Cybersecurity threats have long been an issue for crypto exchanges and their customers. These attacks often prey on the most vulnerable in our population, especially those with minimal financial or technical expertise. 

But within the past year, attacks from state actors and other hackers have recently become increasingly sophisticated, putting a wider swath of retail and institutional investors at risk. Now more than ever, it’s imperative for investors to remain vigilant and take the necessary steps to safeguard their information.  

“The spike we’ve seen within the past four to six months has been crazy,” Gemini CISO Khaja Ahmed said in a Coindesk webinar presented by Fireblocks. “A spike in two senses–a spike both in the sophistication of these attacks and a spike in the volume… there are concerted attacks at a scale we have never seen before.”

[Ahmed and Fireblocks VP of security and trust Shahar Madar joined Coindesk writer Jeff Wilser for an extended webinar](https://events.coindesk.com/event/-the-state-of-centralized-exchanges-security-18) discussing the scale of these cybersecurity threats, common attack strategies on centralized exchanges, how exchanges can protect customers, and some other security best practices.

Here are three takeaways from the webinar:

### Cyberattacks Are Not Limited to Crypto

The crypto industry has faced significant criticism for being vulnerable to hacking attacks. The largest to date came in 2022 when hackers broke into the Ronin Network and stole roughly $625 million in ether and stablecoin.

But the threat posed by malicious actors is widespread across industries, according to Ahmed. A majority of individuals have already had their personal identifiable information (PII) hacked for simply being part of the current digital economy. 

“Everybody’s PII has been stolen multiple times,” Ahmed said. “Your social security number, your mother maiden’s name, your last five addresses, all have been stolen from Experian, from Equifax, from UnitedHealthcare, from Premera. It’s probably easier to list the companies that haven’t been hacked compared to the companies that have been hacked.”

### AI Is Fueling Cyberattacks, but Security Teams Can Still Win

The use of AI deepfakes and other technologies has made some cyber threats especially difficult to combat. But Madar noted that well-designed software security systems should still be able to thwart attacks in almost every case. Part of the issue is that attackers don’t have to cut through the same red tape as those designing the defense systems. 

Still, you don’t have to be afraid of AI tricking someone into doing something they don’t want to if the security team properly sets up the right systems and protocols.  

“If your network and system architecture does not allow them to do certain things, they will not be able to do it,” Shahar said. “If your architecture is flawed, everyone has production access rights, and they can just execute whatever they want… it doesn’t matter that you can detect deep fakes.”

Ahmed said combating these AI-fueled attacks will ultimately come down to cybersecurity teams getting the authentication, key and credential management/cryptography right, and ensuring that the service infrastructure is resistant to compromise.  

“I think that can mitigate some of the problems,” Ahmed said. “We certainly do that at (Gemini).” 

### It’s Time For the Crypto Industry to Work Together

The number of phishing attacks over the past four to six months has increased significantly. 

Gone are the days of getting a text in broken English asking to wire money to a random account to secure a Nigerian princess. Now, it’s state actors or sophisticated hacking cells running pig butchering scams, account hijacking, and other elaborate schemes to steal crypto.  

That makes it especially important for crypto industry exchanges to work together and with their suite of software partners to identify threats quickly and neutralize them. 

“We need faster signaling on the nature of the attacks as they evolve,” Ahmed said. “So we know what to mitigate… we can probably start anticipating the kinds of attacks and start coming up with mitigation (strategies).”

“It is something that has to happen across the industry," he added. "It involves the underlying platform on which the service is running, it involves application development frameworks. It involves cryptographic libraries… Developing methodologies and tools that can mitigate some of those attacks is going to be super important.” 

Onward and Upward!<br> 
Team Gemini


Gemini CISO Khaja Ahmed Talks Cyberattacks, AI, and Crypto Security Challenges in CoinDesk’s Cybersecurity Webinar 

As cryptocurrencies have gone mainstream, more individuals have had the opportunity to participate in the financial system and build personal wealth. At the same time, scammers have increasingly targeted users with complex scams to rob them of their investments. Recently, scammers have increasingly turned to a scheme known as “pig butchering,” which involves a scammer reaching out and slowly manipulating an unsuspecting individual into transferring them money. 

### What is Pig Butchering? 

Pig butchering is not a ruse confined to the crypto industry.  It occurs when a scammer takes a long-term approach to its target, building trust over a sustained period, often with small talk, feigning a romantic interest or promises of large returns on investments. But the scammer’s aim is always the same: Defraud targets of their assets, whether it is fiat currency or crypto assets. 

Pig butchering is also not confined to any particular demographic or population - anyone can be targeted and fall victim to these scams. The scam is known as "pig butchering" because it backs the idea of fattening up a pig before slaughter. Except in this case, the scammers will leverage social media, dating apps, or text messages, manipulating their targets by appealing to their emotions and eventually causing them to let their guard down. 

