Новини SCAM (SCAM)

Web3 Security Alert — Malicious Approvals

What is a malicious approval scam? Malicious approvals are one of the most widespread, dangerous, and damaging scams in Web3 — affecting countless users. In Web3, whenever you interact with a smart contract, you're often asked to grant certain permissions by signing a transaction. Examples include: ● Approving a DApp to access your tokens (e.g., ERC-20 approve) ● Granting a contract permission to transfer your NFTs (setApprovalForAll) ● Performing on-chain actions that seem harmless, like login or verification. Malicious approval scams take advantage of these actions by tricking you into giving a malicious contract permission to transfer your assets. Key features 1. Trick users into granting dangerous permissions Scammers disguise themselves as legitimate DApps, airdrops, or NFT projects. They lure you into clicking an "Approve" button, but in reality, you are authorizing actions like [approve] (token access) or [setApprovalForAll] (NFT access) for a malicious contract. 2. Your assets are drained without a transfer You didn't initiate a transfer—just clicked "Confirm." But once the scammer gets approval, they can call on-chain functions to drain your wallet at any time without needing further approval or signature from you. 3. Approvals are often unlimited Most scam contracts request approval for the maximum possible value (2^256 - 1), giving them unrestricted and permanent access to your assets. 4. The contract does nothing else Scam contracts are passive, they don't actively steal funds on their own. Everything hinges on you willingly signing the approval, which helps them bypass traditional fraud detection and warnings. 5. Misleading signature prompts Wallet prompts for approvals are often confusing — either overly complex or overly simplified — making it hard to analyze what you're signing. Most users assume it's "just an authorization" and click "Confirm" without realizing the serious risk involved. Common scenarios 1. Fake airdrop or NFT minting pages The page may advertise "limited-time airdrops" or "free mint" promotions. Clicking the button triggers an approval request for your USDT (Approve) or NFTs (SetApprovalForAll)—once approved, scammers can drain your assets at any time. 2. Fake DEX or swap platforms You connect your Bitget Wallet to a fake DEX and try to swap USDC for a new token. The site doesn't actually initiate a swap — it just gets you to “Approve USDC.” Once done, your funds are stolen using a malicious contract. 3. Fake staking/farming or game platforms You're prompted to "stake tokens" or "start playing" on a DeFi/GameFi app. The site asks for token/NFT approval. The entire platform is a front for malicious contracts that drain your assets once authorized. 4. Hacked frontends of legitimate projects Hackers compromise trusted project sites or hijack DNS records, injecting malicious scripts to swap the real contract with a phishing one. Users think they're interacting with a legit app — but you are actually granting access to attackers. 5. Fake customer support or help documents You ask for help in a community and a fake "support agent" or "customer service"sends a link. The link leads to a fake support page asking you to authorize a contract under the guise of "resolving your issue" — but it's actually a trap. How it works The core principle of malicious approvals can be summarized in one sentence: It exploits user ignorance of how on-chain permissions work. By misleading you into granting approvals, scammers gain control of your assets and steal them without your awareness. Technical principles Here's the typical workflow of a malicious approval scam: 1. Scammer deploys a malicious contract (but it doesn't initiate transfers directly). 2. User is tricked into calling [approve] (for tokens) or [setApprovalForAll] (for NFTs). 3. Approval is granted, but assets remain in the wallet — for now. 4. Scammers then use [transferFrom()] or similar functions to move funds to their own wallet. 5. Since the transaction is technically valid (approved by the user), wallets and blockchains don't block it. Bitget Wallet security measures ● Phishing website alerts: If you visit a suspicious site, Bitget Wallet will show a warning to prevent you from unknowingly approving a malicious contract. ● Built-in contract risk detection: Bitget Wallet includes a tool that scans your existing approvals. You can proactively review and revoke high-risk or outdated permissions to keep your assets secure. Best practices to protect yourself Watch out for these red flags to identify potential malicious approval attempts: ● The DApp has no real functionality — just a prompt asking you to approve something ● It asks for access to critical assets (USDT, ETH, NFTs) ● The approval has no limit (approve (uint256 max)) ● Your wallet's signature popup shows SetApprovalForAll: true. ● The website looks unprofessional or mimics a well-known project ● Never click random links or approve anything from Telegram DMs, Twitter replies, or other unverified sources Final thoughts If you don't understand it, don't sign it. If it's not a trade, think twice before clicking. For everyday users, approving smart contract permissions should be done with extreme caution. Always adopt a security-first mindset: "approval = transferring funds." Scrutinize and double-check every contract authorization before signing. Related articles: Web3 Security Alert - SMS Spoofing Web3 Security Alert - Payzero Web3 Security Alert - High-risk Tokens Web3 Security Alert - Fake Apps Web3 Security Alert - Malicious Approvals

