One Hack and It's All Gone! A Must-Read for Bitcoin Investors: How to Protect Yourself from Phishing Scams

Hello, this is Bitpunk. Today I'd like to talk about phishing scams, something every Bitcoin investor needs to watch out for.

You can buy Bitcoin or Ethereum at the bottom and HODL, but if you get hacked, it's all over (T.T) When an exchange gets hacked, there's nothing you can do about it (which is why it's better to use a larger exchange: they respond faster to hacks and are more likely to protect customer assets, while most small exchanges simply shut down after a hack). But if your personal account gets hacked, there's no one who will compensate you.

In my view, this is one of the biggest problems with cryptocurrency. If you fall for a phishing scam and your personal information leaks, or your ID and password are exposed, your precious crypto can disappear forever. The reason I'm bringing up phishing scams is that Upbit recently posted a notice warning users that emails impersonating the exchange are being sent out.

The problem is that I myself once won an event and provided similar personal information. Of course, at that time I confirmed with Upbit that I had officially won, and I submitted my personal information on Google Docs through the email I was directed to by text message. Because they said they would deduct taxes and fees, I had to include my ID card, and the phishing scams going around these days follow exactly the same pattern.

And this is an actual phishing email. Doesn't it look like an official email at first glance? The sender's address is event@upbit.co.kr. The body text is neat and tidy too, so it looks like it came from the exchange. The only suspicious part is that it tells you not to cover the back half of your resident registration number when submitting a copy of your ID. Normally, you cover it before sending.

There's no telling whether that file is only harvesting personal information or whether some other malware is planted in it as well. The first step in preventing phishing is simply not to download attachments. If you think about it for a moment, collecting information through attachments like this would mean the exchange has to compile everything one by one, and a large exchange like Upbit would never use such a primitive method. If you receive an email saying you've won an event you weren't expecting, it's best to contact customer support first to confirm.

Not just with events: not opening attachments at all is the basics of security. Also, many people trade crypto on public Wi-Fi without a second thought, but this is quite dangerous. Street Wi-Fi is even worse, and you can get completely cleaned out even through the Wi-Fi offered at places like Starbucks. That's why you absolutely must set up 2FA, such as Google Authenticator. Exchanges that use KakaoTalk, like Upbit, are relatively safer, but there are so many types of attacks, such as SIM swapping and fake apps. Please stay alert to these and keep your funds safe.

This has been Bitpunk.