Unveiling the Theft of ImToken Wallet
Scammers take advantage of users’ greed to cheat them out of assets. They use a user’s mnemonic or private key to transfer their wallet assets to their own addresses.
To tackle this kind of scam, imToken has enhanced its risk warning during the transfer authorization process. We recommend that you back up your mnemonic and keep it safe.
1. Mnemonic Leakage
IM Token Wallet is a multi-chain digital wallet that provides a variety of features for users. It can be used to manage ETH, BTC and other ERC20 compatible tokens, as well as to receive airdrops, DApps and other blockchain-based assets. It also offers a number of transfer services and news display as well as staking (depositing tokens for a period of time to earn rewards).
Once users create an account on the IM Token Wallet, they are given an Identity name and password,Game blockchain , along with their own public crypto address. They are then asked to back up their mnemonic phrase, which is a string of 12 words that can be used to restore the wallet on another device in the future.
This mnemonic phrase should be stored in a safe place, away from prying eyes. IM Token does not store this information on its servers, so it is the responsibility of each user to protect this.
However, it is important to note that mnemonic phrases are not impervious to hacking attempts. Earlier this year, hackers published several dumps that contained mnemonic phrases, which were then used to hack into Trezor hardware wallets and steal users’ coins. These hacks were detected by security experts using the Argus Continuous Vulnerability Monitoring service from a provider called mnemonic. Fortunately, this vulnerability has now been patched by Microsoft.
2. Unauthorized Access
Unauthorized access refers to when a malicious actor gains entry into a system, network, or endpoint in ways not authorized by the system owner. This is typically described as hacking or breaching, but it can occur in a wide range of ways, from guessing passwords to exploiting vulnerabilities and social engineering schemes. Typically, unauthorized access can be stopped by promptly detecting incidents, locking down access, and shutting out the illegitimate actor.
The security team at imToken proactively detects and responds to all types of scams to protect user assets and wallets, with new improvements continually being implemented. The most important way to minimize the risk of a hack is to never share your private key or seed phrase, and to back up your wallet regularly. The imToken software wallet allows users to maximize security by storing their Mnemonics away from the internet, while the imKey hardware wallet stores them on a secure chip that’s difficult to crack.
Additionally, be careful during transferring through QR codes or links since scammers can use them to obtain your transfer authorization. To help prevent this, the latest version of imToken optimizes the risk warning to show if a DApp is a potential victim of this type of scam. If your tokens are transferred without your consent, please check the balance of all wallets on your device or application, and then create a new wallet and transfer your assets immediately to it.
3. Token Transfer Authorization
While digital asset investment comes with risks, newcomers can improve their security and prevent being cheated by having sufficient knowledge of common scams. They should also make sure to cross-check the mnemonic that they have backup, so they can avoid being cheated due to a compromised mnemonic.
One of the most common ways to lose assets is by granting others transfer authorization without permission. This can happen when users unknowingly provide scammers with their mnemonic or private key, or even their wallet address. They may also have a mistyped address when transferring to a third-party wallet, or they may have accidentally provided their DApp ID to someone.
In some cases, scammers can even access the user’s assets by stealing their login credentials. This is why it is important for users to check their mnemonic and wallet address frequently, especially when they are sending to a new or unfamiliar DApp.
To protect against these types of scams, imToken has added a feature that can be activated by users. This will help warn users of potentially risky DApps by displaying them as red-coloured. In addition, the user can choose to block any DApp they suspect to be suspicious. It is also recommended to use a hardware wallet for better protection on large sums of assets. It is expected that imToken will integrate its own hardware wallet, imKey, in the future to provide more secure cold storage options for users.
4. Asset Transfer
If the mnemonic is compromised, scammers can use it to steal users’ assets. To prevent this from happening, make sure that you save a copy of your mnemonic in another place other than the imToken wallet app. You can do this by saving it in a folder in your phone album, WeChat or memo, sending it through instant messaging tools or saving it in a notebook. Also, never store your mnemonic on any website with unchecked security.
If you notice that your assets are being transferred outside of your imToken wallet, it is probably a sign of an attack. To prevent this, check whether or not you have any tokens left in your old wallet before transferring them to a new one. In the case of an attack, you should create a new wallet on a trusted device and application and transfer all your assets to it ASAP.
To maximize your asset security, imToken Wallet supports hardware wallets, such as the imKey, which can be used to protect private keys and digital assets away from a network connection on a secure chip. For more information, visit the imToken support page. Also, be sure to keep up with the latest version of imToken Wallet to receive the most up-to-date security enhancements. This is especially important since fraud and theft in the blockchain ecosystem are on the rise.