Web3 Security Alert – Fake Apps

In the crypto space, scammers are constantly evolving their tactics. One high-risk threat is making a comeback: fake Bitget apps. These malicious apps are cleverly disguised to look just like the official Bitget app — from the logo to the app description — making them nearly impossible to tell apart. Cybercriminals use a variety of tricks to lure users into downloading these lookalikes, aiming to steal personal information and digital assets. What are fake apps? Fake apps (also known as phishing apps or malicious copycat apps) are illegitimate applications created to closely mimic popular, legitimate platforms — such as crypto exchanges, wallets, or social networks. They replicate names, logos, interfaces, and even functionalities to appear authentic. Once installed, these apps often lead to privacy breaches or financial loss. Key features ● Lookalike visuals: App names, logos, and layouts closely resemble the official version, with only minor differences (e.g., logo color schemes or font details). ● Cloned features: Fake apps may replicate core functions of the real app or simply redirect users to fake pages. ● Malicious permissions: Often request access to excessive phone functions like contacts, SMS, camera, or microphone — far beyond what's necessary — to monitor user behavior or steal data. ● Unofficial distribution: Commonly found in third-party app stores, phishing sites, links sent via SMS or emails, or shared in online communities. ● Lack of official credentials: Developer information is vague or missing, and contact details or privacy policies are often fake or absent. ● Spelling, grammar, or description errors: Phishing apps often contain basic mistakes, since legitimate developers typically review text carefully before publishing. ● Suspicious reviews: Low download numbers, polarized ratings (all 5-star or all 1-star), and a mismatch between the release date and the number of reviews. Common attack scenarios 1. Wallet address replacement: ● Users attempt to deposit or withdraw funds using the fake exchange app. ● The app secretly replaces the recipient address with one controlled by the attacker. ● Funds are unknowingly sent to the scammer's wallet and are unrecoverable. 2. Credential theft: ● Users enter their login credentials and 2FA codes into the fake app. ● Scammers use this data to access the real platform. ● Assets are quickly transferred or misused. 3. SMS phishing: ● Victims receive SMS alerts such as "urgent security warning" or "unusual account activity" with links to download the fake app. ● Feeling pressured, users install the app and grant permissions. ● The app then steals sensitive information, including seed phrases or intercepts SMS verification codes, enabling unauthorized access. 4. Malware injection: ● The fake app installs additional malicious software in the background. ● It may deploy keyloggers to capture input from other apps. ● Files such as private keys or seed phrases can be silently accessed and uploaded. 5. Continuous monitoring: ● The app runs in the background, monitoring user activity. ● It captures screen content, especially when financial apps are in use. ● Attackers wait for moments to intercept or alter transaction data. How do fake apps work? Fake apps combine technical deception with social engineering: 1. Technical deception ○ Interface and code duplication: ■ Clone the official app's interface, functionality, or even source code, making the fake app look and function the same. ■ Modify legitimate APK files by injecting malicious code or replacing transfer addresses to create altered versions. ○ Permission abuse: ■ Request excessive permissions (e.g., read SMS, access contacts, track location) to enable data theft or remote control. ○ Intercepting and encrypting communication: ■ API interception is used to intercept and modify communication data between the app and its server. ■ Transmit sensitive information, such as transaction addresses or passwords via encrypted channels. ○ Detection evasion: ■ Code obfuscation: Modify the code to make it unreadable or harder to analyze, helping it evade automatic detection. ■ Delayed activation: Malicious code only triggers after installation or under certain conditions. ■ Dynamic loading: Malicious code is downloaded post-installation rather than bundled with the app. ■ Staggered permission requests: Sensitive permissions are requested gradually, lowering user vigilance. 