MetaMask Redline PDF Spearphishing Email CryptoJordin

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

CryptoJordin on YouTube

YouTuber CryptoJordin was targeted by a spearphishing attack which claimed to be from a representative of Canyon Gaming, a company that specializes in gaming accessories. CryptoJordin was tricked into installing Redline malware via a malicious PDF file. By exploiting a vulnerability which caused the PDF to automatically install malware, the attacker was able to gain access to CryptoJordin's computer and ultimately drain his MetaMask cryptocurrency hot wallet.

About Crypto Jordin

CryptoJordin is from the United States and runs a YouTube channel where he discusses different cryptocurrency projects and news.

About Canyon Gaming

Canyon, founded in the Netherlands in 2003, offers stylish yet affordable accessories and wearables. Canyon promotes individuality, eco-friendliness, and mindful consumption. Their products are designed for young urban individuals who appreciate smart consumption and seek innovation. Canyon encourages users to be themselves, emphasizing that they are cooler than the brands they use and can prioritize what matters to them.

They provide a range of gadgets, including smartwatches for fitness and outdoor activities, USB hubs to extend PC and Mac functionality, and Bluetooth audio devices for high-quality sound and design. They offer charging stations for a clutter-free desktop, power banks for portable device charging, and Canyon Gaming accessories known for their quality, original design, and affordability.

Canyon Gaming offers a range of high-quality PC accessories designed for gamers, including mice and keyboards, headsets that provide an immersive experience for long gaming sessions, gamepads compatible with popular consoles and PCs, and a selection of Sport Battle chairs to suit various budgets, equipped with essential gamer-friendly features. These devices are known for their unique design, extended functionality, and affordability. They are constructed from top-notch materials and designed for ergonomic comfort.

Canyon Gaming peripherals come with extra features such as programmable buttons, onboard memory modules, and a distinct style. The company prioritizes providing an enjoyable user experience and using quality materials that are accessible to the average user. As a result, Canyon Gaming tools are suitable not only for gaming but also for everyday work.

You can find drivers, e-catalogs, news, certificates, and more on their website.

Canyon Gaming Advertising Campaign

Crypto Jordin received an email which claimed to be from Canyon Gaming.

"hi I represent canyon gaming and I'm responsible for launching an advertising campaign to promote new technologies developed by our company"

The Reality

The email received by CryptoJordin was not from Canyon Gaming. It is believed to have originated from a malicious actor known as Mr.Santa. It contained a malicious PDF file with Redline malware.

What Happened

CryptoJordin installed the Redline malware by mistake, and this allowed the attacker to gain access to drain his cryptocurrency hot wallets on his computer.

