Symbiotic is undergoing a hack as cybercriminals try to lure its users into connecting their wallets to a phishing website.
Restaking protocol Symbiotic’s X account was taken over by bad hackers on October 5, blockchain security firm PeckShield announced. “@symbioticfi’s X account has been compromised. Do *NOT* click the link until further official announcement,” said PeckShield’s X post.
The protocol’s website relays an official message saying that the account is still accessible to cybercriminals as late as October 7. “WARNING!” reads a message as soon as one visits the Symbiotic website. “Our twitter is compromised, be careful and don`t click any links until further notice.”
Its X account issued a statement mentioning that it is not secure well into October 7. “While not 100% out of the woods yet, we are working on securing the account,” it said, adding, “Do not click on any links in the meantime. A detailed postmortem to follow once we have more details.”
Like with any such posts, fake accounts commented claiming they can help those affected recover their lost funds. Users are cautioned to not fall for such scams.
The original scam promoted a points “checklist” on X, urging users to click a link to find out how many points they accumulated. It looks like anyone visiting that link, whether a Symbiotic user or not, gets thousands of points. The website that link leads to is nowhere related to the staking protocol. Instead, it is a phishing link that requests users to connect their wallets to receive crypto based on the points.
The phishing site also introduces a sense of urgency, asking users to click on a ‘Redeem Points’ button after linking their wallets. Those with crypto in their wallets would likely have their balances drained upon clicking on the button and giving the website additional permissions it asks for beyond that point.
Phishing Scams Take Over
Phishing scams have wreaked havoc this year as $127 million were siphoned away from users just in the third quarter. September alone saw $46 billion drained. Ethereum users were most affected in that period. The trend looks to remain the same in this year’s final quarter as Sybmiotic is an Ethereum-based restaking protocol.
Moreover, like what was exhibited in the Symbiotic hack, most phishing attacks occur via malicious links spread on X, if not Google Ads. Users are requested to verify every link they click and check amply before connecting their wallets to any platform or service.
