Accounts from the CEO of Binance, Gemini Exchange and the Binance Exchange itself have started tweeting about CryptoForHealth with pinned tweets — using the same message template across multiple tweets. This immediately raised the suspicions of many cryptocurrency community members, with some urging to report the tweets to Jack Dorsey and Twitter directly. Originally posted by Coindesk and Coinbase as well, the tweets have since been removed in the former’s case and a new article has come out about prominent Twitter accounts being hacked and taken over for this scheme.
Pinned tweet placed by the likely hackers/scammers on CZ’s profile timeline.
Metamask, the Ethereum-based wallet and Web3 extension interface, has flagged the domain as a possible phishing instance. The cryptoforhealth.com domain itself seems to be registered to a private individual in the United States with little to no public relationships with any of the major cryptocurrency exchanges and which had been requesting funds from members of the cryptocurrency community.
Andreas M. Antonopoulos, the author of Mastering Bitcoin, speculated that this wave of attacks was likely due to to a third-party application the accounts used to manage Tweets that had access to the Twitter API as a fully credentialed user. For most cryptocurrency community members, especially those affected by SIM swapping attacks, the use of strong, random passwords and two-factor authentication that depends on Time-Based One Time passwords (TOTP for short) should be natural. Yet with many prominent attacks now failing to this new attack, it’s time to examine what may have went wrong here.
For now, while more details are forthcoming, it’s important to inspect and carefully avoid these set of tweets and “Crypto For Health”, no matter which influencers tweet about it and to consider the role of self-custody of keys and trust that come inherent with the cryptocurrency community.
In a sense, the exchanges that help people onboard onto cryptocurrency and the influencers and media outlets that write about it are delegated an heightened amount of trust. Yet, the same rules that apply to custody should apply here as well: everybody in the cryptocurrency community should have a very high incentive to ensure that keys and accounts that they control remain under their control. Hopefully, this is a reminder that trust must be verified every once in a while, and a lesson for all of us in the cryptocurrency community about the importance of security.