Key Event Timeline - Crypto Jordin Redline PDF Spearphishing Email

Date	Event	Description
December 1st, 2021 6:30:53 AM MST	Last Avalanche Transaction	The last reported transaction on CryptoJordin's avalanche wallet prior to the malicious transaction.
December 4th, 2021 4:29:00 PM MST	Response To Promotional Offer	CryptoJordin receives an email reporting to be from Canyon Gaming, offering him a potential partnerships with them. He is reportedly able to pick out 3-4 items from a new private catalog in exchange for recording a video about their products. The email requests that he responds if he's interested and they will send him the catalog.
December 4th, 2021 4:55:48 PM MST	KuCoin Withdrawal	A small amount of BSC is withdrawn from the KuCoin hot wallet to CryptoJordin's main wallet address on the Binance smart chain.
December 4th, 2021 4:58:48 PM MST	BUSD Tokens Transferred	In an unrelated transfer, CryptoJordin transfers 396.46602051 BUSD tokens from his MetaMask wallet to another wallet via the Binance Smart Chain.
December 5th, 2021 5:57:00 AM MST	CryptoJordin Email Response	CryptoJordin responds to the email requesting to look at the catalog to say he "would love to see the new collection & create videos".
December 5th, 2021 10:58:00 AM MST	Catalog Email Received	CryptoJordin receives a response which provides the catalog with the "product line" for him to download, and reportedly including a "non-disclosure agreement" to be signed. Upon clicking on the PDF to view it, an installation bar briefly appeared before showing a catalog. The PDF contained a full catalog which also described everything he had to do for the commercial.
December 5th, 2021 12:21:00 PM MST	Transfer In Avalanche	The attacker transfers 0.300561904654125746 Avalanche tokens (AVAX) into CryptoJordin's wallet on the Avalanche blockchain. These Avalanche tokens are likely necessary to cover transaction fees.
December 5th, 2021 12:22:48 PM MST	Time Balance Unstaked	The attacker unstakes CryptoJordin's balance of 0.16149775 TIME.
December 5th, 2021 12:31:49 PM MST	Trader Joe Swap Completed	CryptoJordin's unstaked 0.16149775 TIME balance and 974.24359663155504615 magic internet money (MIM) in his wallet are swapped for 11.519380960436277797 AVAX.
December 5th, 2021 12:34:22 PM MST	Malicious Transaction	The entire 11.811348845090403543 AVAX resulting from the swap are swept from CryptoJordin's wallet.
December 8th, 2021 9:27:37 AM MST	Video About Missing Tokens	CryptoJordin posts a video reporting the missing wonderland tokens. He reports that his TIME wonderland balance has been wiped from his wallet. A few days after he got the malware, CryptoJordin noticed his time balance was gone and wondered if it's a glitch. The malware has full control over his computer, and is still siphoning his personal information and activities during this time.
December 9th, 2021 8:20:49 AM MST	Another Video Uploaded	CryptoJordin uploads his first video explaining the situation and what happened titled "Update on The Hackers Who Wiped My MetaMask Wallet.".
December 11th, 2021 10:09:31 AM MST	Video Detailing Size of Operation	CryptoJordin produces and launches another video with "Shocking Details About My MetaMask Hackers." which goes through how his funds were joined into a wallet with over $31m worth of other funds.
December 11th, 2021 8:37:00 PM MST	Security Expert Discussion	CryptoJordin discusses his situation and the Redline Malware with a cryptocurrency expert, and is advised of the full extent of the risks.
December 12th, 2021 6:08:00 AM MST	Security Expert Discussion	In discussions with the security expert, he asks about any storage of the seed phrase. At that point, CryptoJordin recalls having a screenshot saved on his phone, and it's speculated that the screenshot might have been taken from the phone.
December 12th, 2021 8:55:00 PM MST	Security Expert Discussion	CryptoJordin discusses more about the theft with the security expert. The hacker is revealed as Mr. Santa, a name he uses on many forums where he sells stolen data on. The attack was more of a "malicious virus" and the malware uncovered was called Redline. Multiple Chrome extensions are downloaded, which attempts to capture all the saved passwords from the browser. CryptoJordin was not saving any of his passwords on his browser. The attacker tried to get access to the WiFi, which was replaced by Comcast. There were 3-4 days where his computer was compromised and he didn't know. It was also revealed that he had stored a picture of his seed phrase on his phone. He's very glad to only have the single wallet taken. He wants to bring justice against hackers and references a recent arrest of hackers. The hackers are exploiting information to steal funds and selling information they don't want to less sophisticated scammers/hackers. CryptoJordin gives incorrect information about how the malware could have infected his Ledger.
December 14th, 2021 2:14:07 PM MST	Video Baiting Scammer	CryptoJordin reports on baiting the hacker into sending a malicious PDF with the malware included.
January 1st, 2022 12:56:28 PM MST	Update Video Published	CryptoJordin publishes a video with an update on the incident for his followers on YouTube "There's way more to these MetaMask Hackers...".
January 4th, 2022 11:15:13 AM MST	Another PDF Email Received	CryptoJordin reports on receiving another malicious PDF email in a new video. This email included 3 other YouTubers in the videos. In this video, CryptoJordin reports that he felt something was funny when reviewing the original email, however still clicked the PDF file.
April 4th, 2022 2:49:35 PM MDT	Video About Scam Emails	CryptoJordin posts another video about scam emails. He goes over cooperation business emails which claim to offer him a partnership. He reviews a phishing email from MetaMask which is claiming that his wallet is unverified and needs to be upgraded. He reviews a comment from a fake recovery service. He also indicates that they are currently "in contact with the hackers". Some scammers offering cryptocurrency recovery scams commented on the video and had their comments liked by CryptoJordin.

Technical Analysis

CryptoJordin was tricked into installing Redline malware on his computer, which allowed attackers access to his files and data on his computer. It is believed that his seed phrase was obtained through an image backup which he kept on his computer. Once access to his MetaMask account was obtained, the attackers sent in Avalanche tokens and used those to unstake and withdraw all balances, which were then liquidated. CryptoJordin started his investigation only after noticing that all of his funds had disappeared from his wallet.

Blockchain Transaction Details

Avalanche:

BNB:

Information From Security Researcher

From the video .