After the scammer establishes trust with their target, they will introduce the idea of making some kind of risk-free investment, even offering doctored financial information to assuage any concerns. They will entice the target to share personal banking information and ultimately convince them to transfer large sums of fiat or cryptocurrency. The scammers may even send a small amount of funds to the target to show that their investment is profitable to draw out the scam for as long as possible. Once they have defrauded their target out of their investments, they often simply disappear.   

### How To Spot Pig Butchering Schemes 

__Beware of contact from random people:__ If you receive a phone call, text message, email, or direct message from someone you don’t recognize, put your guard up immediately. Pig butchering scammers will often send a text or random message, then attempt to strike up a conversation over an inane topic to pique your interest. Once you’ve let your guard down, they will strike with a request for personal financial information to make an investment. 

__Beware of the get-rich quick pitch:__ Investing comes with risks, whether it’s investing in the stock market or digital assets. If you ever are in a conversation with someone who offers an investment opportunity without risk, it is most likely too good to be true. Every investment opportunity has upside and downside risks. Beware of any individual who will tell you differently–and simply walk away if they put any pressure on you making a decision quickly.  

__Never Give Away Personal Info or Financial Info:__ This might sound obvious, but when in doubt, avoid giving away your personal or financial information to someone you have met online. This includes your social security number, bank account number, credit or debit card details, or your crypto wallet address. Simply avoiding these pitfalls will ensure you won’t be vulnerable to pig butchering schemes.

Onward and Upward!<br> 
Team Gemini


Learning More About Pig Butchering Scams and How To Avoid Them

- Collaboration between our Customer Support (CS), Trust and Safety (T&S), Threat Detection and Response (TDR), and Application Security (AppSec) teams regularly leads to the identification and takedown of phishing sites.
- We believe that our varied and extensive countermeasures help keep our users protected, and we continuously monitor and adapt to new threats, ensuring our customers' assets remain secure.
- Gemini is committed to helping maintain the integrity, trustworthiness, and resilience of crypto networks, ensuring the foundations remain strong for the future of decentralized innovation.

![Blog Inline 03](//images.ctfassets.net/jg6lo9a2ukvr/6NjikZ3DzdLHZdqBx8G1oG/87208c48dc03f7b455a92a1085b1de34/Blog_Inline_03.png)

At Gemini, ensuring the safety of our customers' assets and personal information is paramount. Since day one, we’ve operated with a security-first mindset, and we continually update our processes to stay ahead of threat actors.

In this blog post, we discuss the methods we used and actions we took against a specific phishing campaign to secure our customers’ crypto and account information, and display how we shared the information we gathered for the benefit of the wider crypto industry.

Collaboration between our Customer Support (CS), Trust and Safety (T&S), Threat Detection and Response (TDR), and Application Security (AppSec) teams regularly leads to the identification and takedown of phishing sites. To better understand attackers’ methods, we conduct investigations from a secure and isolated browsing environment to analyze phishing sites, uncovering valuable insights into their tactics. 

By understanding the broader landscape of ATO attempts, we are better equipped to analyze the specific incident we encountered. Our investigations not only focus on the immediate threat but also contribute to the security community’s knowledge of threat actors, helping to identify patterns, improve control measures, and ultimately enhance our overall security posture.

### Understanding Phishing Campaigns and Account Takeovers

Account takeovers (ATOs) occur when a threat actor gains unauthorized access to a customer’s account through various means, including exploiting vulnerabilities in authentication systems, leveraging misconfigurations, or social engineering. The Cyber Security and Information Security Agency (CISA) describes phishing [as a form of social engineering](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks). Phishing attacks aim to scam users out of personal and confidential information (such as your password or phone number) by abusing trust. 

In most instances, phishing attacks take the form of misleading emails, text messages, or social media posts which can trick people into inadvertently responding with private information, transferring funds to the attacker’s cryptocurrency wallet, or clicking a malicious link which compromises passwords. Attackers often do this by directing a customer to a web page that is designed to look like it is owned by a trusted brand or company (i.e. Gemini). While most phishing attacks now take place online, these attacks can also occur over the phone or via offline communication channels.

### The Phishing Campaign We’re Discussing Today

Today, we shed light on a specific phishing campaign in which threat actors sent Gemini customers emails and texts directing them to a fake Gemini-branded landing page. 

From the fake pages, unsuspecting users would be coerced to divulge their Gemini credentials, and the nefarious actors would then attempt to gain access to the real Gemini accounts, with the ultimate aim of stealing funds.

### Assessing the Tactics, Techniques, and Procedures (TTPs)

When our security team is made aware of an ongoing phishing campaign we gather all relevant information about the threat vector, take every action possible to mitigate potential damage, and get started on identifying and targeting the threat.

Analyzing phishing campaigns is central to protecting users from existing and future threats. To do this, we actively identify the malicious actors' tactics, techniques, and procedures (TTPs), as well as potential security control improvements. Below, we dive into some of the TTPs we identified during our process.

__The Use of Multiple Hosting Providers to Impede Triage Efforts__

While analyzing the sites the malicious emails and texts were directing users to, we determined that there was a landing phishing site and then a secondary harvesting phishing site hosted on different providers. 

