Connect with us

Coin Market

Coinbase to track off-exchange transactions from Dutch customers

Published

on

Dutch users need to provide the recipient’s full name, the purpose of transfer and full residential address to move digital assets off the platform.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Coin Market

Zero-click attacks: How your wallet can be hacked without a click

Published

on

By

What are zero-click attacks?

Zero-click attacks allow bad actors to access your cryptocurrencies without any input from you.

Imagine opening your crypto wallet one day and discovering that it’s all gone. You didn’t download any viruses or click on suspicious links. The funds just aren’t there. It’s possible you have fallen victim to a zero-click attack.

A zero-click attack is a digital threat that allows hackers to access your wallet without any interaction from you.

While having your wallet hacked without clicking anything sounds impossible, these threats are the latest to watch out for if you want to protect your crypto wallet.

How zero-click attacks work

Zero-click attacks are the latest in an endless variety of crypto wallet hacks.

Typically, hackers gain access to your wallet when you accidentally download malicious software or click on a suspicious link, also known as crypto phishing attacks. 

However, a zero-click crypto attack executes code without any action required by you. This lack of interaction is what makes them so threatening. 

Instead of relying on user error, zero-click attacks access your wallet through flaws in your device’s software, be it a PC or mobile phone. 

Picture a burglar breaking your door not because you forgot to lock it but because they took advantage of a flaw in your door’s manufacturing. Zero-click attacks work similarly but in a virtual environment, often targeting mobile devices.

Did you know? Zero-click attacks aren’t exclusive to crypto. These software-threatening assaults have been around since the early 2000s, initially targeting messaging apps and email clients. Now, they’re how wallets get hacked.

How hackers target wallets with a zero-click attack

Zero-click malware targets you through programming weaknesses.

Here are some common ways zero-click attacks can target you.

Software weaknesses

If your Android phone receives an update with a specific security flaw, a bad actor can exploit that vulnerability by simply texting you a particular set of words. Once you receive the text, it may activate that flaw and give the hacker complete control. From there, they’ll commit a wallet security breach.

Similarly, hackers can target iOS devices through everyday apps like iMessage or Airdrop. In April 2024, Trust Wallet shared “credible intel” of a zero-click attack on iOS devices. The group recommended users with a crypto wallet installed disable iMessage to protect themselves until Apple produces an update. 

While Trust Wallet classified this issue as a zero-day exploit, the company acknowledged that the attack could take over devices without user input, making it a clear example of a zero-click attack.

Network weaknesses

Targeted attacks can breach your wallet software through proximity if you’re connected to a public wi-fi network, like at a coffee shop. The same applies to open Bluetooth connections.

Here’s how it works: open networks transmit your unencrypted data between devices. Hackers can intercept those packets and send malware through them, targeting any devices with a specific software vulnerability.

Any connection to your device — be it wi-fi, Bluetooth, or some other one — is a potential opportunity for a zero-click attack. That’s what makes these attacks so alarming. They can come out of nowhere. One day, a bad actor finds a way to take advantage of your device and exploits it. 

Decentralized application (DApp) weaknesses

Most crypto wallets interact with Web3 apps, also known as DApps. Notably, the barrier to entry for creating a DApp is relatively low, but security measures can vary greatly. 

Even if you’re using a trusted Web3 service, its code can be vulnerable to zero-click attacks anytime. Bad actors can use that weakness, such as an error in the DApp’s smart contract programming, to access your wallet. 

While it can be fun to interact with new DApps, consider using a wallet holding minimal funds. That way, you can test the application while mitigating the damage from a potential zero-click wallet hack.

While attacks caused by such vulnerabilities may seem completely unfair, there are steps you can take to protect yourself.

What if you’ve fallen victim to a zero-click attack?

Suspect you’ve fallen victim to a zero-click attack? Immediately transfer your assets.

If you suspect you’ve fallen victim to a zero-click attack, follow these steps to protect your crypto assets:

Disconnect your device: Disconnect the device from the internet immediately.Transfer assets: Secure your Web3 wallet. Transfer your assets to another device using your wallet’s recovery phrase.Run an anti-virus check: Once your assets are safely stored on an uncompromised device, install anti-virus software to scan for any threats.

Did you know? Zero-click attacks are different from zero-day attacks. Zero-click attacks can happen without interaction, while zero-day attacks require clicking on something or opening a file.

Security best practices to protect against a zero-click attack

Zero-click attacks may be scary, but wallet exploit prevention steps exist to protect yourself.

To protect yourself from zero-click attacks, consider adopting these crypto-security best practices:

Turn off auto-receive: Turn off auto-receive for texts and multimedia in any messaging apps you use.Minimize Bluetooth usage: Keep Bluetooth off when you’re not using it. This step limits access points for some zero-click attacks.Monitor your wallet connection history: Regularly check your wallet connection history. Consider moving your assets to another wallet if you notice transactions with an unknown source.Utilize a hardware wallet: Hardware wallets are USB-like devices that store your cryptocurrencies offline. Since hardware wallets are disconnected, they’re safer from cyber threats like zero-click attacks. This is always one of our top wallet security tips.Use a multisignature wallet: Multisignature crypto wallets require multiple approvals before executing a transaction. This added layer of protection can significantly reduce the risk of unauthorized transactions.Update apps and software: Keep your apps and device software up to date. Updates often introduce new protections and bug fixes that can prevent zero-click attacks.Install anti-virus software: Anti-virus software regularly scans your device for abnormalities, warning you of anything suspicious.

