Categories
Crypto News Crypto Wallets Hackers Trezor

Trezor Suffers Newsletter Phishing Attack via MailChimp Exploit

Crypto hardware wallet company Trezor has confirmed that some of its users were the target of a phishing attack over the weekend. Trezor tweeted that it was investigating “a potential data breach of an opt-in newsletter hosted on MailChimp” and warned users to avoid opening emails from “[email protected]”.

“We will not be communicating by newsletter until the situation is resolved,” Trezor advised in a later post. “Do not open any emails appearing to come from Trezor until further notice. Please ensure you are using anonymous email addresses for bitcoin-related activity.”

Fake Security Breach Used as Bait

Trezor users shared warnings and screenshots of the phishing attempt from April 2, some noting it was a bare-faced ruse to induce users to download malicious code under the guise of Trezor’s Suite desktop app by alleging a fake security breach at the company:

A Trezor Good News Story

In a rare good news story associated with a similar incident in January, a hacker using the handle ‘Kingpin’ was able to bail out a user who’d forgotten the PIN to his Trezor One hardware wallet.

Kingpin later posted a video demonstrating how he managed to retrieve the user’s PIN:

Categories
Crypto Exchange Crypto Hardware Wallets Crypto News Crypto Wallets Cryptocurrency Law Europe Regulation

EU Parliament Votes in Favour of KYC for Private Crypto Wallets

European Union lawmakers have voted in favour of controversial proposals that require exchanges to collect personal data from individuals who transact more than EUR 1,000 using unhosted wallets.

Bad News for Exchanges

The proposals were passed, albeit narrowly, and purport to effectively prohibit anonymous crypto transactions:

The underlying justification behind the proposals is that they intend to extend anti-money laundering (AML) requirements that apply to conventional payments over EUR 1,000 to the crypto sector. As Coinbase CEO Brian Armstrong noted, however, the burden imposed on exchanges would be extremely onerous:

Most of the pushback from industry is because non-custodial wallets aren’t necessarily customers, with commentators describing the measures as “anti-innovation and anti-privacy”.

Referring to Chainalysis data showing that less than 0.05 percent of crypto volume was related to crime, hardware wallet provider Ledger argued that the proposals were neither necessary nor proportionate. It further noted that they reduced financial freedom, consumer protection and financial inclusion, and put Europe at a competitive disadvantage relative to other jurisdictions.

Image
Proposals’ unintended consequences. Source: Ledger

While some noted that users would simply resort to decentralised exchanges or send EUR 999 at a time, others had a more humorous perspective:

Turning Up the Regulatory Heat

This year has already shown that European lawmakers are increasingly scrutinising the digital asset sector. A few weeks ago, the EU Parliament finally decided not to ban proof-of-work cryptocurrencies (effectively Bitcoin), after going back and forth on the matter.

The next battle is clearly over unhosted wallets and for now it appears as if the regulators are in the driving seat. Importantly, the laws have not been enacted and still need to go through tripartite meetings between the EU Parliament, European Commission, and European Council.

Despite expectations that little will derail the proposals in question, if there is one thing we know about the crypto sector it’s that it will never go down without a fight.

Categories
Blockchain Crypto News Crypto Wallets Gaming Metaverse Opera

Opera Browser Adds BTC, SOL and MATIC Wallets for its 350 Million Users

Popular web browser Opera has this week announced support for at least eight more base networks and various layer-2 protocols in what seems to be a push for a major Web3 browsing experience.

As per a blog post from the Oslo-based company, Opera plans to onboard millions of users to enjoy a “seamless Web3 experience” through built-in wallet support for leading blockchain ecosystems and layer-2s including Bitcoin, Ethereum, Solana, Polygon (MATIC), Cosmos-based IXO, Ronin, Celo, and StarkEx:

Seamless Access to Web3

Opera users will be able to access dApps (decentralised applications) from popular ecosystems such as Polygon or Solana and benefit from lower gas fees and faster transactions.

By connecting several layer-1 and layer-2 ecosystems, Opera will remain “chain agnostic” – allowing its 300+ million users to seamlessly access Web3. Users from the popular P2E (Play-to-Earn) title Axie Infinity will also be able to interact with the recently hacked Ronin ecosystem.

The integration of multiple blockchains and notably Layer 2s is a key strategy in Opera’s mission to remain chain agnostic and seamlessly onboard millions of users to Web3 and do so in an environmentally-conscious way.

Opera blog post

Opera Sings Praises of its Browser

Opera has been working on crypto-related products since 2018 when it launched its first web browser with an integrated Ethereum wallet and Web3 support, even before most browsers started integrating different levels of support for blockchains.