2. Social engineering ○ Abuse of trust: ■ By mimicking trusted platforms (e.g., Bitget), phishing apps inherit user trust and cause users to drop their defenses. ○ Creating urgency: ■ Use scare tactics (e.g., "Your account is at risk" or "Asset loss detected") via SMS or push notifications to lower user vigilance and trigger quick, unverified actions. ○ Visual trickery: ■ Exploit users' inability to notice small visual discrepancies, using similar visual elements to deceive. ■ Inflate legitimacy with fake reviews and manipulated download counts. ○ Targeted distribution: ■ Target specific groups, such as crypto investor communities, to increase the success rate of attacks. ○ Frequent rebranding: ■ Continuously change app names, icons, and descriptions to avoid detection and prolong the scam's lifespan. How to spot a fake app Be on the lookout for these red flags: ● Abnormal icon: Slight but noticeable differences compared to the official app icon. ● Excessive permission request: Unnecessary permission prompted after installation. ● Suspicious reviews: Either overly positive or overwhelmingly negative. ● Grammar and spelling errors: Obvious mistakes in the app name or description. ● Unusual download volume: The legitimate Bitget app should have a large number of downloads. ● Suspicious developer information: Missing or fraudulent company details. ● Questionable release timing: Be cautious of newly launched apps with an unusually high number of reviews. ● Untrusted sources: App links shared via social media, SMS, or email instead of official channels. Bitget security protections Bitget is committed to keeping you a step ahead and fully informed about what's happening on your account. Email alerts If you have linked your email, you will receive an email whenever you log in from a new device. These emails include your anti-phishing code, verification code, login location, IP address, and device details. Always take a moment to verify that this information matches your activity. If your account is accessed from a different location, you'll receive a follow-up email notifying you of the login. Please verify this access. When making a withdrawal, you'll receive an email containing the verification code and full transaction details. Always confirm that everything matches your intended withdrawal. Cooling-off period (1 hour or 24 hours) To prevent impulsive actions caused by scams, Bitget has implemented a cooling-off period — a temporary safeguard triggered when the system detects potential account risks (like unusual login locations, suspicious transactions, or suspected fraud): Cooling-off period: Depending on the risk level (1 hour or 24 hours). ● 1-hour period: For lower-risk scenarios (e.g., remote logins), this short delay pauses withdrawals so users can verify account activity. ● 24-hour period: For high-risk scenarios (e.g., verification method changes or phishing risks), all withdrawals are suspended, giving users time to reassess account safety. Official verification channels If you're unsure about someone's identity, you can always verify it through Bitget's official verification channels. Best practices for account security Enable multiple 2FA methods Two-factor authentication (2FA) is a critical layer of protection that requires two separate methods of identity verification. This may include combinations of email, passwords, SMS, Google Authenticator, security keys, or other methods. Using multiple 2FA options greatly strengthens your account security and reliability. Set anti-phishing code An anti-phishing code is a security feature provided by Bitget to help users identify phishing websites. Once enabled, all official emails and SMS from Bitget (excluding SMS verification codes) will include your unique anti-phishing code. Phishing emails and SMS will not contain anti-phishing codes, making it easy for users to identify whether they are from official Bitget channels. To set it up, go to Profile > Security > Anti-phishing code and follow the instructions. Visit this link for more details about anti-phishing codes. Enable withdrawal address confirmation When withdrawing funds via the Bitget website, there's a risk of malicious activities like traffic hijacking, which may tamper with your withdrawal address. To prevent this, Bitget offers a cross-device verification switch. You'll be required to scan a QR code using the Bitget mobile app to confirm the withdrawal address before the request can go through. Practice good account hygiene Install antivirus software. Always download applications and software from trusted official sources, and avoid clicking on links received via SMS. To further enhance your account security, consider using a dedicated device for accessing sensitive or confidential accounts. Never put all your eggs in one basket. Avoid logging into your email, inserting a SIM card, and storing Google Authenticator on the same phone. If your device is lost or compromised, having everything on a single device could mean losing it all. Spreading out your risk can significantly reduce potential losses. Conclusion: Security begins with awareness — and it starts with you Technology can build defenses in the field of network security, but your awareness and vigilance are the ultimate safeguards. Scammers thrive on confusion and urgency, but when you're informed, you can spot the traps and respond with confidence. Bitget provides a multi-layered security framework to protect users, but the most powerful safeguard is your own understanding of risk. Every bit of scam awareness you gain is another shield protecting your assets. Knowledge is power. Action is protection. Bitget will continue to update anti-scam resources and risk alerts. Every time you double-check a detail or make a cautious decision, you close the door on scammers. Let's work together to make safety our shared foundation. Learn more: Bitget's security best practices Related articles: Web3 Security Alert - SMS Spoofing Web3 Security Alert - Payzero Web3 Security Alert - High-risk Tokens Web3 Security Alert - Fake Apps Web3 Security Alert - Malicious Approvals