"I have identified the attackers alias base on his attack server associated with the malware. Security community refers to the attacker by the name Mr.Santa. This is the username he use on various forums that he sells stolen data on"

"The second stage malware file downloads and installs multiple .crx files (which is the file extension type for chrome browser extensions.) malicious extensions cannot be detected by AV because they do not run at the device system level. Chrome extension run within the chrome application. The way the google has developed chrom prevents AV from inspecting .crx files."

"The chrome extensions installed have very likely captured any bank account details from you device. If you have ever used your pc for personal banking please change your online banking password"

"This malware also tries to discover your active wifi connection. This means the the attacker is trying to discover other devices on your network. So please change the password on you home router as well."

"If you live with your family or house mates or your girlfriend or something please ask them to also change their online banking passwords"

"It is impossible for me to know if the attacker has compromised your wifi router without forensically inspecting the device and I cannot walk you through this process as you do not have the equipment required."

"Absolutely - people aren't security conscious with regular IT, let alone crypto security. Some people have millions of dollars staked with metamask. Its ridiculous."

"Can I also ask, did you store the seed phrase locally? as a text file of screenshot? I just trying to understand the level of info that the REDLINE malware can collect from the metamask application."

"okay interesting. If that screen shot was exfiltrated from your device that is highly likely the way they were able to rebuild your wallet on another device. Since I cant see that the metamask wallet stores the seed phrase"

"Yeah the security community refers to this bad actor as mr.Santa because he uses that username on hacking forums. He sells your pc profile and stolen info after he takes want he wants or what is most valuable. It's very common. Skilled hackers are the apex and they sells to less technical script kiddies that don't know how to hack themselves"

Risks To Hardware Wallet

In a discussion with a security expert, CryptoJordin shows a screenshot which states:

So in cases like your's where you computer was infected with malware - a hardware wallet would not have prevented you from being hacked. Because as soon as you plugged your USB wallet into your infected computer the malware would have copied the .log file... In some cases malware will copy the log file and delte it from the USB so that the victim cannot access the wallet...unless they also wrote the seed phrase down on paper and reimported the wallet into metamask.

While it is certainly possible for an attacker to cause the hardware wallet to not work with that particular PC, and to trick a user into entering their seed phrase or signing a malicious transaction, it's not possible for the PC to damage the hardware wallet.

Total Amount Lost

CryptoJordin shows a screenshot of his wallet, which has a transaction transferring 11.811348845090403543 avalanche tokens. The historic closing market price of avalanche on December 5th, 2021 was $85.79. This makes a total loss of $1,013.30 USD.

A separate transaction the day prior to the exploit for $396.47 BUSD is likely unrelated. While the attacker may have had access to that wallet due to the same compromised private key, this transaction happened just moments after a transfer from KuCoin, which was likely initiated by CryptoJordin, and was also prior to CryptoJordin's original response to the attacker. There is no suggestion of his KuCoin account being compromised. In a video uploaded on December 8th, CryptoJordin says he "lost $400 yesterday from trying to transfer something" which may be related to this transaction. The discrepancy related to the timeline is likely because CryptoJordin took a couple of days to edit his content before sharing it online.

The total amount lost has been estimated at $1,000 USD.

Immediate Reactions

CryptoJordin describes his initial reactions when first encountering the theft in his video.

it got me really worked up and I wanted to make a video on it, but, I also wanted to calm down first before I even thought about making a video, because I didn't want to make an immature video like freaking out and I wanted to get to the bottom of the problem before I actually made a video on it. Because, you know how badly I wanted to jump on here and just freak out and ramble, but I knew it wasn't the right thing. I had to really just calm my thoughts, and just, breathe. But um, basically I went on my wonderland account, to, um, just see how my stake balance was doing, to see how much money it was. I typically check on it like once a week or so, just to see how it's performing. So, I went on and I noticed this 'zero time zero' memo - just a wiped account. So obviously I thought to myself 'Oh I'm not connected to my MetaMask' or 'I'm on the wrong network.' because if you get connected to the Binance network [or] ethereum network it doesn't really work. It'll say you're wrong network. I was connected to the avalanche network. I was on my right account. I was connected. But I did notice that I had no avax and I did have, like point, like something, like I always keep a little bit in here for transactions and stuff.