Back up your data: Most devices automatically back up your data regularly. Enable auto-backups to roll back to a previous version if your device is compromised.Tighten up app permissions: Adjust your app permissions to require manual input for activities like wallet transactions. That way, nothing can happen without your input.Two-factor authentication (2FA): Add 2FA to your important log-ins. That way, you’ll be notified if a threat attempts to access your wallet.Use a VPN: VPNs encrypt your internet traffic, making it harder for hackers to intercept your data.Pay attention: Perhaps the most important protection is to pay attention. Browse social media like Reddit for emerging threats, follow credible cybersecurity sources, and take the proper precautions. You can never be too safe.

How to check for a zero-click attack

Zero-click attacks may appear out of nowhere, but there are signs of invasion.

If you’re suspicious of a zero-click attack but aren’t sure, watch out for these signs:

Faster battery drain: If the attack installs malware, your device battery may drain faster. You can check your battery health in your device settings.Slower device performance: Alongside faster battery drain, you may notice your device running slower than usual.Random app installs: Occasionally, zero-click attacks may install apps without your approval. If you notice an app you never installed, be wary.Unknown background processes: If your phone suddenly has new background processes going on, delve a bit deeper. These processes may be the result of a zero-click attack.Increased data usage: You can also check your device’s data usage. If you notice a spike in data consumption, it may be time to run a virus scan.Unusual text messages: If you receive unrecognized text messages or emails, block the sender immediately. 

These attacks may not happen right away but can lie awaiting a specific trigger.

The future of zero-click attacks

Zero-click attacks are hardly a new threat. They’ll continue to evolve just as security processes will.

As crypto technology continues to evolve, so will crypto cybersecurity threats. Crypto wallets operate without a central authority, meaning crypto wallet security falls entirely on you. This autonomy makes crypto wallets a target for hackers, meaning delving into the space comes with risk.

Additionally, as artificial intelligence (AI) becomes more advanced, bad actors may leverage it to develop even more complex zero-click spyware. Future threats could include code that auto-updates after infecting your device, protecting itself from whatever you throw at it. 

Protecting yourself from these threats is more important than ever. You can do so by following cybersecurity experts and blogs and abiding by strong security best practices. The best protection against zero-click or any form of attack is to evolve with them.

Continue Reading

Coin Market

AI and blockchain — A match made in heaven

Published

on

By

Opinion by: Merav Ozair, PhD

Tech moguls cannot stop heralding the artificial intelligence revolution — from Bill Gates to Sundar Pichai to Jensen Huang — signaling that agentic AI and robotics will claim our jobs and act as our autonomous assistants performing on our behalf in our professional and personal lives.

Whether these scenarios happen in a few years or are decades away, we will most likely evolve into that future in some manner, and technology, once again, will reshape our lives. Without the support of blockchain technology, however, it would be quite difficult, and potentially impossible, for agentic AI and robotics to evolve to what its proponents expect them to.

If we expect these services and devices to act autonomously, security, privacy, transparency and accountability will be at the top of our minds. These areas are where blockchain shines and can support AI weaknesses to facilitate the scaling and evolution of this vision. 

Blockchain strengths support AI weaknesses

Blockchain technology can significantly bolster the security of AI models by leveraging its key features such as decentralization, immutability, traceability, smart contracts, data privacy and identity verification. For example, but not limited to:

The decentralization aspect eliminates a single point of attack, increasing the resilience of AI models against breaches. 

The immutability of blockchain ensures that the data used in training AI models and the models themselves cannot be illicitly altered, maintaining the integrity of the models. 

Every alteration or decision made by the AI model can be audibly traced through blockchain, providing unparalleled transparency and accountability. 

Smart contracts automate the enforcement of data access and usage rules, preventing unauthorized or unethical use of AI models. 

Smart contracts can ensure that data is only used for training and testing and by authorized personnel, locking the option to be used for other purposes. Combining these rules with multiparty computation could prevent or at least mitigate AI adversarial attacks. 

Blockchain allows secure multiparty computation, ensuring data privacy during AI model training by keeping the data decentralized. 

Blockchain’s secure identity verification enhances the safety of AI systems by preventing unauthorized access. 

Integrating AI with blockchain can establish a secure, transparent, traceable and decentralized AI environment, protecting our privacy, enhancing accountability and manifesting responsible AI.

Transactions: Programmable AI meets programmable blockchain 

AI agents and robotics are programmable. Smart contacts, the driver of digital assets, are programmable. It makes perfect sense that digital assets would be the preferred payment rail for agent-to-human and agent-to-agent, which includes robotics.

