Crypto Firms Hit by Newsletter Breach Attack, Mailing Lists Leaked

Crypto users are being warned to be careful with email newsletters in the coming days.

AccessTimeIconJun 5, 2024 at 11:25 a.m. UTC
Updated Jun 5, 2024 at 11:33 a.m. UTC
  • The attack targeted newsletter vendors and was reported by several crypto companies.
  • Users were warned to be vigilant against malicious phishing links.
  • It is currently unclear how much, if anything, has been stolen.
  • Over $67M in Crypto Lost to Hacks and Exploits in February: Immunefi Report
    00:56
    Over $67M in Crypto Lost to Hacks and Exploits in February: Immunefi Report
  • Running With Crypto: 5 Questions With TRM Labs' Ari Redbord
    00:59
    Running With Crypto: 5 Questions With TRM Labs' Ari Redbord
  • Hacks Involving North Korea Are 'Even Greater Problem': Legal Experts
    09:43
    Hacks Involving North Korea Are 'Even Greater Problem': Legal Experts
  • Breaking Down the State of Hacking in 2024
    02:01
    Breaking Down the State of Hacking in 2024
  • Several cryptocurrency businesses are reporting that there is an ongoing “supply chain email breach attack” that uses newsletter mailing lists to send malicious phishing links to users.

    The breach targeted an unnamed vendor that manages mailing lists for crypto companies. Bitfinex CTO Paolo Ardoino and CoinGecko founder Bobby Ong have confirmed that a breach has taken place.

    “There is an ongoing supply chain email breach attack happening with an email newsletter vendor right now,” Ong said. “Several crypto companies may be affected via email blasts of fake token launches. Be careful with email newsletters in the coming days.”

    "We have received two independent confirmations that a prominent vendor used by crypto companies to manage mailing lists might have been compromised. "Please beware of any emails suggesting crypto-airdrops received more than 24 hours ago," Ardoino. added.

    Phishing is a technique used by hackers to lure a victim into clicking on a malicious link. That link will either drain that user’s personal information, like login data, or it can link directly to an online crypto wallet, giving the attacker access to the user’s wallet.

    The amount, if any, that has been stolen from phishing links in connection with this breach is currently unclear.

    Edited by Parikshit Mishra.

    Disclosure

    Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

    CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

    Oliver Knight

    Oliver Knight is a CoinDesk reporter based between London and Lisbon. He does not own any crypto.


    Read more about