blog.ethereum.org mailing list incident | Ethereum Foundation blog

Phishing emails were sent to 35,794 email addresses on 2024-06-23 00:19 AM UTC. Update@blog.ethereum.org With the following contents

Users who clicked on the link in the email were taken to a malicious website.

The website was running a crypto drain in the background, and when users created a wallet and signed a transaction requested by the website, money was drained from the wallet.

Our internal security team immediately launched an investigation to determine who initiated the attack, what the purpose of the attack was, when it occurred, who was affected, and how it occurred.

Some of the initial steps include:

• Prevented the threat actor from sending additional emails.
• We sent out notifications via Twitter and email asking people not to click on the link.
• Blocked the malicious access vector used by the threat actor to access a mailing list provider.
• After submitting the malicious link to various blacklists, it was blocked by most web3 wallet providers and Cloudflare.

Our investigation into the attack found that:

• Threat actors import their large email lists into mailing list platforms for use in phishing campaigns.
• The threat actor exported email addresses from the blog mailing list, totaling 3,759 addresses.
• When comparing the emails to the email list pulled by the threat actor, we found that the blog mailing list contained 81 email addresses that the threat actor did not previously know about, and the rest were duplicate addresses.
• Analysis of on-chain transactions made to the threat actor between the time the email campaign was sent and the time the malicious domain was blocked revealed that none of the victims lost funds during this particular campaign sent by the threat actor.

As we continue to work through this incident, we have taken additional steps to reduce the risk of something like this happening again, including migrating some of our mail services to other providers.

We sincerely apologize for this incident, and we are working closely with our internal and external security teams to investigate and resolve this incident.

Please send your inquiries to the following address: security@ethereum.org.