Cryptocurrency users are often exposed to various scams. Most of these come in the form of Ponzi schemes, phishing sites, and malware attacks. It appears a new Bittrex phishing site is making inroads these days, which tries to attract users through a phishing email campaign. It is not hard to spot the fake site, but quite a few people may fall for this scam regardless. Always be wary when receiving emails allegedly from exchanges that ask you to visit a site and confirm your identity.
Bittrex Phishing Scam is Quite Problematic
It is not the first nor the last time cryptocurrency exchange users are targeted by phishing emails and cloned websites. The most-often targeted platform in this regard is Blockchain.info, as the company provides a very popular online wallet service for holders of Bitcoin and Ethereum. Users often receive fake emails from people impersonating the company as a way to guide them to a fake website and steal their login credentials. Other exchanges and wallet services have suffered from similar attacks, including the current Bittrex phishing scam.
This new scam is quite interesting, although it is unlikely to be overly successful. Its success hinges on how aware cryptocurrency users are. First of all, Bittrex never sends emails to customers asking them to prevent their accounts from being labeled inactive. Even if one does not visit the exchange for a full year, such emails will never be sent by the company. Whoever is behind this scam thinks people will fall for such a phishing attempt, yet the average cryptocurrency enthusiast should know much better than that.
In the email sent out to Bitrex users — and possibly non-Bittrex users too — the sender asks the recipient to click on a website link. This site redirects to a lookalike of the official Bittrex website, but it is hosted on an entirely different domain. In this case, the website leads to Bittrex.cam rather than Bittrex.com. It is only a minor detail, but not noticing the fake URL could result in people losing a significant part of their cryptocurrency portfolio.
Fortunately, people who use a password manager to generate strong and unique passwords for every platform will immediately notice something does not add up. After all, the password manager only works with the legitimate Bittrex domain. Since this phishing site is a fake website, they will not be able to insert their passwords automatically. That alone is always a solid indication to distinguish between legitimate and phishing platforms. It also shows why more people need to take password security far more seriously than they have done up until now.
The email sent out to users looks pretty fake as well. There are multiple spelling and grammatical errors in the message, indicating this email is not necessarily composed by a native English speaker. The copyright message at the bottom looks incomplete as well, and the header images will not load automatically as the email sender is not trusted nor verified. Indeed, everything about the email looks and feels fake, even though the website to which users are redirected looks genuine enough. That is, until you pay close attention to the address bar in your browser.
Given the recent popularity surge Bittrex has seen, it is not entirely surprising that this exchange would be targeted by phishing attempts. Criminals will always look for new ways to make money, and stealing login credentials from exchange users can be a very lucrative venture. Anyone who uses the Bittrex exchange and receives an email claiming their account is inactive should ignore the message. This is not the last time we will see scam attempts like these.
