Many people think that as long as they enter the right URL and download apps from official stores, they can’t get robbed. Two real incidents this week have thoroughly debunked that idea.

1. What happened this week

1) Domain hijacking: From the night of October 30 to the early hours of October 31, the DNS settings for domains belonging to 15 DeFi projects registered with Name.com were changed, including BSC-based token launch platforms Flap, Kintsu, FluxBeam, and StonkFun. Users entered the correct URLs, but were taken to fake websites set up by attackers, which had the Step Drainer crypto-stealing tool embedded in them. Bitquery reported that, in just a few hours, 32 wallets across six chains were robbed of about $200,000—and every transaction was signed by the victims themselves. The projects’ smart contracts were fine; the problem was the “website.”

2) Fake apps in the App Store: An app impersonating Padre, a Solana trading tool, was listed in Apple's App Store. After users imported their private keys, their wallets were drained. On-chain investigator Iris found that since October 25, 27 wallets had been stolen from, for a total of about $23,000. The attackers also swapped $USDC for $SOL to avoid being frozen. The real Padre is web-only and has no mobile app at all. Suspicious apps impersonating tools such as Axiom and GMGN were also discovered during the same period.

Conclusion: An official website or app store doesn't automatically mean something is safe. Your real last line of defense is the few seconds before you press “Sign.”

II. Four checks to make before signing

Step 1: Check what the pop-up is asking for. Normal interactions are usually swaps, mints, or deposits, with amounts that match what you expect. If you see approve / setApprovalForAll / permit / increaseAllowance, and the allowance is “unlimited,” stop and investigate.

Step 2: Check the recipient and contract address. Does the contract address shown in the wallet pop-up match the one published in the project's official documentation or pinned post on X? If not, close it.

Step 3: Be wary when “just logging in” requires a transaction signature. Connecting a wallet doesn't cost anything. If a page asks you to sign a transaction or a string of incomprehensible Permit data to “claim an airdrop” or “verify eligibility,” it's almost certainly a phishing attempt.

Step 4: Check the timing. If the project team suddenly announces that it has “paused use of the front end,” or a security firm issues an alert, don't sign anything—even on a website you use regularly. Following the project's official X account and security accounts such as Blockaid and SlowMist is more useful than any trick.

III. Three rules for downloading apps

1. Only download from an app store by following the link provided on the project's official website. Don't search for the app directly in the store.

2. Check the developer's name, download count, and reviews. If the developer name doesn't match, or someone in the reviews says “I got drained,” delete the app immediately.

3. Never use a trading tool that asks you to “import your private key/seed phrase.” Legitimate trading terminals connect to your wallet; they don't ask for your private key.

IV. What to do if you've already signed

1. Immediately go to revoke.cash or your wallet's built-in approval manager and revoke any suspicious approvals ($BNB on-chain, remember to leave a little BNB for gas).

2. If you entered your private key or seed phrase, consider the wallet compromised: create a new wallet, transfer the remaining assets, and stop using the old wallet.

3. Revoking approvals can only prevent funds from being transferred “in the future”; it can't recover funds that have already been taken. Beware of anyone charging a fee to “help recover your funds”—that's often a second-stage scam.

V. One piece of advice for beginners

Keep large amounts of assets in a wallet used only for storage, where you never sign random transactions. Use a separate small wallet for trading Meme coins, claiming airdrops, and free mints, and only keep in it what you need for that activity. That way, even if you visit a compromised website, your losses are limited.

Many people have been withdrawing and moving funds recently. Before transferring, double-check the first and last four characters of the address. Don't rush.

DYOR. Not investment advice.

#币安陆续恢复多个资产及网络提现服务 #BinanceUpdatesProofOfReservesAddress