Web3 Security Alert — High-risk Tokens

Overview ● High-risk tokens definition ● The four common types of high-risk tokens and their malicious mechanisms. ● The three layers of security measures implemented by Bitget to ensure the safety of token listings. High-risk tokens refer to cryptocurrencies that are deliberately embedded with malicious mechanisms or hidden "backdoor" codes during their design and issuance. These are implemented by project teams with the intent to exploit investors at an opportune moment, enabling them to reap illicit gains through technical means. On the surface, these tokens may seem indistinguishable from regular ones, often featuring attractive marketing promotions, vibrant community engagement, and initial price surges. However, their smart contracts conceal dangerous mechanisms that can be activated at any time. Common high-risk token types Honeypot token: The "money-in, never-out" trap The honeypot token is sometimes nicknamed the Pixiu token, after a mythical Chinese creature believed to attract wealth but never release it. The metaphor is apt: these tokens are a one-way street — easy to buy, nearly impossible to sell. Imagine stumbling upon a "soon-to-moon" token and eagerly buying in early. Prices go up, and you're ready to take profits. But no matter what you do, every attempt to sell fails. All you can do is watch as your tokens turn into nothing more than worthless numbers on a screen. For example, the token GROKAI had a blacklist function embedded in its smart contract. The token's creator used it to block regular investors' addresses, preventing them from selling their tokens once the function was activated. Inflationary scam tokens: The developer's personal money printer Inflationary scam tokens function like a nonstop "money printer" for the project team. On the surface, these projects often promote attractive claims such as a "fixed supply" or being "non-inflationary." In reality, however, there are hidden backdoors embedded in the smart contract. To the investor, everything appears to be running smoothly: the token supply seems fixed, trading is active, and the price is steadily climbing. Then, at a critical moment, the development team suddenly activates the hidden backdoor, minting a massive number of new tokens. As these tokens are rapidly dumped onto the market, prices crash suddenly, and investors see the value of their holdings wiped out in an instant. For example, the YFII fork project YYFI enabled excessive token minting, crashing the market before the team exited with huge profits. Liquidity rug-pull tokens: Modern-day exit scams The project team first creates a liquidity pool on decentralized exchanges (such as Uniswap or PancakeSwap) and pairs its token with mainstream assets such as ETH or USDT to establish an initial trading environment. As hype builds and investors flood in, the token price rises steadily. Once the pool holds a substantial amount of real assets (ETH, USDT, etc.), the team suddenly removes all liquidity without warning. This is like draining a pond, leaving the fish (investors) stranded without water. Without liquidity support, the token's value can collapse almost instantly, often leaving investors with no chance to sell their holdings and cut losses. For example, in 2021, AnubisDAO amassed nearly $60 million worth of ETH in liquidity on Uniswap. Within 24 hours, the project team withdrew all liquidity, causing the token's value to plummet to zero and leaving investors with heavy losses. Premature unlock scams: Fake lockups, real damage Premature unlock scams are a more subtle form of fraud. Most legitimate projects implement token lockup mechanisms to prevent early investors and team members from selling large quantities too soon, thereby helping to maintain price stability. However, in shady projects, these lockups are often fake. Hidden backdoors in the smart contracts allow insiders to bypass the lock and unlock tokens prematurely. When the price reaches a favorable level, the team dumps tokens that were supposed to be locked, causing the price to crash and leaving regular investors holding the bag. Bitget's security measures In-depth token due diligence: Going beyond the surface At Bitget, we are not easily swayed by flashy marketing or glossy whitepapers. Every token seeking to be listed on our platform is put under our "security microscope" — a comprehensive and rigorous multi-dimensional evaluation system. Our security experts conduct thorough investigations from multiple angles, including: ● Project background checks: We dig deep to verify the origins, professional qualifications, and track records of the token project team. ● Comprehensive tokenomics analysis: A sustainable token requires a healthy tokenomics model. We assess its inflation mechanisms, incentive