Ministry of Industry and Information Technology: Metaverse, fraudsters have arrived at the battlefield

Not long ago, the well-known security auditing organization SlowMist published an article warning that fake wallet apps have caused tens of thousands of people to be stolen, with losses as high as US$1.3 billion.

As the Metaverse becomes increasingly popular, people from all walks of life who want to experience Metaverse games, web3 products, and want to seize the opportunity to "dig for gold" are flocking in. In addition, some platforms have announced that the day of liquidation has arrived, and many people are forced to start using wallets.

However, for many people who have not operated crypto assets, new things mean a lot of unfamiliar operations like "blind men touching an elephant", which also makes some "special groups" smell the atmosphere of "Chinese New Year"...

Friends who have played blockchain games can all see a phenomenon: the official communication group administrators’ catchphrases are almost all warnings against fraud, but every day there are still people being deceived by fake “administrators”.

Taking the "fake wallet" scam in the Telegram group as an example, when users go to the official group to report some problems, there may be a group administrator (with the same nickname and avatar) to help you solve the problem, and "kindly" remind you to beware of scams and recommend downloading the "Xiaoxli" wallet.

At the same time, you have been quietly pulled into an official communication group of the "XiaoXili" wallet, where the official customer service will release links and warn users in the group not to trust private chats.

Therefore, under the friendly reminders of the "kind" administrators and customer service, many people confusedly clicked on the link of the so-called "wallet official group", downloaded the wallet, and imported the mnemonic, etc. Then, the digital assets would disappear.

A victim's account of being deceived was circulated in a certain community. Recently, similar digital asset frauds have been particularly serious, with a large number of people deceived and a huge amount of assets. In addition to the official project team, not only some wallet teams and security teams in the industry, but also security teams outside the industry have paid attention to this phenomenon.

Usually the scammers will tell you that they will first transfer money to you, and then give you a "payment QR code" and ask you to scan it to transfer a small amount to test whether it can be received. However, when the actual wallet scans this QR code, it opens a "wallet transfer page" that is highly imitated by the scammers.

The operation performed on this page is actually an "authorization" operation. After confirming the authorization, the scammer can move all the currency in the wallet.

The above is just the tip of the iceberg, and various scams are happening every day. Most scams involving "fake wallets" have different processes, but the purpose is almost the same, which is to find ways to trick you into downloading a "fake" high-quality fake wallet.

When users create a new encrypted wallet or import private keys and mnemonics in this wallet, sensitive mnemonics and private key information will be quietly sent to the scammers, or they will try to trick you into signing and authorizing. Then, the scammers will have the right to dispose of the encrypted assets in your wallet.

According to statistics collected by SlowMist, among the reasons for the theft of various assets, 61% were due to the downloading of fake wallet apps.

Unlike the losses caused by hackers attacking the wallets of project parties, platforms and other institutions, this type of fake wallet fraud targets ordinary users. Institutions have professional security personnel to deploy security measures, but ordinary users are almost completely defenseless. For many ordinary users, the average loss of $130,000 per person is an astronomical figure, enough to make most people go bankrupt. Perhaps, in the era of the metaverse, security will still be the most important link.

The wallet must be downloaded from the official website. If you download it from the app store, be sure to check the name of the app developer and confirm that it is the app officially submitted by the wallet before downloading.