We triaged 99 total incidents over the past week. Here are the reported losses by category:

1) Protocol compromise: $57M + 2.4 BTC (excluding Binance*)

2) Seed compromise: $3.62M + 0.91 BTC

3) DPRK intrusion: $3M

4) Infrastructure exploit: $2.19M

5) Fake support caller: $1.57M + 1.12 BTC

6) Malware: $630K

7) Pig butchering: $332K

*Binance disclosed the incident separately. However, more than 10% of our reports were contact tickets related to this attack (tracing, attacker addresses for freezes, and third-party intel). SEAL is actively tracking a variety of DPRK-related campaigns, including TraderTraitor activity and we continue to provide both on-chain as well as web2 indicators to relevant parties.

What we collected

  • 5,137 phishing domains
  • 5,185 indicators published
  • 169 wallets

Recovered & Frozen

  • 0.1 BTC frozen, fake-caller theft
  • 6,200 DAI frozen, seed compromise

Protocols & Infrastructure

  • Protocol compromise across 9 reports resulting in loss of $57.2M + 2.42 BTC:
    • One exchange hot-wallet theft for a $49M loss; with currently undisclosed root cause. We assisted with on-chain tracing and asset freezing coordination.
    • $5M signing-infrastructure theft
    • $1.15M vault exploit on TON
    • $1M lending bug
    • $805K bridge exploit
    • $236k + 2.42 BTC margin protocol
  • Infrastructure-related attack vectors
    • A multi-milion loss related to code execution inside the pods that sign transactions, then the pods' service account decrypted pre-generated keys through the cloud KMS and the keys left. Shutting the system down failed to stop it. 💡 Any key your pod can decrypt, an attacker on that pod can also decrypt.
    • $1.15M on TON: vault shares minted with no deposit, three rounds over 17 days. The attacker's address links on-chain to two earlier incidents in our tickets, $1M and $255k. Same actor, third time.
    • $1M: a permission edge case let one account borrow on others' power.

Front-ends and DNS. Polymarket's front-end carried an injected drainer via a third-party vendor. Two victims came to us with one successful asset freeze conducted by SEAL. A few days later, a registrar-level DNS hijack hit two protocols at once, again injecting a crypto drainer.

💡
Registry lock, registrar 2FA, DNSSEC and monitor third-party dependencies on your front ends (i.e. user analytics tools).

DNS Hijack attacks on crypto protocols are a regular occurrence, usually conducted through social engineering of registrars support staff and domain management accounts takeover. Vet your registrars and avoid high risk TLDs such as .fi.

  • Infrastructure exploit incidents: 7 reports, $2.19M lost. Key or account theft with no contract bugs involved:
    • A long-lived cloud key had read read access to secrets store which led to Solana wallet emptied. $855K
    • A server holding trading-bot keys. $990K
    • PredictFun, a third-party API docs site takeover leading to script injection and users loosing their funds: $400K. All related to finding and exploiting infrastructure flaws and not socially engineering targets into executing malware. More details: https://x.com/predictdotfun/status/2115089547528950108

🔥 One more infra case to threat model: an attacker made over a million guesses at 6-digit 2FA codes, spoofing client-IP headers to dodge rate limits, then created API keys and withdrew via the withdrawal API. $56.7K reported loss. Rate-limits should apply on the account, not the IP.

DPRK

4 incidents resulting in $3M reported losses (again, this doesn't include Binance).

  • UNC1069 x3, all macOS, months from infection to drain:
    • $2M from a 2-of-3 Safe after months of malware persistence
    • $640K after a fake Teams invite from a "CEO," drained 7 weeks later
    • $300K: fake "Siri" and "Teams" binaries on a Mac.

The most interesting aspect of this week's UNC1069 thefts is that they all happened long time after initial infection. Check your devices regularly and you may avoid loss regardless of earlier malware detonation.

For MacOS we recommend installing:

  • https://objective-see.org/products/knockknock.html
  • https://objective-see.org/products/lulu.html

New UNC1069 infrastructure

  • Fake Microsoft and Teams lookalikes:
    • teannsnisrocoft[.]com
    • teennsrniccosoft[.]com
    • tearnsliues[.]com
    • teamviacam[.]com
    • videoviewer[.]onlineus05[.]live
  • Suspected UNC1069:
    • us04[.]cloud
    • us06[.]cloud
  • Contagious Interview: $60K
    • Linkedin fake recruiter, Git Hook repository, and a video call to exfiltrate a wallet's password upon connection to malicious dApp.

SINT-69

An uncategorized intrusion set that takes over Telegram accounts through fake Zoom invites, registered 9 new domains:

  • 03web[.]us
  • 03z[.]us
  • 04s[.]us
  • u04web[.]us
  • web05[.]us
  • live[.]teams[.]eu[.]com
  • meets[.]eu[.]com
  • team[.]lives[.]cn[.]com

Fake Support Callers

3 reports, $1.57M + 1.12 BTC reported losses

The largest was an "Apple support" call that captured Apple ID credentials. The seed was in cloud storage. This is a known TTPs we've previously warned about.

  • assist-apple-id[.]com
  • casesapple[.]com

Another victim gave up a seed on a Telegram "support" call. We observe different unaffiliated threat actors conducting "fake support" calls using a variety of different techniques.

Learn more in our advisory here: https://radar.securityalliance.org/from-gmail-compromise-to-fake-support-call-a-social-engineering-pattern-on-the-rise/

Other

iOS wallet compromises continue: 6 reports resulting in ~$127K lost (last week 4, $434K) across multiple Trust Wallets and one Uniswap Wallet. A majority of these victims were from Russia, Ukraine, and Kazakhstan.

  • 🚨 Censys reported in October that DarkSword and Coruna are used against wallet apps. Update iOS.

MalwareL 10 reports resulting in $630K + 53.77 SOL reported losses, including two $200K Rabby wallets in one week, both suspected to be device malware.

Electrum: one victim lost 1.2 BTC to the fee-bump bug patched in 4.8.3 on 24 Oct. A rogue server fed a fake unconfirmed transaction, then the fee bump rebuilt it to the attacker's address.

  • 🚨 Update Electrum and read the outputs on screen before bumping any fee.

Seed compromise, 13 reports, $3.62M + 0.91 BTC.

Largest loss was a $3.5M hardware-wallet victim.

Also: $200K was lost to a scam that registered the victim's own address as an ENS name, a $180K rug pull, and a seed typed into a fake Ledger app.

'Twas a long week, everyone!

Our incident response service is free to anyone who needs it, and stays that way because people from the community fund it. If this week's numbers are useful to you, fund the next one: https://securityalliance.org/donate

If you require a direct data feed from SEAL-ISAC, contact us at [email protected].

The link has been copied!