.jpeg)
Crypto users were recently targeted by a sophisticated wallet-draining scam on CoinMarketCap, a leading cryptocurrency data platform. Attackers exploited a front-end vulnerability, injecting malicious JavaScript to display fake "Verify Wallet" pop-ups. This incident, which prompted swift action from CoinMarketCap and warnings from major crypto wallets, highlights the persistent security challenges in the digital asset space.
CoinMarketCap Confronts Malicious Wallet Scam After Front-End Breach
On June 20, 2025, CoinMarketCap, a prominent cryptocurrency price-tracking website, became the target of a malicious attack. Users reported encountering deceptive "Verify Wallet" pop-ups, designed to trick them into connecting their cryptocurrency wallets and approving transactions, potentially leading to the draining of funds. The incident quickly gained traction on social media, with users like Auri (@Auri_0x) flagging the suspicious activity.
CoinMarketCap responded promptly, issuing a public warning on X (formerly Twitter) advising users not to connect their wallets to the malicious pop-up. Within hours, the platform confirmed that the malicious code had been identified and removed, though an investigation into the breach remains ongoing.
How The Attack Unfolded
According to a technical analysis by blockchain security firm Coinspect Security, the attackers exploited a vulnerability in CoinMarketCap's backend API, specifically within the "doodles" feature. This allowed them to inject malicious JavaScript into the site's front-end via manipulated JSON payloads. The injected code then generated the fake wallet verification pop-ups, mimicking legitimate prompts.
Approving these prompts could have led to the draining of ERC-20 tokens from users' wallets. This type of attack, known as a wallet drainer, is a common phishing tactic in the crypto world, where hackers aim to gain unauthorized access to users' digital assets.
Key Takeaways and User Protection
-
Immediate Response: CoinMarketCap acted swiftly to remove the malicious code and issue warnings to its users.
-
Wallet Warnings: Major crypto wallets like MetaMask and Phantom quickly red-flagged CoinMarketCap's site, with Phantom even labeling it "unsafe to use" temporarily.
-
Phishing Tactic: The attack was a classic phishing scam, aiming to trick users into granting approvals for ERC-20 tokens.
-
Ongoing Investigation: CoinMarketCap is continuing its investigation to strengthen its security measures.
This incident serves as a stark reminder of the importance of cybersecurity vigilance in the cryptocurrency space. Users are advised to:
-
Never connect your wallet to unexpected prompts.
-
Always double-check URLs for HTTPS and authenticity.
-
Consider using a hardware wallet for offline storage of crypto.
-
Regularly revoke suspicious permissions via tools like Etherscan's token approval checker.
This breach is not an isolated event, as the crypto industry has seen a surge in similar attacks. CoinMarketCap itself experienced a data breach in October 2021, resulting in the leak of over 3.1 million user email addresses. As the digital asset landscape evolves, continuous vigilance and robust security practices are paramount for both platforms and individual users.
Sources
-
CoinMarketCap Hacked, Fake Pop-Ups Drain User Wallets, Cyber Kendra.
-
CoinMarketCap has 'identified and removed' malicious wallet scam — TradingView News, TradingView.
-
CoinMarketCap Hack Fixed; Scammers Targeted Users With Fake Wallet Verification, CoinGape.
-
CoinMarketCap suffers from hacker attack, Traders Union.
This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.