Cosine lists common Crypto phishing techniques, involving DaaS functions and phishing paths

SlowMist founder Yu Xian published an article on the X platform listing common Crypto fishing techniques, including: Drainer-as-a-Service (DaaS) features: - eth_sign/personal_sign/eth_signTypedData_* This kind of native signature utilization, eth_sign has been blocked by wallets less and less; - Utilization of authorization functions like approve/permit for Token/NFT; - Utilization of powerful functions such as Uniswap swapExactTokensForTokens/permit2; - Utilization of protocol functions such as OpenSea/Blur; - TX data 4byte utilization, Claim Rewards/Security Update, etc.; - Use Create2 to pre-create the fund receiving address to bypass related detection; - Solana steals all the assets in the target wallet address with one signature; - Bitcoin Inscription one-click batch phishing, UTXO mechanism; - Switch phishing for each EVM chain/Solana/Tron, etc. Phishing path (not necessarily using DaaS): - Google/X and other advertising poisoning, X comment or private message poisoning - Hack official accounts (X, Discord, Telegram, etc.) to publish phishing links or other deceptions. Common hacking methods include: SIM card hijacking, third-party application OAuth authorization, defrauding Discord tokens, defrauding Telegram login codes, etc.; - BGP/DNS and other hijacking or intrusion techniques are used to implant malicious code on official websites; - Supply chain attacks implant malicious code on official websites (such as the previous poisoning incident of Ledger module ledgerhq/connect-kit); - Hidden trap contracts (Pixiu plates, arbitrage traps, etc.); - There are authorization loopholes in well-known project contracts; - Buying and selling airdrop tokens or stealing excessive gas from users in the name of canceling authorization; - Forgery events/zero transfers and other deception methods; - Contaminate the wallet's transfer history (the first and last numbers are the same) and wait for users to copy; - Pretend to be reporters, investors, project parties, etc. to trick users into downloading and opening documents, game programs, tools, etc. with Trojans; - Hair trimming tool with back door; - Fake Telegram/WhatsApp/Binance, etc. to replace the wallet address; - The fake wallet directly collects the mnemonic phrase or adds a permission lock to the Tron address and waits for the target to enter the account; - Trick users into filling in tricky data (such as authorization) when transferring money; - Scams such as counterfeit coins, fake official websites, fake official personnel, etc.; - Trick users into directly “providing” their mnemonic phrases; - Clear text mnemonic phrase/private key trap: stealing handling fees or inducing the installation of wallet programs with Trojans; - Online routine similar to "Pig Killing Plate"; - Offline routines such as "wrench attack", "sex lure" and "big business"; - The hardware wallet sales channel is manipulated by middlemen.