The right address, the wrong site

We tell people to type a site's address themselves, or use a bookmark, so a fake link can't fool them. This week that advice wasn't enough. On November 10, thieves took over the real web address of Across Protocol, a service that moves crypto between blockchains. Anyone who typed it correctly still landed on a copy built to empty wallets.

The copy couldn't take anything by itself. It needed each visitor to tap "approve" in a wallet pop-up. That pop-up, and what to look for in it, is what this issue is about.

A real address, hijacked. The attackers didn't break Across's code. They tricked the company that holds its web address into handing over control, then pointed the address at their own copy. Security firm GoPlus estimates nearly $350,000 was taken. Across hasn't confirmed a total, has the address back, and says everyone affected will be repaid. Our report, and what to check

A big exchange, cut off from US banks. A US Treasury order published November 10 tells American banks and financial firms to stop moving money to or from the crypto exchange MEXC. The agency says at least $16 billion in illicit money moved through it. The order is not an account freeze, but other exchanges are already holding transfers that arrive from MEXC. What the order does and doesn't do

Why bitcoin slipped. US prices rose 0.4% in October, more than expected. Bitcoin fell below $74,000 as traders bet the Federal Reserve will raise interest rates when it meets on December 8 and 9. Higher rates tend to pull money away from riskier things like crypto. Nobody knows what the Fed will do. The plain-words version

The pop-up is the last check. A correct address and a bookmark both failed Across users this week, through no fault of theirs. The one thing left was the small window their wallet showed before anything moved. If it says "approve," "permit" or "set approval for all," you are giving that site permission to move your tokens. If you only came to look, or the amount says "unlimited," close it.

Read the pop-up before you sign.

Scam of the Week

Scam of the Week: the broker who calls you. Police in Ukraine arrested four people this month over call centers that sold fake crypto investments. At least 135 people in Germany lost more than €4.3 million (about $5 million). The callers posed as brokers, showed fake profits on fake platforms, and in some cases got into victims' online banking. A real broker never needs remote access to your computer or your online banking. How the calls worked

Also this week

Keplr and "Sign in with Google." Keplr wallet paused its Google and Apple logins on November 6 after a flaw at its login provider exposed the keys to some accounts. Wallets made with a recovery phrase or a hardware wallet are not affected, Keplr says. Who needs to act

A crypto card breach. Gnosis Pay, which issues debit cards that spend crypto, told customers on November 6 that someone got into an older card system. For some people the leak included card numbers, home addresses and linked wallets. The company says no funds were taken. What leaked

Each day's market move. Our daily page explains why crypto moved, with a named source for every number and no price predictions. Why is crypto down today?

New guides on DMJ

 

 

 

Coming next week: new guides and the stories behind the week's headlines, with this Briefing on Sunday, November 22.

Loss figures in this issue are estimates from researchers and news reports unless a company or agency confirmed them. News and education, not financial advice. Tokens and NFTs can lose all their value.

DeFi Market Journal, PO Box 114, Belen, NM 87002