What do you do when your identity is stolen through impersonation and a SIM swap? What if all your emails and social media identities have also been hacked? Would you let it slide? And what if your Binance Account with $50,000 worth of crypto was being hacked by the same hackers who are now siphoning off Bitcoin (BTC) amounts similar to the daily limits linked to your account on the platform?
The above sounds like some extreme science fiction movie from Hollywood such as Will Smith’s Enemy of The State or John Travolta’s Swordfish; but it indeed did happen to one Reddit user known as BeanThe5th only 2 days ago. The quick thinking of the Reddit user has saved not only his identity, but the remaining crypto assets in his Binance wallet.
So how did it all happen?
According to BeanThe5th’s post via Reddit, the following unfolded:
Hello, I have been impersonated and sim swapped, they hacked my emails, twitter, facebook, exchanges, literally everything including binance, which they stole 2 btc (daily limit) from today and will steal more if the account isn’t frozen by tomorrow. They logged in and somehow disabled my google authenticator and I cannot get into my account, microsoft is working on giving me the hacked email back that is related to binance but they say it will take 3 days to escalate the ticket.
The user would later appeal to the r/Cryptocurrency Subreddit community, to upvote his post so it can get the much needed attention of someone at Binance to hopefully have his account frozen:
In 3 days the hackers will have already taken my entire balance so I really need the binance account frozen now before they can steal more. Luckily I was able to freeze all other exchanges I had money on but please upvote guys I really need this resolved. Also if someone from Binance sees this I submitted support tickets under an alternate email but don’t think that will do much and it definitely won’t be answered within a day so please help me out 🙁
The post has since received 1,900 upvotes as well was 630 comments. The comments include reply’s from the Binance team who locked his account, as well as other community members offering their support and ways of resolving not only his Binance account issues, but gaining back his ‘digital’ identity.
The user had been a victim to the common identity theft case of someone calling your regular phone company and pretending to be you. After successfully gaining control of the SIM, the hackers used the SMS one-time-key authentication linking the SIM and the numerous online accounts linked to the phone number.
Another theory postulated by Reddit Users, was that he had been a victim of a session hijacking also known as a cookie hijacking.
A third theory was the common phishing attacks orchestrated through a website with a domain similar to that of Binance. The slight difference in the domain name include spelling (e.g B1nance) or double dots in the ‘i’ in Binance: ï.
One way that has been recommended to avoid phishing attacks that lead to hacks, is not to use search engines to search for you favorite exchange. What will happen, is that one of the sites presented by the search engine might just be a facade for a phishing website with a similar domain name. What will then proceed is a presentation of a false login similar to what you are used to. The hackers will then obtain your login data when you key it in unknowingly.
So how do you protect yourself?
The most logical way is to have a good percentage of your crypto assets in a hardware wallet.
Another manner available in some exchanges such as Binace is listing a few crypto addresses as trusted withdrawal addresses in what is commonly referred to as a Whitelist. Any other attempt to use other addresses will be declined.
Binance has also introduced an Anti-Phishing Code in each user’s Binance account center. By verifying your Anti-Phishing Code, you will be able to prevent phishing attempts from fake emails. All you need to do is successfully set your Anti-Phishing Code. Once complete, all legitimate Binance emails that you receive will contain this exact code.
In summary, the web is rife with dangers for the unknowing crypto-trader. Proper vigilance, diligence and care is needed whenever one wants to access not only crypto-exchanges, but all other websites with sensitive user data.