My $Time Wonderland Balance Was Wiped

CryptoJordin created a video just a few days after his loss, explaining that upon checking his account, he discovered a balance of zero AVAX (Avalanche) and observed suspicious transactions. Despite being connected to the correct network, he found no activity in their account history and realized that someone had accessed their account, unstaked their assets, wiped out their Wonderland balance, and transferred the funds to a different address. He expresses frustration and plans to secure his accounts better, emphasizing the importance of securing assets and suggesting viewers do the same. He concludes by acknowledging personal responsibility for the situation and call for collective learning and education in the crypto space.

"Hey. What is up, guys? It's Jordin. Welcome back to another uh investigation video. To be honest, I haven't got much sleep - probably about four to five hours last night. I've honestly just been stressed about this whole situation."

"Today we investigate who stole crypto from my #MetaMask wallet. This is one of many scams. We will get to the bottom of this. This is far from over... stay tuned"

Ultimate Outcome

CryptoJordin continued to post more videos on his situation as it developed. As he would state, he saw this as part of a broader mission of educating the cryptocurrency space.

"i want to take my mistake and turn it into something positive and allow people to learn from it"

Update on The Hackers Who Wiped My MetaMask Wallet

In this video, CryptoJordin concludes he fell victim to a sophisticated scam involving a fake sponsorship offer. The scam involved receiving an email from a supposed gaming accessories company, offering free products in exchange for creating an advertising video. He details how he clicked a link provided in the email, which led to the installation of malware on his computer via a manipulated PDF catalog, granting the scammers full control of his computer and ultimately his MetaMask wallet. The speaker emphasizes the professionalism of the scam and notes ongoing investigations, including collaboration with a blockchain security engineer at Binance. He promises future updates on the case and urge viewers to prioritize securing their assets. The video serves as a cautionary tale and a call for vigilance within the crypto community.

Shocking Details About My MetaMask Hackers

CryptoJordin provided an update on their investigation into a hacking incident involving their MetaMask wallet. He shares that he's received over 100 messages from others experiencing similar issues. He is currently collaborating with a blockchain security engineer at Binance to gather information about the hackers. Despite the difficulty in tracking funds that haven't reached an exchange, he discovered a chain of transactions indicating greed on the part of the hackers. The investigator identifies multiple exchange accounts associated with the attacker and recommends reporting the wallet to Binance for further investigation. CryptoJordin urges viewers to report identified wallets to exchanges, emphasizing the importance of collective action. He expressed his commitment to continuing the investigation and be a voice for those affected by similar scams. The video ends with an emotional response to the impact of such crimes on people's lives.

We Baited The MetaMask Hacker...

CryptoJordin discusses his heightened anxiety and paranoia. He emphasizes the pervasive fear of online scams and express their struggle to trust even innocent interactions. He updates viewers on their ongoing investigation with the help of a collaborator, revealing that they have detected information about the hacker. He explains the process of baiting the hacker through a decoy email and receiving a PDF file. The file, decrypted using a separate device, provides details about the attacker's operation, including a username "mr santa" associated with selling stolen data. CryptoJordin acknowledges the scale of the hacking group, emphasizing that they target not just individual wallets but also user data. He expresses gratitude to his collaborator and shares stories from other victims, highlighting the need for increased security measures and user protection. He calls for collective action to address the issue, expressing hope for positive change. The video concludes with a plea to share the information and work together to combat scams in the cryptocurrency space.

The PDF Crypto Scam Just Went To A Whole New Level

TBD - YouTube hilariously fails at preparing a transcript for this video.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

CryptoJordin has vowed to continue investigating the scammers.

Individual Prevention Policies

The primary issue was that CryptoJordin was storing his cryptocurrency funds along with a backup of his seed phrase online. He used the same computer to answer emails and perform other uncontrolled activities. This meant that once the device was compromised, all of the funds in his hot wallet were able to be taken. Seed phrases are meant to be stored completely offline, and it is recommended to only ever access cryptocurrency in a heavily controlled environment.

Any time untrusted software is being run is an opportunity for abuse. It is recommended to always interact with cryptocurrency in a fully controlled environment, which is an environment where you have understanding of every piece of software running there. Using a hardware wallet, spare computer with all software wiped, and/or virtual machine with only the needed software greatly reduces your attack surface. Take the time to verify downloaded files come from the correct and expected source and match available hashes if provided. Any time you encounter a new file, always check if it can contain executable code prior to using it.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Increasing the education level for cryptocurrency users can help prevent loss. In the event of loss, an industry insurance fund can assist and provide some relief.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Increasing the education level for cryptocurrency users can help prevent loss. In the event of loss, an industry insurance fund can assist and provide some relief.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.