It wasn’t until January of this year that Opera unveiled the beta version of its Crypto Browser Project, a fully dedicated Web3 browser with built-in integrations and support for seamless access to dApps, games, and metaverse platforms.

Ever since we started in the Web3 space in 2018, we’ve been sealing partnerships with the most popular and cutting-edge blockchains and Web3 domain name providers in order to accelerate crypto’s evolution from proof-of-concept towards mass adoption.

Jorgen Arnesen, EVP Mobile and Web3, Opera

On February 25, Opera integrated DeversiFi, a decentralised exchange powered by StarkWare, a scaling solution for Ethereum that uses ZK rollup technology.

Categories
Crime Crypto Wallets Hackers Scams

Cybersecurity Uncovers 13 Malicious Wallets that Could Steal Your Crypto

A criminal plot to steal users’ digital assets via apps impersonating popular cryptocurrency wallets has been uncovered in new research by global cybersecurity firm ESET.

ESET believes it’s likely that a single criminal group is behind the coordinated scheme to steal users’ crypto funds – via more than 40 copycat websites of popular crypto wallets used to promote downloads of malicious apps.

While the malicious apps were not available on Apple’s App Store (instead requiring download and installation using a configuration profile), 13 apps impersonating the Jaxx Liberty wallet were found on the Google Play store and have subsequently been removed by Google.

Counterfeit Wallets Target Chinese Users

Primarily targeting Chinese users, across both Android and iOS devices, the malicious apps closely mimicked the appearance and functionality of legitimate wallets including MetaMask, Coinbase and Trust Wallet.  

ESET researcher Lukáš Štefanko said the malicious code used in the Trojan wallets enables users’ funds to be stolen and opened users to other risks:

These malicious apps also represent another threat to victims, as some of them send secret victim seed phrases to the attackers’ server using an unsecured HTTP connection. This means that victims’ funds could be stolen not only by the operator of this scheme, but also by a different attacker eavesdropping on the same network.

Lukáš Štefanko, ESET researcher

Beware Before You Download

ESET found the Trojan apps and fake websites were sophisticated, and also promoted using ads on legitimate sites and via groups on Telegram and Facebook.

The firm said the source code of the threat it uncovered has now been leaked online, which could encourage and enable other criminals to spread the threat even further. 

In light of the findings, Keystone Wallet tweeted a warning to its users to be wary of what they download:

Fake wallet scams are a key risk for crypto investors. Last year it was revealed that over US$500,000 had been lost due to Google Ads directing users to fake wallets, while Apple was served a US$5 million lawsuit over a phishing app disguised as a wallet that was available in the tech giant’s App Store.

Categories
Banking Coinbase Crypto News Crypto Wallets Ethereum Gas MetaMask Payments Stablecoins

MetaMask iOS Update Allows Users to Buy Crypto Using a Credit Card

MetaMask now allows iPhone and Apple Pay users to buy crypto using a debit or credit card through its mobile application, eliminating the need to transfer Ethereum from a centralised exchange such as Coinbase into the app.

And in response to popular demand, MetaMask has also introduced the Apple Dark Mode feature, which will automatically open in the app as long as a user’s iPhone operating system has dark mode enabled.

Daily Deposit Limit of 400 USD

Users can now deploy their Visas and Mastercards stored in Apple Pay to buy ETH and deposit a daily maximum of US$400 into their wallets, thanks to the Wyre API (MetaMask uses two payment gateways, Wyre and Transak, to support debit card and credit card transactions).

Gas fees are also said to be lower, and some transactions may even be gasless if done on a private blockchain or if a project pays for the gas on the user’s behalf. (When completing an ETH purchase, MetaMask discloses that it does not profit from gas fees.)

Buy Stablecoins and Make Bank Transfers in 60+ Currencies

Via Transak, users have been able to buy stablecoins such as USDT, USDC and DAI on the Ethereum mainnet in MetaMask for some time now, but the latest update also allows them to make bank transfers and use credit/debit cards to buy crypto using more than 60 global currencies.

Exact payment methods and fees vary depending on the location. Earlier this month, OpenSea and Metamask blocked users from countries including Iran and Venezuela after both platforms cited compliance issues. It was later confirmed that Ethereum’s Infura cut off users to separatist areas in Ukraine, accidentally blocking Venezuelan users as well.

Just this week, the EU Parliament announced its intention to extend checks to cover privately managed unhosted wallets, including MetaMask, despite fears that such rules could prove unenforceable.

Categories
Crypto News Crypto Wallets Privacy

EU Set to Vote on Prohibiting Transactions to Unhosted Wallets

The global crypto community is up in arms over proposed new European Union rules that would sanction the invasion of personal privacy and treat new technologies less fairly than cash or traditional bank transfers.

