23 August

Ethereum under attack

Group-IB, a global leader in preventing and investigating high-tech crimes, and high-grade threat intelligence and anti-fraud solutions provider, has detected a scam attack on Numerai, a hedge fund that was the first to launch its own cryptocurrency, the Numeraire (NMR) earlier this year. Fraudsters offered to estimate how much NMR a user is entitled to, if ETH Wallet Address and Balance is provided.

Spreading this offer via Slack using the name of a Numerai employee, fraudsters proposed recipients an opportunity to claim an NMR airdrop. Having provided ETH Wallet Address and Balance, and receiving an NMR balance estimate, the victim is then asked for a private key (which no site should ask for) supposedly for a verification procedure. Once fraudsters receive the key they promptly drain the account.

The phishing page is quite well made – aside from the video embedded and the absence of favicon, which would potentially alert an aware user – all links work by redirecting the user to 3rd party web-sites and even to the company’s original page.

Cybercriminals tend to use trending topics and human weakness to succeed in fraudulent activities. They pay special attention to the areas where people have less expectation for fraud or experience. Therefore it’s very important to remain alert online, especially when in relation to sensitive personal data and financial transactions.


Yaroslav Kargalev

Senior Analyst CERT-GIB

Phishing site suggests entry of a private key for ETH wallet verification

Phishing site suggests entry of a private key for ETH wallet verification

Following simple cybersecurity best practices can considerably minimize risks:

  • Be cautious of any proposals you receive online, especially coming from unknown accounts.
  • Even if you receive a message with a proposal from a known contact, think twice before clicking.
    Their account may be compromised.
  • When it comes to sensitive topics, i.e. personal data, money transfers, etc. check the URL of the resource. If you aren’t sure, google it. Wikipedia articles and official social media channels can help.
  • No one web-site, call center operator, or messenger should ask you for sensitive data like passwords, PIN‑codes, or any private keys.

Report an incident

24/7 Incident Response Assistance +7 495 984-33-64

Thank you!
We will contact you soon.