Metaverse scams abound, asset security remains a top priority

"People are being scammed every day." In the official communication group of a certain metaverse game project, the administrator has to post anti-fraud warnings dozens of times every day: "The administrator will not message you privately, so don't click on the private message link."

Not long ago, the well-known security auditing organization SlowMist published an article warning that fake wallet apps have caused tens of thousands of people to be stolen, with losses as high as US$1.3 billion.

As the Metaverse becomes increasingly popular, people from all walks of life who want to experience Metaverse games, web3 products, and want to seize the opportunity to "dig for gold" are flocking in. In addition, some platforms have announced that the day of liquidation has arrived, and many people are forced to start using wallets.

However, for many people who have not operated crypto assets, new things mean a lot of unfamiliar operations like "blind men touching an elephant", which also makes some "special groups" smell the atmosphere of "Chinese New Year" ...

Friends who have played blockchain games can all see a phenomenon: the official communication group administrators’ catchphrases are almost all warnings against fraud, but every day there are still people being deceived by fake “administrators”.

Taking the "fake wallet" scam in the Telegram group as an example, when users go to the official group to report some problems, there may be a group administrator (with the same nickname and avatar) to help you solve the problem , and "kindly" remind you to beware of scams and recommend downloading the "Xiaoxli" wallet.

At the same time, you have been quietly pulled into an official communication group of the "XiaoXili" wallet, where the official customer service will release links and warn users in the group not to trust private chats.

So, under the friendly reminders of the "kind" administrators and customer service, many people clicked on the link of the so-called "wallet official group" without knowing what was going on, downloaded the wallet, and imported the mnemonic phrase...

Next, the digital assets disappeared.

A victim's account of being deceived, which was circulated in a certain community

Recently, similar digital asset scams have been particularly serious, with a large number of people being scammed and a huge amount of assets. In addition to the official project team, not only some wallet teams and security teams in the industry, but also security teams outside the industry have paid attention to this phenomenon.

For example, 360 Security Brain has specially launched a "virtual wallet fraud model" to intercept the three major types of fraud. Based on the three major types of fraud prompted by 360 Security Brain, we have also made some common fraud extensions and examples.

The first type uses promotional methods such as giving away "Tokens" as bait to induce users to download and install fake wallets

The second type is to promote fake wallet applications through fake wallet websites and niche application distribution sites

As long as you search for any well-known wallet name on major search engine websites, the results you get will be shocking, because out of 10 results, 5-6 are fake wallet websites, and they are ranked higher than the real wallet official website.

Some time ago, a scammer registered the trademark of a certain brand of wallet, applied for brand protection on search engines, and listed the fake wallet's official website as the "brand's official website."

Do you think that you can be safe as long as you download from the App Store on your phone?

Of course not, scammers are waiting for you here, because the app store can also sell high-imitation fake wallets. For plug-in wallets such as Little Fox, many people have downloaded high-imitation fake plug-ins from the Chrome official store, resulting in the theft of digital assets...

In summary, the wallet must be downloaded from the official website. If you download it from the app store, be sure to check the name of the app developer and confirm that it is the app officially submitted by the wallet before downloading.

The third type: Impersonating customer service of a trading platform

Many people have received similar fraudulent calls, in which users are tricked into installing conference apps and wallets with screen sharing functions, claiming that their accounts are at risk. The calls are then used to steal the user's coins after obtaining the user's wallet mnemonics.

The fourth type: Telegram groups impersonating official customer service of the project

In the example mentioned above, customer service helped solve the problem and reminded people to prevent fraud, while also inducing them to download the wallet in a fake official wallet group.

The fifth type is to contact attractive cooperation such as "brushing orders", "stealing U", "changing U" with high returns

Usually the scammers will tell you that they will first transfer money to you, and then give you a "payment QR code" and ask you to scan it to transfer a small amount to test whether it can be received. However, when the actual wallet scans this QR code, it opens a "wallet transfer page" that is highly imitated by the scammers.

The operation performed on this page is actually an "authorization" operation. After confirming the authorization, the scammer can take away all the U in the wallet.

The above is just the tip of the iceberg, and various scams are happening every day. Most scams involving "fake wallets" have different processes, but the purpose is almost the same, which is to find ways to trick you into downloading a "fake" high-quality fake wallet.

When users create a new encrypted wallet or import private keys and mnemonics in this wallet, sensitive mnemonics and private key information will be quietly sent to the scammers, or they will try to trick you into signing and authorizing. Then, the scammers will have the right to dispose of the encrypted assets in your wallet.

According to statistics collected by SlowMist, among the reasons for the theft of various assets, 61% were due to the downloading of fake wallet apps.

Unlike the losses caused by hackers attacking the wallets of project parties, platforms and other institutions, this type of fake wallet scam targets ordinary users.

Institutions have professional security personnel to deploy security measures, but ordinary users are almost completely defenseless. For many ordinary users, an average loss of $130,000 per person is an astronomical figure, enough to bankrupt most people.

Perhaps, in the era of the metaverse, security will still be the most important aspect.