Malware Targets Wallets via Photos

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, a new malware targeted crypto wallets via photos, a CoinMarketCap attack drained wallets, BitoPro blamed Lazarus for an $11M heist, Trezor warned of phishing campaign, France saw its 10th crypto kidnapping this year, cops re-arrested a teen behind $245M bitcoin theft, Hacken blamed human error for exploit wiping out 98% of its value and Self Chain ousted CEO over Ponzi scheme allegations.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

Researchers discovered a malware strain they dubbed “SparkKitty” stealing photos from Android and iOS devices to harvest cryptocurrency wallet seed phrases. Identified by Kaspersky, SparkKitty appears to be an evolution of SparkCat, which used optical character recognition to extract recovery phrases from image files. SparkKitty spreads through apparently legitimate apps such as messaging, crypto exchanges and modified or “modded” games on the on Google Play and the Apple App Store, as well as unofficial sources.

The malware requests access to the device’s photo gallery. On Android, it uploads all images, sometimes filtering those with text using OCR, along with device metadata. On iOS, it monitors for new images and exfiltrates them once it gains access.

CoinMarketCap underwent a supply chain attack that exposed its visitors to a crypto-draining scam through a malicious Web3 popup. The incident began on June 20, when users saw prompts to connect their wallets to CoinMarketCap. Those who complied unknowingly interacted with a wallet drainer script that stole funds.

The breach exploited a vulnerability in the site’s homepage doodle image. CoinMarketCap said the attackers tampered with the API delivering the doodle, injecting malicious JavaScript via a modified JSON payload. This script, hosted on static.cdnkit.io, triggered a fake wallet connection popup mimicking legitimate Web3 requests.

Taiwanese crypto exchange BitoPro attributed an $11 million theft from its platform to North Korea’s Lazarus Group. The attack occurred on May 8 during a hot wallet system upgrade. Hackers exploited the process to withdraw funds from an old wallet across Ethereum, Tron, Solana and Polygon blockchains. BitoPro’s internal investigation linked the incident to Lazarus based on attack patterns resembling previous high-profile heists.

The attackers used social engineering to infect a cloud operations employee’s device with malware, hijacking AWS session tokens and bypassing multi-factor authentication. They delivered malicious scripts into the wallet infrastructure while mimicking normal behavior to avoid detection. The stolen assets were quickly laundered through decentralized exchanges and mixers such as Tornado Cash and ThorChain.

BitoPro acknowledged the breach on June 2 and confirmed no insider involvement. The exchange also replenished affected wallets using reserves and completed a forensic investigation by June 11.

Trezor warned users about a phishing campaign that exploits its automated support ticket system to send deceptive emails from its legitimate help@trezor.io address. Attackers are abusing the system by submitting support tickets using urgent, phishing-laced subject lines, such as prompts to “secure assets,” which the platform then auto-replies to, making the messages appear authentic.

The phishing emails direct recipients to malicious websites that mimic Trezor interfaces and prompt users to enter their wallet seed phrases – these 24-word recovery phrases serve as master keys to cryptocurrency wallets stored on Trezor’s hardware devices. If stolen, attackers can gain full access to a user funds. Trezor said it is working on defenses to prevent further abuse of its support system.

France recorded its 10th crypto-related kidnapping of the year, marking a rise in “wrench attacks” physical assaults aimed at forcing victims to hand over cryptocurrency. The latest incident reportedly occurred in Maisons-Alfort, near Paris, where a 23-year-old man was abducted while running errands. The attackers forced him to call his partner and instruct her to deliver a Ledger hardware wallet and 5,000 euros in cash. The victim was released unharmed in nearby Creteil after the handoff. Le Parisien reported that violence was used during the abduction. Cypherpunk Jameson Lopp, who maintains a global database of such incidents, said France now accounts for nearly a third of the 32 wrench attacks reported worldwide this year. Researchers at the University of Cambridge say that many incidents go unreported due to fear or privacy concerns.

Veer Chetal, a 19-year-old from Danbury, Connecticut, pleaded guilty to his role in the $245 million bitcoin theft from a Genesis creditor in August 2024. Chetal, known online as “Wiz,” cooperated with authorities and forfeited millions in assets, including luxury goods and over $36 million in ethereum. He faced up to 24 years in prison but was released on bond pending sentencing.

A week after the original $245 million theft, Chetal’s parents were targeted in a kidnapping attempt by a group of six masked men, five of whom have pleaded guilty to charges against them.

Newly unsealed court documents now show that Chetal was re-arrested in January after authorities discovered he committed an additional $2 million crypto theft while on release. The scheme involved social engineering a New Jersey resident into revealing her wallet seed phrase under the guise of Gemini support. Investigators linked the stolen funds to Chetal through a VPN leak that exposed his real IP address, traced to his mother’s home. Chetal reportedly gambled the $200,000 proceeds from the theft and lost them all in a single online bet just minutes after receiving the funds.

Ukrainian cybersecurity firm Hacken said a leaked private key caused an exploit of its $HAI token, allowing an attacker to mint nearly 900 million tokens and crash the asset’s value by about 98%. The attacker exploited a minter account on both Ethereum and BNB chains, dumping tokens on decentralized exchanges and stealing around $250,000.

The exploit nearly doubled $HAI’s supply, sending its market cap plunging from $12.7 million to $7.2 million. Hacken acknowledged fault on X, formerly Twitter, saying that failure to implement a multisig bridge setup years earlier contributed to the breach. The compromised minter role was later revoked, and no other accounts appear affected.

The firm hinted at a future token swap and potential merger with Hacken equity, valuing the combined entity at over $100 million. Hacken’s own recent Web3 security report warned that human and permission failures now outweigh smart contract bugs as the biggest threats in the space.

Blockchain project Self Chain has removed Ravindra Kumar as CEO after users linked him to an alleged over-the-counter crypto scam that defrauded investors of more than $50 million. The project announced Kumar’s termination, severing all ties and responsibilities following claims he orchestrated a months-long Ponzi scheme.

The fraud began in November, with Telegram brokers offering discounted tokens such as GRT, APT, SEI and SUI. Early participants received payouts, encouraging larger deposits. But by May, industry figures like Mysten Labs co-founder Adeniyi Abiodun warned that no discounted SUI allocations existed. The scam collapsed when operators failed to deliver tokens, revealing new funds were used to pay earlier investors.

Aza Ventures CEO Mohammed Waseem said a broker known as “Source 1” initially delivered real tokens before pivoting to fraud. Though Kumar has said he’s not Source 1.