The EU Parliament seeks to extend checks to cover privately managed unhosted wallets that store crypto, despite fears that such rules could prove unenforceable:

Examples of an unhosted, or non-custodial, wallet include MetaMask, WalletConnect, or hardware wallets such as Ledger and Trezor. 

“Money going to unhosted wallets may end up in the wrong place, for example with terrorist groups,” according to Paul Tang, one of the members of the European Parliament on the Economic Affairs Committee that will vote on the matter later this week.

Data Collection an Impossible Task

Tang, a Dutch socialist, tweeted earlier this week that wallet owners would need to be identified in the same manner as bank customers are. The draft regulation would require crypto service providers not only to collect personal data related to transfers made to and from unhosted wallets (as they are already obliged to do) but also to “verify the accuracy of information with respect to the originator or beneficiary behind the unhosted wallet”. Such verification would prove problematic, if not impossible, say those service providers.

‘Travel Rule’ Another Data Harvesting Scheme in Disguise

The likes of Coinbase are already objecting to the EU’s so-called travel rule, which proposes to extend anti-money-laundering identity checks to payments made in digital currencies, even if they fall under an existing threshold of 1,000 euros (US$1,098).

“The travel rule … is really a massive and indiscriminate personal data collection and transfer scheme,” said Mikołaj Barczentewicz, associate professor at the University of Surrey in the UK and Fellow of Stanford Law School (US).

Proponents of the new rules, Barczentewicz added, are “saying that it is necessary for all crypto service providers to report sensitive data of their clients, even when there is not even the slightest suspicion of a criminal connection”.

Even if the 1,000 euro threshold were maintained, he said, such a privacy restriction would “very likely not be as effective as less rights-restricting alternatives” because those with nefarious aims could simply circumvent them.

What we seem to be dealing with here is an attempt to do ‘something about crypto and crime’ without a serious, evidence-based reflection on how best to do it.

Mikołaj Barczentewicz, associate professor, University of Surrey (UK), and Fellow of Stanford Law School (US)

In more encouraging news earlier this month, the EU Parliament voted against a proof-of-work ban, allowing BTC holders at least to breathe a collective sigh of relief.

Categories
Bitcoin Crime Crypto Wallets

BTC Mixer ‘CoinJoin’ Starts Blacklisting BTC Linked to Illegal Activity

The CoinJoin coordinator that facilitates the coin mixing functionality built into the privacy-focused Wasabi Wallet has started blacklisting accounts linked to criminal activity, in a move seen by many in the crypto industry as a blow to user privacy:

Essentially this means that Bitcoin addresses that have been linked to criminal activity in the past will be prevented from using the CoinJoin functionality offered by Wasabi Wallet.

Blacklists to Prevent Legal Trouble

According to blockchain analytics firm Elliptic, Wasabi Wallet’s CoinJoin functionality has likely been used numerous times in high profile thefts and scams to evade authorities. 

Apparently this illicit usage has concerned Wasabi Wallet’s parent company zkSNACKS. According to a series of tweets from one of its developers, the decision to implement blacklists on their CoinJoin coordinator is a bid to avoid legal and regulatory trouble:

In response to the move, Bitcoin users have aired concerns that it may impact their privacy and result in a slippery slope where legitimate use ends up being targeted by authorities:

Across the broader crypto market, privacy protocols have seen a growth in popularity recently, with the Ethereum-based mixer Tornado Cash surging 94 percent following recent updates.

What is CoinJoin?

CoinJoin is an open-source mixing protocol for the Bitcoin blockchain which allows users to perform anonymous transactions known as CoinJoins. 

CoinJoins create anonymity by obscuring the source and destination addresses used in the transaction – this process is also known more generically as coin mixing. CoinJoin coordinators play a vital role in finding users to participate in transaction pools and ensure anonymity.

CoinJoin Available on Alternative Services

Users do not need to use Wasabi Wallet to perform a CoinJoin transaction. While it is one of the most popular providers of the functionality, numerous other wallets and dedicated mixing services also offer automated CoinJoin functionality. 

Users can manually perform a CoinJoin, though this is difficult and requires advanced technical knowledge.

Categories
Airdrop Blockchain Cosmos Crypto Wallets DeFi

Users Left Fuming After Evmos’ Cosmos Cross Chain Fails to Launch

Evmos, a layer-1 blockchain compatible with EVM (Ethereum Virtual Machine) built on Cosmos, is facing a community backlash after the protocol failed to launch this week due to numerous bugs found on the network.

The launch of the Evmos mainnet, which came with a rather ambitious token airdrop, was highly anticipated by the Cosmos and Ethereum communities as it allowed cross-chain transfer between the two blockchains.