The landing sites had assets hosted on the CloudFlare network that linked to the harvesting phishing sites hosted on a separate network, notably azurewebsites.net. Those assets being on CloudFlare meant that tools like urlscan.io weren’t able to crawl the site to the depth needed to identify the harvesting phishing sites. 
![Blog phishing Diagram](//images.ctfassets.net/jg6lo9a2ukvr/1naVVtq5xDBkjFOo1Npbi3/e1f8673fa5d04549c2d9a020e183024d/Blog_phishing_Diagram.png)

The diagram above is a simplified view of the malicious actors redirection. Victims that click on the assets hosted on Cloudflare are redirected from the landing phishing site, primarily hosted on webflow.io, to the harvesting phishing site hosted on azurewebsites.net.

We faced the same issue during our reconnaissance process, where we weren’t able to load the harvesting site in BurpSuite, an application security testing software. We were able to bypass those constraints by configuring FireFox to use BurpSite as a proxy to analyze the traffic more ergonomically. BurpSuite Proxy allowed us to retain all the HTTP that was generated while the browser interacted with the phishing sites and also provided us with the ability to search, highlight, and comment on HTTP requests. 

__Multiple Hosting Providers__

The majority of the phishing sites we reviewed were a subdomain of the following sites. The subdomains were meant to look like they belonged to Gemini Trust Company LLC. For brevity we only include one example of each site.
![Blog phishing Multiple Hosting Providers](//images.ctfassets.net/jg6lo9a2ukvr/W4zgzLkmGgjFAqMON5qHA/bee4a39a331fc4aa63e9e3e8aa65085f/Blog_phishing_Multiple_Hosting_Providers.png)
### Credential Harvesting Tactics

__Use of Email to Transfer Harvested Credentials__

While analyzing the phishing sites hosted on azurewebsites[.]net we discovered a misconfiguration that disclosed the attacker programmatically sending the unsuspecting user’s credentials and phone number from a GMail address to other GMail addresses. Those email addresses are available below:
![Blog phishing Email](//images.ctfassets.net/jg6lo9a2ukvr/EBBH1jqMjjiwvcLanV8Cp/6552e9f548c46181b03dbe5354863dff/Blog_phishing_Email.png)

__Malicious Customer Support Chats__

After the user enters a phone number, the site returns an error message and opens a chat window hosted by LiveChat, at which point the attacker requests further information from the user. During our recon we saw the chat window appear and a support agent frantically requested that we provide them with our credentials. They claimed that they needed our credentials as they were alerted that we weren’t able to log in to our account and would like to unblock us as soon as possible. We reported the following license_ids to LiveChat, which swiftly addressed the issue. 
![Blog phishing Chat Ids](//images.ctfassets.net/jg6lo9a2ukvr/4ZQQQw7BDcsfgnqNwbyNSP/8fe0497782bb8eba1bc6efb2e987dd4a/Blog_phishing_Chat_Ids.png)
### Steps We Took to Secure the Ecosystem

At Gemini, we believe that active participation is a necessary component to securing the crypto cybersecurity ecosystem. By actively engaging in cybersecurity efforts, whether you're a developer, user, or enthusiast, you contribute to the collective defense against these threats. Gemini is committed to helping maintain the integrity, trustworthiness, and resilience of crypto networks, ensuring the foundations remain for the future of decentralized innovation. 

__ZeroFox — Shutting Down Phishing Websites__

In partnership with ZeroFox, a cloud-based cybersecurity company, we shut down over 200 phishing sites while investigating this campaign. This collaboration not only helped take down these sites but also exposed email addresses linked to the attackers, leading to further investigations. 

We collaborated with ZeroFox to share this intelligence and improve the detection of malicious sites. Additionally, we reached out to providers whose infrastructure was exploited for illicit activities. 

### Conclusion

We believe that our varied and extensive countermeasures help keep our users protected, and acknowledge that the battle against threats on the Internet is ongoing. We continuously monitor and adapt to new threats, ensuring our customers' assets remain secure.

Gemini is dedicated to protecting its customers and the cryptocurrency community at large, and implementing new tools to support this goal. Earlier this year we introduced passkeys, which add an extra layer of security to Gemini accounts. [Check out this blog](https://www.gemini.com/blog/passkeys-add-security-feature-to-gemini-account) to get a better understanding of how passkeys work and how they could have protected users who visited phishing sites.

Our proactive measures, collaborative efforts, and continuous vigilance against ATO attempts demonstrate our unwavering commitment to providing a secure trading environment across the crypto industry. As the crypto landscape evolves, so do our security practices, ensuring that Gemini remains a trusted platform. Your security is our priority.

Onward and Upward!

The Gemini Security Team

Gemini Security Team

ARTICLES BY Gemini Security Team

Gemini CISO Khaja Ahmed Talks Cyberattacks, AI, and Crypto Security Challenges in CoinDesk’s Cybersecurity Webinar

Learning More About Pig Butchering Scams and How To Avoid Them

How to Recognize and Dismantle a Phishing Campaign

A simple, secure way to buy and sell cryptocurrency