Attacker Targets Wealthy Crypto Funds Using Telegram Chats

Exchange owners cautioned against downloads of malicious as attackers zeroed in on gullible users with a very relevant and specific narrative.

AccessTimeIconDec 7, 2022 at 1:07 p.m. UTC
Updated May 9, 2023 at 4:04 a.m. UTC

In the latest type of crypto-focused attacks, an attacker known as DEV-0139 has targeted wealthy cryptocurrency funds through the use of Telegram group chats, Microsoft's (MSFT) Security Intelligence team said in a report on Wednesday.

Fees levied by crypto exchanges on transactions are a big challenge for investment funds and wealthy traders. They represent a cost and must be optimized to minimize the impact on margins and profits. As is the case with many other companies in this industry, the largest costs come from fees charged by exchanges.

The attacker or group of attackers capitalized on this specific problem to lure their crypto-fund targets.

DEV-0139 joined several Telegram groups, used by high-profile clients and exchanges for communication, and identified their target from among the group members. OKX, Huobi and Binance exchanges were targeted, data from the Microsoft report shows.

Posing as an exchange employee, DEV-0139 invited the target to a different chat group and pretended to ask for feedback on the fee structures used by exchanges. They then initiated a conversation to gain the target’s trust – using their knowledge of the industry and preparedness to lure victims gradually.

DEV-0139 then sent a weaponized Excel file containing accurate data on fee structures among cryptocurrency-exchange companies with the goal of increasing his or her credibility.

The Excel file initiated a series of activities, including using a malicious program to retrieve data and drop another Excel sheet. This sheet was then executed in invisible mode and used to download a picture file containing three executables: a legitimate Windows file, a malicious version of a DLL file and an XOR-encoded back door.

A DLL is a library that contains code and data that can be used by more than one program at the same time. On the other hand, XOR is an encryption method used to encrypt data and is hard to crack by the brute-force method

The threat actor was then able to remotely access the infected system through the use of the back door.

Microsoft said DEV-0139 may have also run other campaigns using similar techniques.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.