Under the mask of security: how not to lose cryptocurrency during “risk checking”

A new, sophisticated way to steal cryptocurrencies has surfaced online and is being promoted under the guise of “risk checking.” GetBlock AML Research explains the details of yet another fraudulent scam.

Scam as a service

Information about the Signature Checker service (http://signature[.]land), which supposedly can be used to check the security of one’s crypto wallet, has been circulating on social networks. The tool is designed to check the wallet for phishing signatures, with the help of which attackers can gain access to the wallet.

Signature Checker home page

The essence of the scam was that to clean the wallet from phishing signatures, it was necessary to enter into a special field a private key of the wallet, which should never be transferred to other persons. The service was designed in the style of another popular security checker — Revoke.

Signature Checker’s warning about the dangers of phishing

If you enter any address in the Signature Checker field, a phishing warning will be displayed. This is how scammers encourage potential victims to use their service to prevent hacking and enter a private wallet key. Once the private key is entered, it is transmitted to the attackers via email.

The Signature Checker code that transmits the data to the email

How not to fall for a new type of scam

Attackers often pose as security experts. One of the accounts used to spread Signature Checker was an X account that published information about cryptocurrency security from 2024. It had more than 70 000 users subscribed to it. At this point, the account has been deleted.

An attempt to convince users to use Signature Checker

From this account, potential victims received a warning that their address was at risk. Data from the malicious Signature Checker service was cited as evidence. The fake security expert distributed detailed instructions on how to use Signature Checker to clear phishing signatures from your wallet. He was even willing to provide additional advice on Telegram or Discord.

Offer of “help” from the attacker