Phorpiex a new malicious botnet has been discovered
The crypto clipper changes the recipient addresses when sending cryptocurrency
17.12.2021 - 12:20
731
1 min
0
What’s new? Check Point Research (CPR), a cyberthreat research company, reports a new variant of Phorpiex, a botnet known for spamming, extortion, and cryptocurrency theft. The new variant, dubbed Twizt, has stolen more than $500 000 worth of cryptocurrency in a year.
How does Twizt work? According to CPR, the botnet uses a technique called “cryptocurrency clipping.” The malware replaces the recipient's wallet address with that of the attacker. Twizt operates without active management and control servers, meaning that each infected computer can expand the botnet. Since the botnet uses a peer-to-peer model, it can receive the commands and updates from other devices hosting the virus.
How much did the attackers manage to steal? Between November 2020 and November 2021, Phorpiex bots hijacked 969 transactions. The hackers stole 3,64 BTC, 55,87 ETH, and $55 000 in ERC20 tokens. The largest intercepted transaction was 26 ETH.
Useful material?
Incidents
The company is linking the incident to a compromised private key on a service wallet, rather than a smart contract exploit
May 22, 2026
Incidents
Following the incident, the project temporarily halted trading operations and node activity.
May 15, 2026
Incidents
The user spent weeks unsuccessfully trying to guess the password until Claude helped find an old wallet backup file
May 14, 2026
Crypto regulations
Authorities are introducing mandatory registration for companies handling cross-border crypto transactions
May 8, 2026
Incidents
According to Blockaid, the attack may have been carried out by the same hacker behind the 1inch Fusion V1 exploit.
May 7, 2026
Incidents
The attacker gained administrative access and altered contracts to drain user funds
Apr 30, 2026
Telegram
Twitter