structures, and long-term viability. ● Valuation and distribution review: We rigorously evaluate the token's Fully Diluted Valuation (FDV) to ensure it aligns with the project's current development stage and market standing. ● Community health assessment: Projects of real value have active and diverse communities. We analyze the distribution of token holders and assess community engagement and participation levels. Dual-layer security audits: Two lines of defense At Bitget, we recognize that smart contract security is paramount to safeguarding digital assets. That's why we have established a dual-layer audit system: ● Professional internal audit: Bitget has a team of experienced blockchain security engineers skilled at identifying smart contract vulnerabilities and attack vectors. Each contract's code is reviewed line by line by our experts to detect potential security risks. ● External audit: Each token contract is also independently audited by leading third-party blockchain security firms with whom we have long-standing partnerships. Their expertise helps uncover even the most hidden threats. This dual-layer approach ensures that if one layer overlooks a security issue, the other can detect and resolve it, giving users the strongest possible security assurance. Real-time on-chain monitoring: A tireless digital guardian Listing a token is not the end. It's the beginning of continuous security monitoring. Bitget's proprietary on-chain monitoring system acts as a tireless digital guardian, protecting user assets around the clock: ● Real-time anomaly detection: Our system continuously monitors all on-chain transactions and analyzes contract interactions in real time. Unusually large transfers, suspicious contract calls, and permission changes are promptly detected. ● Constant evolution: The monitoring system is designed to learn and adapt. It continuously updates its threat models and detection rules to stay responsive to emerging threats. Best practices for users Do your research and thoroughly understand the project Investing in digital assets is like exploring uncharted territories. Thorough research is your most reliable compass. Before putting any money into a project, make sure you've conducted a deep investigation: ● Research the project team: Don't take polished bios or sleek headshots at face value. Dig into the true identities of core team members and verify the accuracy of their claimed experience. Trace their footprint in the blockchain industry and pay close attention to the outcomes of any previous projects they've been involved in. ● Understand the tokenomics: Carefully examine the token's total supply, circulating supply, and the ratio between the two. Review its unlock schedule, and evaluate the token's utility and growth mechanisms to ensure it's more than just a speculative asset with no practical use. Pay attention to smart contract security A project's smart contract code is a critical area that deserves close attention. ● Check for open-source contracts: Use blockchain explorers like Etherscan or BSCScan to verify whether the smart contract is fully open-source. Avoid projects that don't make their code publicly available. ● Use security analysis tools: Leverage specialized token analysis tools such as Token Sniffer or Go+ to scan the contract for vulnerabilities. These tools can automatically detect common risks like unlimited minting access, hidden fees, suspicious permission settings, and other red flags. ● Look for credible audit reports: Prioritize projects that have been audited by reputable third-party security firms. Invest rationally In the tempting and volatile world of digital assets, rational thinking may be the rarest and most valuable asset. Investors should always align their strategies with their personal circumstances: ● Assess your risk tolerance: Your crypto investments should never compromise your quality of life or mental well-being. ● Diversify strategically: Don't put all your eggs in one basket. Spread your investments across different project types, development stages, and blockchain ecosystems to reduce risk. ● Emotional discipline: While short-term market movements are often driven by emotion, long-term value depends on a project's real-world progress. Learn to manage FOMO (fear of missing out) and FUD (fear, uncertainty, and doubt), and stick to a research-driven, long-term investment approach grounded in fundamentals. By following these best practices, you'll not only invest more safely but also grow wiser in the process. In the world of blockchain, smart investors don't just chase returns. They balance financial growth with knowledge and sound risk management. Final thoughts As blockchain technology and the crypto market continue to evolve, the importance of digital asset security has never been greater. In this dynamic landscape of opportunity and risk, Bitget remains steadfast in its commitment to safeguarding user assets, continuously strengthening our comprehensive protection systems to ensure a safer trading experience for all. Related articles: Web3 Security Alert - SMS Spoofing Web3 Security Alert - Payzero Web3 Security Alert - High-risk Tokens Web3 Security Alert - Fake Apps Web3 Security Alert - Malicious Approvals