Critical Security Bug Halts Network

But it seems the launch was riddled with gremlins. Two days before the launch, a “critical security bug” was found on the network, which rushed validators to implement a fix improperly and subsequently caused a network halt:

Users were reporting problems related to hardware and software wallet integrations, which were apparently higher than the network was able to handle. On top of this, some users were claiming a “lack of organisation” and numerous delays surrounding the launch of the mainnet:

The team behind Evmos said developers and validators were reportedly still working on the matter and unable to reach a consensus on the next steps for the protocol.

Launch Suspended Till Further Notice

The backlash forced the Evmos team to suspend the launch for an undetermined number of days to address the community’s concerns, and that the network would be reviewed internally via a postmortem:

Evmos Responds to Backlash

While the community backlash was rather harsh for Evmos, some other users were supportive of the response from the Evmos team to handle the issues and give clarity to its community.

Some other DeFi projects are the opposite, however. Such was the case in January with the cross-chain bridge Multichain when it lost over US$3 million through a security hack. The protocol was sending “mixed messages”, stating the issue had been fixed, but it later reminded users to revoke approvals of the token.

Categories
Crypto News Crypto Wallets Cryptocurrencies Russia

Ukraine Government Raises Over $37 Million in Crypto After Public Appeal

Since the start of Russia’s military invasion of Ukraine on February 24, over US$37 million in Bitcoin and other cryptocurrencies has been donated to the Ukrainian government and Ukraine-based non-governmental organisations (NGOs).

This figure is rising rapidly as donations continue to pour in from crypto users around the globe.

Ukraine has been fairly progressive in its approach to crypto, having officially legalised Bitcoin and other digital assets in 2021.

The official Twitter account of the Ukrainian government issued a request for crypto donations on February 27, including to its official Bitcoin, Ethereum and USDT (ERC-20) addresses. 

Initially there was some scepticism about the legitimacy of the request, with Ethereum founder Vitalik Buterin tweeting a warning – but it was later confirmed the addresses were under the direct control of the Ukrainian government. 

Analytics Show Most Donations Direct to Government

According to crypto analytics firm Elliptic, of the current donations, US$10.6 million has gone directly to the Ukrainian government from 13,670 individual transactions – including the donation of one NFT worth US$1.86 million, which was originally intended to raise funds for imprisoned Wikileaks founder Julian Assange.

The remainder of the donations have gone to NGOs, most notably Come Back Alive, which has received over US$6.5 million in Bitcoin and has come to rely more heavily on crypto donations following the suspension of its Patreon account due to funding military activity.

Crypto Shines During Conflict, Both Sides Could Benefit

Many in the community have noted the advantages crypto provides over more traditional payment systems during times of crisis. While Russia looks like it may be entirely cut off from the SWIFT network and Patreon suspends the accounts of NGOs, crypto donations continue to flow unabated:

Of course, crypto’s decentralised nature allows for funds to flow freely to both sides of the conflict and there’s still significant doubt and concern about how crypto might influence the course of this, and future, military conflicts.

Categories
Blockchain Crypto News Crypto Wallets Ethereum

Opera Web Browser Launches ETH Layer 2 Web Wallet Powered by Starkware

StarkWare has launched the latest version of its Ethereum Layer 2 scaling solution StarkNet and announced it is now fully ready for building decentralised apps (dApps).

The company tweeted that Opera will be integrating the DeversiFi exchange, powered by StarkWare, into its browser as a built-in wallet to offer users faster, easier and cheaper ETH P2P transactions:

Ethereum’s high gas fees and slow transaction times have made room for other blockchains to try to solve these inefficiencies. Other Layer 1 blockchains such as Solana have been somewhat successful in doing this, but there are still security issues to be worked out. StarkNet, as a Layer 2 solution, could be the answer to these problems.

Introducing ZK Rollups

StarkNet uses zero-knowledge (ZK) rollup technology to solve the scaling problems plaguing the Ethereum network. ZK rollups offer a low-cost solution for transacting on Ethereum, compacting hundreds of transactions into one, off-chain, thereby reducing the amount of transactions written to the blockchain. This significantly reduces gas fees and makes it much cheaper to use.

At present, StarkNet’s speed is similar to Ethereum’s 7 TPS, but the plan is to reach 70 to 700 TPS as StarkNet is scaled out over the next few months.

With the growing popularity of DeFi and NFTs in the crypto space, scaling solutions for the Ethereum blockchain have been in high demand, and the race is on for who can best serve the industry. Argent X is a Layer 2 solution also built on StarkNet, and there are many others. Crypto News Australia has made a list of the best 10+ Ethereum Layer 2 projects and sidechains for you to learn more about.