Crypto is an internet-native, programmable money with several advantages for powering the agent-based economy. As AI agents become more autonomous and engage in micro-transactions at scale, crypto’s efficiency, borderless nature and programmability will make it the preferred medium of exchange over traditional fiat rails.

Recent: Sentient open-source AI search outperforms GPT-4o and Perplexity

The true intersection of Web3 and agentic AI for financial transactions could emerge through new tokens and protocols tailored for this use case. These could extend stablecoin capabilities by integrating agent-specific functionalities.

In this scenario, payments could be made using a specialized asset that agents can stake for quality control. Slashing policies could penalize poor performance, while validators could resolve disputes based on task quality.

Additionally, agents’ reputations could be directly tied to their token stakes. Incorporating rules via smart contracts enables users to have control over their autonomous workers/assistants, enabling a shutdown or even a “kill switch,” if necessary, when AI agents start behaving dangerously. 

If Goldman Sachs wants to create AI agents that think and act like a seasoned employee in a highly regulated industry and with imperative risk to financial systems and at the extreme financial markets’ stability, it would be vital, not optional, to have these AI agents controlled by programmable tokens.

While this approach requires advancements in both Web3 and agentic AI, it is not as distant as it may seem.

Blockchain development firm Skyfire recently launched a payment platform that allows AI agents to spend money autonomously. Helmed by former Ripple vice president of products and services Amir Sarhangi, the company’s platform enables a business to give a pre-loaded wallet to an AI agent.

The company’s protocol converts the cash into USDC (USDC). In early March, Skyfire brought its payments network that enables AI agents to make autonomous transactions out of beta.

Using digital assets for robotics, VR devices and agentic AI transactions goes beyond a mode of payment for transactions. It could enhance user experience and security and enable endless business models that have never existed.

It would be interesting to see how it all plays out and whether other companies will follow.

There are risk issues to be addressed, however, and we should be mindful of how they are, at the very least, mitigated. This is where we should carefully consider the security measures discussed previously.

Stepping out of “tunnel vision” to a multifaceted approach

There is a lot of focus on the evolution of AI — generative AI, agentic AI, reasoning models, physical world models and more — all focusing on the premise that AI is the sole technology that we need to achieve AI autonomous agents at scale.

This is quite a tunnel vision approach to how products are built, and it is somewhat myopic: not understanding what needs to be accomplished beyond AI models’ advancement for the ecosystem to evolve and scale.

AI, advanced as it can be, cannot stand on its own and needs the support of blockchain technology — a programmable match made in heaven. Therefore, we must act in a multifaceted approach. We should think about and treat AI and Web3 together in terms of innovation, regulation and infrastructure. This is fundamental to the bedrock of a successful agentic economy.

“Dreams are built with solid foundations,” and the time to build them is now.

Opinion by: Merav Ozair, PhD.

This article is for general information purposes and is not intended to be and should not be taken as legal or investment advice. The views, thoughts, and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.

Continue Reading

Coin Market

Coinbase Institutional files for XRP futures trading with CFTC

Published

on

By

US crypto exchange Coinbase has filed with the US Commodity Futures Trading Commission (CFTC) to launch futures contracts for Ripple’s XRP token.

“We’re excited to announce that Coinbase Derivatives has filed with the CFTC to self-certify XRP futures — bringing a regulated, capital-efficient way to gain exposure to one of the most liquid digital assets,” stated Coinbase Institutional on April 3. 

The firm added that it anticipates the contract going live on April 21.

According to the certification filing, the XRP (XRP) futures contract will be a monthly cash-settled and margined contract trading under the symbol XRL.

The contract tracks XRP’s price and is settled in US dollars. Each contract represents 10,000 XRP, currently worth about $20,000 at $2 per token.

Contracts can be traded for the current month and two months ahead, and trading will be paused as a safety measure if spot XRP prices move more than 10% in an hour. 

“The exchange has spoken with FCMs (Futures Commission Merchants) and market participants who support the decision to launch a XRP contract,” the firm stated. 

Coinbase is not the first to launch XRP futures in the United States. In March, Chicago-based crypto exchange Bitnomial announced the launch of the “first-ever CFTC-regulated XRP futures in the US.” 

XRP futures trading is available on many of the world’s leading centralized crypto exchanges, such as Binance, OKX, Bybit and BitMEX. 

Funding rates remain negative

In late March, Cointelegraph reported that XRP derivatives’ funding rates had flipped negative as investor sentiment turned bearish. 

Related: XRP funding rate flips negative — Will smart traders flip long or short?

Funding rates are periodic payments between traders in perpetual futures markets that help keep the futures price aligned with the spot price. Positive funding rates mean that long traders (buyers) pay short traders, while negative funding rates mean short traders (sellers) pay long traders. 

When funding rates go negative, it means short traders are willing to pay a premium to maintain their positions, indicating strong conviction from bearish derivatives traders. 

XRP funding rates remained negative on major derivatives exchanges as of April 4, according to CoinGlass. 

XRP OI-weighted funding rates. Source: CoinGlass

Magazine: XRP win leaves Ripple a ‘bad actor’ with no crypto legal precedent set

Continue Reading

Trending