ETHEREUM FOUNDATION

DESCRIPTION OF EVENTS

"The Ethereum Foundation(opens in a new tab) (EF) is a non-profit organization dedicated to supporting Ethereum and related technologies.

The EF is not a company, or even a traditional non-profit. Their role is not to control or lead Ethereum, nor are they the only organization that funds critical development of Ethereum-related technologies. The EF is one part of a much larger ecosystem."

"Our vision for Ethereum is the Infinite Garden. Ethereum is more than a technology, it is a diverse ecosystem of individuals and organizations that build and grow alongside a protocol. The Ethereum ecosystem wasn't something that was designed by any one individual or organization, but it organically evolved with the support of people who nurture the ecosystem to become more vibrant and diverse."

"We are proudly bringing the Ethereum community an innovative and secure way to stake with Lido."

"Now, you can earn a remarkable 6.8% APY on your stETH, wETH, or ETH deposits, all while enjoying the peace of minde that comes with best in blass security."

"This collaboration harnesses the strengths of both organizations to deliver deep liquidity and competitive rewards, enhancing your staking experience with over 100+ integrations. Together, we are selling a new standard for decentralized finance, providing a secure, transparent, and resilient protocol that empowers the Ethereum community like never before."

"Protected and Verified by the Ethereum Foundation" "Over 100+ integrations" "Best in-clas ssecurity" "Transparent and Resilient Protocol"

"This is just the beginning. We are committed to delivering a seamless and rewarding experience for all Ethereum users, and we are excited to continue building the future of decentralized finance together."

"Join us in this exciting new chapter of Ethereum's journey."

"In June, a threat actor compromised Ethereum's mailing list provider and sent to over 35,000 addresses a phishing email with a link to a malicious site running a crypto drainer."

"The results of the investigation into the incident involving unauthorized access to the Ethereum Foundation account show that a Google Workspace account was used for the breach. There is no evidence that the SendPulse infrastructure or other users’ accounts were compromised."

"Ethereum says that the threat actor used a combination of their own email address list and an additional 3,759 exported from the platform's blog mailing list. However, only 81 of the exported addresses were previously unknown to the attacker."

"On-chain transaction analysis showed that none of the email recipients fell for the trap during the campaign."

"Ethereum disclosed the incident in a blog post and said that it had no material impact on users."

"it seems like the mailing list provider the EF uses for "updates@ethereum.org" has been compromised. We are currently trying to reach @SendPulseCom to resolve the issue. Please don't click any links sent from that email."

"Ethereum says that its internal security team launched an investigation as soon as possible to identify the attacker, understand the attack's purpose, determine the timeline, and identify the affected parties.

The attacker was quickly blocked from sending more emails and Ethereum took to Twitter to notify the community about the malicious emails, warning everyone not to click the link.

Ethereum also submitted the malicious link to various blocklists, which led to it being blocked by most Web3 wallet providers and Cloudflare."

"Ethereum concludes by saying it has taken additional measures and is migrating some email services to other providers to prevent such an incident from happening again."

"The results of the investigation into the incident involving unauthorized access to the Ethereum Foundation account show that a Google Workspace account was used for the breach. There is no evidence that the SendPulse infrastructure or other users’ accounts were compromised."

Late in the afternoon of June 22nd, an email was sent to 35,794 people, including at least 3,759 email addresses from the Ethereum Foundation's mailing list. The email offered respondents 6.8% APY return from staking in the Lido protocol through a partnership with the Ethereum Foundation. There was no push for urgency or limited time offer in the email, and the Ethereum Foundation notified users of the phishing with a follow up email shortly thereafter. Blockchain analysis shows that no users have fallen for the attack, and no funds were lost.

Rekt - Crypto's Achilles' Heel (Jul 12)
Ethereum Foundation | ethereum.org (Jul 12)
https://ethereum.foundation/ (Jul 12)
https://ethereum.foundation/infinitegarden (Jul 12)
@TimBeiko Twitter (Jul 12)
@SendPulseCom Twitter (Jul 12)
@TimBeiko Twitter (Jul 12)
@fivedogit Twitter (Jul 12)
Ethereum mailing list breach exposes 35,000 to crypto draining attack (Jul 12)

More case studies

MakerDAO Delegate aEthMKR
Pendle USDe Phishing Attack

MetaMax Arrests
Revenue Payouts Stop