Cisco: Bitcoin Phishing Scam Bagged $50 Million Over 3 Years

Cisco has released new information about a bitcoin phishing scam that involves websites masquerading as Blockchain.info.

AccessTimeIconFeb 15, 2018 at 7:00 a.m. UTC
Updated Sep 13, 2021 at 7:34 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Security researchers at Cisco have released new information about a bitcoin phishing scam that involves websites masquerading as Blockchain.info, the popular online wallet service.

In a blog post published Wednesday, Dave Maynor and Jeremiah O'Connor detailed the Coinhoarder phishing scam, which they said Cisco has been investigating in the past six months in partnership with the Ukrainian Cyberpolice. All in all, they said that those behind the scam had netted $50 million in cryptocurrency over a three-year period.

"The campaign was very simple and after initial setup the attackers needed only to continue purchasing Google AdWords to ensure a steady stream of victims," they wrote. "This campaign targeted specific geographic regions and allowed the attackers to amass millions in revenue through the theft of cryptocurrency from victims. This campaign demonstrates just how lucrative these sorts of malicious attacks can be for cybercriminals."

As shown in the blog, those behind the attack would create websites similar to Blockchain but with different domain names – "block-clain.info" and "blockchien.info" among them – that the casual user may not notice. They then "leveraged Google Adwords to poison user search results in order to steal users' wallets," thereby directing more traffic to those pages.

Cisco traced the group's activity back to as early as 2015 and estimated that "tens of millions of dollars" in cryptocurrency had been stolen since that year. They indicated that as much as $50 million had been stolen, including $2 million in less than 4 weeks during one period last year.

"What is clear from the COINHOARDER campaign is that cryptocurrency phishing via Google Adwords is a lucrative attack on users worldwide," the firm concluded.

Image via Shutterstock

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.