fell to $1.18. In November, a former professional Fortnite player known as Serpent was accused of stealing $3.5 million through meme coin scams that targeted several high-profile brands and artists. Wallet addresses connected to Serpent played a major role in several pump-and-dump schemes tied to meme coins launched on the Pump.fun platform. Read More Meme Coin Mania: 76% of Twitter Influencers Promote Worthless Tokens, Study Finds Pudgy Penguins Targeted in Google Ads Phishing Scam on Web3 Users French Crypto Scams Surge as Regulators Crack Down on Fraud Networks Michaela has no crypto positions and does not hold any crypto assets. This article is provided for informational purposes only and should not be construed as financial advice. The Shib Magazine and The Shib Daily are the official media and publications of the Shiba Inu cryptocurrency project. Readers are encouraged to conduct their own research and consult with a qualified financial adviser before making any investment decisions. Post Views: 109