Crypto’s most trusted websites are becoming the new playground for attackers.
TL;DR
-
Cointelegraph confirmed its site was compromised by a front-end exploit, pushing a fake “ICO Airdrop” to steal funds.
-
The scam urged users to connect wallets for $5,500 worth of bogus tokens, backed by a fake CertiK audit.
-
It’s the second major phishing attack on a crypto site this week, following CoinMarketCap. Trusted websites are now key targets.
-
CZ warned after back-to-back hacks on CoinMarketCap and Cointelegraph, trusted crypto websites are now prime targets for phishing.
Cointelegraph, one of the largest media outlets in the Web3 space, confirmed that its official website was compromised over the weekend. The method? A front-end exploit, where attackers injected malicious code into the visible part of the site. The result was a fake pop-up banner offering visitors “CoinTelegraph ICO Airdrops” and a fabricated CTG token.
The scam promised users nearly $5,500 worth of tokens for simply connecting their crypto wallets. To make the ruse seem legitimate, the attackers cited a nonexistent CertiK audit, displayed made-up token prices, and used phrases like “fair launch”, familiar language in crypto circles meant to establish credibility. But there were no tokens. No audit. And for anyone who followed the pop-up’s instructions, the likely result was wallet compromise and immediate loss of funds.
Cointelegraph quickly responded on X with a warning:
Part of a Bigger Pattern
This attack came just two days after CoinMarketCap, the popular crypto price aggregator, suffered a similar front-end hack with identical tactics. In both cases, visitors were lured into connecting their wallets with promises of token claims, loyalty rewards, or “early access” deals.
Once a wallet is connected to such malicious sites, hackers can trick users into unknowingly approving transactions that drain their funds.
Even CZ, founder of Binance, flagged the trend, posting on X :
Both incidents signal a troubling trend: attackers are no longer just focusing on DeFi protocols or bridges, they’re going after trusted crypto websites that people visit daily.
How to Stay Safe
These attacks rely on one thing: trust. They exploit the fact that users don’t expect scams on websites like CoinMarketCap or Cointelegraph. But here’s how to protect yourself:
-
Never connect your wallet to pop-ups, especially ones offering tokens, airdrops, or rewards out of the blue.
-
Verify announcements directly from official social channels or blogs before engaging with wallet connections.
-
Use a separate wallet for interacting with unknown dApps or airdrops, keeping your main funds in a cold or hardware wallet.
-
Bookmark official websites to avoid phishing clones.
-
Double-check URLs and pop-ups for strange behavior or spelling errors.
Most importantly: If it feels rushed or “too good to be true,” step back.
Final Thought
Crypto is built on trust but trust should be earned, not assumed. As scammers get smarter, it’s on both platforms and users to stay vigilant. Front-end hacks like these show that even trusted sites aren’t invincible.
Web3 is still building its security standards, but one thing is clear: no website is too big to be hacked. Staying safe in crypto today is just as much about good habits as good technology.
