Connect with us

Crypto

Crypto Scam App Disguised as WalletConnect Steals $70K in Five-Month Campaign

Published

on

Crypto Scam App Disguised as WalletConnect Steals K in Five-Month Campaign

Sep 28, 2024Ravie LakshmananCryptocurrency / Mobile Security

Cybersecurity researchers have discovered a malicious Android app on the Google Play Store that enabled the threat actors behind it to steal approximately $70,000 in cryptocurrency from victims over a period of nearly five months.

The dodgy app, identified by Check Point, masqueraded as the legitimate WalletConnect open-source protocol to trick unsuspecting users into downloading it.

“Fake reviews and consistent branding helped the app achieve over 10,000 downloads by ranking high in search results,” the cybersecurity company said in an analysis, adding it’s the first time a cryptocurrency drainer has exclusively targeted mobile device users.

Over 150 users are estimated to have fallen victim to the scam, although it’s believed that not all users who downloaded the app were impacted by the cryptocurrency drainer.

Advertisement
Cybersecurity

The campaign involved distributing a deceptive app that went by several names such as “Mestox Calculator,” “WalletConnect – DeFi & NFTs,” and “WalletConnect – Airdrop Wallet” (co.median.android.rxqnqb).

While the app is no longer available for download from the official app marketplace, data from SensorTower shows that it was popular in Nigeria, Portugal, and Ukraine, and linked to a developer named UNS LIS.

The developer has also been associated with another Android app called “Uniswap DeFI” (com.lis.uniswapconverter) that remained active on the Play Store for about a month between May and June 2023. It’s currently not known if the app had any malicious functionality.

Crypto Scam App

However, both apps can be downloaded from third-party app store sources, once again highlighting the risks posed by downloading APK files from other marketplaces.

Once installed, the fake WallConnect app is designed to redirect users to a bogus website based on their IP address and User-Agent string, and if so, redirect them a second time to another site that mimics Web3Inbox.

Users who don’t meet the required criteria, including those who visit the URL from a desktop web browser, are taken to a legitimate website to evade detection, effectively allowing the threat actors to bypass the app review process in the Play Store.

Besides taking steps to prevent analysis and debugging, the core component of the malware is a cryptocurrency drainer known as MS Drainer, which prompts users to connect their wallet and sign several transactions to verify their wallet.

Advertisement
Crypto Scam App

The information entered by the victim in each step is transmitted to a command-and-control server (cakeserver[.]online) that, in turn, sends back a response containing instructions to trigger malicious transactions on the device and transfer the funds to a wallet address belonging to the attackers.

“Similar to the theft of native cryptocurrency, the malicious app first tricks the user into signing a transaction in their wallet,” Check Point researchers said.

“Through this transaction, the victim grants permission for the attacker’s address 0xf721d710e7C27323CC0AeE847bA01147b0fb8dBF (the ‘Address’ field in the configuration) to transfer the maximum amount of the specified asset (if allowed by its smart contract).”

In the next step, the tokens from the victim’s wallet are transferred to a different wallet (0xfac247a19Cc49dbA87130336d3fd8dc8b6b944e1) controlled by the attackers.

Cybersecurity

This also means that if the victim does not revoke the permission to withdraw tokens from their wallet, the attackers can keep withdrawing the digital assets as soon as they appear without requiring any further action.

Check Point said it also identified another malicious app exhibiting similar features “Walletconnect | Web3Inbox” (co.median.android.kaebpq) that was previously available on Google Play Store in February 2024. It attracted more than 5,000 downloads.

“This incident highlights the growing sophistication of cybercriminal tactics, particularly in the realm of decentralized finance, where users often rely on third-party tools and protocols to manage their digital assets,” the company noted.

Advertisement

“The malicious app did not rely on traditional attack vectors like permissions or keylogging. Instead, it used smart contracts and deep links to silently drain assets once users were tricked into using the app.”

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Crypto

Ripple and Bitso Expand Stablecoin Settlement on XRP Ledger

Published

on

Ripple and Bitso Expand Stablecoin Settlement on XRP Ledger

Key Takeaways

XRP Ledger Deal Pushes Stablecoins Deeper Into US-Mexico Settlement

Cross-border payments are becoming a major test case for regulated stablecoins. Ripple said on June 9 that Bitso’s MXN-backed stablecoin, MXNB, will be issued on the XRP Ledger and connected to Ripple’s Payments on Decentralized Exchange infrastructure for enterprise settlement.

The expansion targets the U.S.-Mexico corridor, where companies need dependable access to peso and dollar liquidity. Ripple’s RLUSD stablecoin and Bitso’s MXNB are intended to support faster settlement flows for institutions handling cross-border payments between the two markets.

Ripple said:

“As part of the collaboration, Bitso’s regulated MXN-backed stablecoin, MXNB, will be issued on the XRP Ledger (XRPL) and integrated into Ripple’s evolving Payments on Decentralized Exchange ( DEX) infrastructure.”

“Together with RLUSD, Ripple’s enterprise-grade USD stablecoin, MXNB will support more efficient liquidity and settlement flows for enterprise cross-border payments across the U.S.–Mexico corridor,” the crypto firm added.

Silvio Pegado, Ripple’s managing director for Latin America, said the addition of MXNB and RLUSD to XRPL’s Permissioned DEX is intended to create regulated onchain liquidity infrastructure for enterprise payments between dollars and pesos.

XRPL’s Permissioned DEX gives the partnership its institutional focus. The system is designed for verified counterparties, allowing regulated financial participants to use onchain liquidity while operating within a more controlled settlement environment.

Advertisement

MXNB and RLUSD Create a New Dollar-Peso Liquidity Path

MXNB provides Bitso with a peso-native stablecoin built for enterprise settlement needs. RLUSD provides Ripple with a dollar-denominated asset designed to support institutional cross-border payments.

Bitso brings scale to the integration through more than 10 million users and over 2,000 institutional clients. The company operates across Mexico, Brazil, Argentina, Colombia, Chile, Peru, the United States, and Europe.

Pegado noted:

“By bringing together RLUSD and MXNB on the XRPL Permissioned DEX, we’re helping create regulated, onchain liquidity infrastructure purpose-built for enterprise cross-border payments. This is the next evolution of how value moves between dollars and pesos.”

Ben Reid, head of stablecoins at Bitso Business, described MXNB as regulated, peso-native, and built for institutional cross-border payment demands. His comments place the stablecoin within treasury, liquidity, and settlement operations for financial counterparties.

The expansion aligns with Ripple’s broader strategy of connecting traditional payment infrastructure with digital asset liquidity. Ripple and Bitso are using the XRP Ledger to build enterprise settlement infrastructure for one of Latin America’s most active cross-border payment markets.

Advertisement
Continue Reading

Crypto

Two foreigners arrested in Georgia on cryptocurrency money laundering charges

Published

on

Two foreigners arrested in Georgia on cryptocurrency money laundering charges

Georgia arrests alleged cryptocurrency criminals

As part of an international operation in Georgia, law enforcement officers arrested two members of an organised criminal group that investigators say laundered cryptocurrency worth hundreds of millions of US dollars.

At a joint briefing held at Georgia’s Prosecutor General’s Office and attended by representatives of the Prosecutor’s Office, the US Secret Service and Poland’s Central Cybercrime Bureau, Deputy Head of the Investigation Department Beka Kvitsiani said the suspects were foreign nationals. Authorities transferred them to Adjara on 10 June.

According to Kvitsiani, prosecutors in Georgia carried out the large-scale operation with the participation of the US Secret Service, Poland’s Central Cybercrime Bureau, the Łódź Regional Prosecutor’s Office, Georgia’s Interior Ministry Investigation Service and the Ministry of Finance.

Advertisement

During searches, law enforcement officers seized electronic evidence and documents, as well as 173 vehicles, high-value real estate and funds held in bank accounts. Investigators believe the suspects may have used these assets to launder criminal proceeds.

According to prosecutors, the case centres on an organised criminal group operating under the alias AudiA6 since 2022. Investigators say the group provided money-laundering services to cybercriminals and other criminal networks, helping them conceal the origins of illegally obtained cryptocurrency and evade law enforcement scrutiny.

The Prosecutor’s Office said ongoing investigations in several countries have established that members of the group laundered hundreds of millions of dollars between 2022 and 2025.

Crackdown on cryptocurrency mining in Georgia

According to investigators, the group also operated a forum known as Dark2Web, which members used to advertise illegal services and establish contacts between cybercriminals operating in different countries around the world.

Advertisement

Around 100 law enforcement officers from Georgia, Poland and the United States took part in the operation, which received support from Eurojust and Europol.

Georgia’s Prosecutor’s Office thanked its international and domestic partners for their cooperation in the operation and said that combating transnational crime remains one of its key priorities.

Advertisement
Continue Reading

Crypto

Dragonfly’s Rob Hadick Says Stablecoins Could Grow 10x as Payments Adoption Expands

Published

on

Dragonfly’s Rob Hadick Says Stablecoins Could Grow 10x as Payments Adoption Expands

Key Takeaways

Stablecoins and the Fall of Legacy Payments

For years, the stablecoin market has been viewed through the lens of issuance. The most visible winners have been the companies minting the assets, holding reserves, and benefiting from interest income. But Rob Hadick, General Partner at Dragonfly, believes that view is too narrow for where the market is heading.

In Hadick’s view, stablecoins do not simply improve the existing payment system. They compress much of it.

Stablecoins collapse the legacy payment infrastructure and reduce the dependency on intermediaries,” Hadick said. “When you’re a stablecoin native, everything is just a book transfer.”

That shift changes where value accrues. In the traditional payments system, value was spread across banks, card networks, processors, settlement layers, compliance vendors, and middleware providers. Stablecoins make many of those roles less necessary, or at least less defensible.

The result, Hadick argues, is an inversion of the 2010s fintech playbook. During that era, major companies were built by creating connections between software startups and legacy banking payment rails. In the stablecoin era, the opportunity is not simply connecting to those legacy banking payment rails. It is replacing them.

That means in the future, the most valuable businesses may sit at the edges of the system: the companies that own customer distribution, merchant relationships, compliance workflows, banking access, and regulatory infrastructure.

Advertisement

From Reserve Yield to Payments

Within the stablecoin vertical of crypto, stablecoin issuers have been the clearest winners so far. Tether and Circle built large networks, accumulated liquidity, and benefited from high interest rates on reserves, which they haven’t had to pass on to users. That model has proven powerful, especially while rates remain elevated.

But Hadick does not expect reserve yield alone to define the next stage of the market. “Going forward, both have started investing heavily in moving from asset management models to payment models,” he said.

That transition is already visible. Hadick pointed to Tether’s investments in companies and ecosystems such as Whop, Transfi, Rumble, and Plasma, while Circle has launched the Circle Payments Network and Arc. These moves suggest that the largest issuers understand the limits of being purely reserve-backed asset managers. In other words, issuance was the first business model, but it will not be the final one.

The Full Stack Starts to Collapse

One of the largest open questions is what the winning stablecoin companies will actually look like. Will they resemble banks, software platforms, payment networks, protocols, or something else entirely?

Hadick answers that today’s market contains all of the above. But he believes stablecoins create room for a new kind of company that blends several financial functions into one.

Advertisement

Imagine a company issuing its own stablecoin, serving users directly, handling merchant settlement, and performing identity, fraud, and compliance checks on an open ledger. In that world, the need for separate issuing banks, merchant banks, card networks, clearing systems, and settlement intermediaries begins to shrink.

“You don’t need both an issuing and merchant bank,” Hadick said. “You don’t need the card network if the merchant and consumer are already known to the provider. You don’t need the network to facilitate clearing and settlement.”

For Hadick, the winners will not be simple network aggregators sitting in the middle. They will be companies that control the last mile, solve compliance problems, face customers directly, and take real operational responsibility.

Where Retail Investors Can Partake

Hadick remains strongly bullish on stablecoin growth. “ Stablecoins are here to stay,” he said. “I think they’re going to grow tenfold.”

He pointed to an estimate from McKinsey that stablecoins account for roughly 3% of cross-border payments, up from almost nothing a year earlier. Hadick expects that share to continue rising sharply.

Advertisement

As for retail investors, Hadick believes the investment map is not just about who issues the token; it is about who owns the flow.

Overfunded Middleware and Crowded Consumer Fintech

Not every part of the stablecoin market looks equally attractive. Hadick is particularly skeptical of aggregated API (application programming interface) platforms that simply wrap or connect third-party services without taking on compliance or operational risk themselves. These companies may be able to charge high fees today, but Hadick believes their margins are vulnerable.

“They call themselves ‘Plaid for stablecoins,’ forgetting that blockchains already solve many of the original pain points Plaid solved for traditional banking,” he said.

The critique is straightforward. If a company is only aggregating APIs and not owning the customer, compliance layer, liquidity, or operational burden, it may be squeezed as the market matures. To remain valuable, these platforms may need to move closer to the end customer or take on more of the stack.

Hadick also sees risk in consumer fintech. Stablecoin infrastructure makes it easier than ever to launch a neobank or payment app. But that accessibility creates a crowded field.

Advertisement

Established brands such as Nubank, Robinhood, and Revolut can add stablecoin features to existing user bases. That makes it difficult for new consumer startups to stand out unless they offer a clear wedge, strong distribution, or a differentiated regional use case.

Hadick expects failure rates in this category to be high. Still, he does not dismiss the sector entirely. A small number of consumer fintech winners could become large global businesses if they solve real customer problems and use stablecoins as infrastructure rather than branding.

The biggest winners so far may not be the final winners. As the stack collapses, the real value will move toward the companies that own users, flows, compliance, and trust.

Advertisement
Continue Reading
Advertisement

Trending