Week 33: Crypto wallet phishing by post
The NCSC receives several reports of letters containing a QR code and instructing recipients to download an urgent update for their crypto wallets. However, scanning the QR code takes you to a phishing website where you are asked to enter your seed phrase. Anyone who discloses this phrase gives the attackers full control of their crypto wallet.
Scammers usually take advantage of what the internet offers them: they can cover their tracks, conceal their identities and send emails at virtually no cost. Nevertheless, the NCSC regularly receives reports of scams involving physical letters being delivered to potential victims' letterboxes. Since sending such letters requires considerably more effort, scammers tend to use this method for schemes that offer particularly high potential returns. The current campaign specifically targets crypto wallet users.
Security update by post
In this case, the scammers are sending letters in the name of various crypto wallet providers, claiming that a critical security update is required because of the introduction of what they call ‘quantum resistance’. The letters instruct people to scan the QR code provided in order to begin the supposedly necessary update process.
One striking feature of the letter is that the deadline is more than two weeks away. This is unusual for a scam, as scammers usually create a false sense of urgency to pressure their victims into acting hastily. However, this generous deadline is also likely to be part of the deception. It makes the letter appear more legitimate and trustworthy, which may help to dispel any doubts. Because there is no immediate pressure to act, the letter seems more credible at first.
If the victim scans the QR code, they are taken to a professionally designed website with several different parts. The domain has nothing to do with the actual provider; however, most of the links actually do lead to the legitimate website of the relevant crypto wallet provider. This further reinforces the impression that the site is genuine.
If you click on the section mentioned in the letter for the supposed ‘quantum resistance’ update, you are taken to a website controlled by the scammers.
On the fake website, you are then asked to enter your seed phrase to activate the security update. Anyone who does so gives the scammers full control of their crypto wallet and the assets it contains.
Beyond the letterbox: Crypto phishing across all channels
The current scam involving physical letters and QR codes is a striking example of just how creative and targeted cybercriminals can be in their attempts to steal crypto assets. But the threat on conventional digital channels remains.
The scammers' goal is almost always the same: to steal people's seed phrases, also known as recovery phrases or recovery word sequences. Anyone who has access to these 12 or 24 words has full control of the crypto wallet and can irreversibly transfer the funds.
Attack vectors
Email phishing
Scammers send highly convincing emails in the name of well-known crypto platforms such as Binance, Kraken, Coinbase or MetaMask, or hardware wallet manufacturers such as Ledger or Trezor. Claiming that there is a security vulnerability, that an account has been blocked or that the recipient is eligible for a lucrative ‘airdrop’, they lure their victims to a scam website. There, victims are asked to enter their seed phrase, supposedly to resolve the issue.
Vishing (voice phishing, or scams by phone)
Scammers are also increasingly contacting potential victims by phone. Using spoofing to manipulate the number shown on the caller ID, they make it appear that the call is coming from official support. The callers then create an intense sense of urgency by claiming, for example, “Your account is being hacked right now. We need to secure your funds immediately.” They pressure their victims into either reading out their seed phrase over the phone, or entering it on a particular website.
Recommendations
- Never disclose your seed phrase. No legitimate support representative, crypto exchange, wallet manufacturer or authority will ever ask you for it.
- Cybercriminals deliberately exploit people's fear of losing money. If someone pressures you by phone or email, stop engaging with them immediately.
- Do not click on links. Enter your crypto platform's URL directly into your browser instead.
- Keep your seed phrase strictly offline.
- If you suffer financial loss, the NCSC recommends reporting it to the police. You can find your nearest police station on the Suisse ePolice website (available in German, French and Italian).
Current statistics
Last week's reports by category: