Case file folder with redacted documents and confidential investigation report.

CASE / DE / DOMAIN

WalletConnect Abuse: Threats & Stats

The Enablers Registry·Editorial mirror·/de/domain/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Gesamtzahl der erfassten Fälle

VT Detected

Last Seen Active

Unavailable at Last Check

VT Ausstehend

HOCH THREAT

Understanding and Combating WalletConnect Abuse

WalletConnect Abuse represents a significant threat, with 1,667 domains detected and 555 currently active. THE ENABLERS REGISTRY has identified top TLDs including .com, .app, and .xyz, and leading registrars such as [REDACTED].

602

Domains Detected

HOCH

Threat Level

How This Attack Works

WalletConnect Abuse involves deceptive tactics to exploit users of cryptocurrency platforms. Understanding these steps can help in prevention.

STEP 1

Creation of Fake Domains

Attackers create fake domains that mimic legitimate cryptocurrency platforms to lure victims.

STEP 2

Deployment of Possibly phishing Pages

Possibly phishing pages are set up on these domains to capture user credentials and wallet information.

STEP 3

Execution of Malicious Code

JavaScript and other scripting languages are used to execute malicious code that intercepts user data.

STEP 4

Unauthorized Transactions

Stolen credentials are used to authorize transactions, draining victims’ wallets.

Technical Analysis

WalletConnect Abuse often involves the creation of possibly phishing sites that mimic popular cryptocurrency service providers. Attackers use sophisticated scripts to manipulate the WalletConnect protocol, intercepting the authentication process. This includes the use of JavaScript to capture private keys and signatures when users attempt to connect their wallets. Infrastructure-wise, attackers frequently utilize content delivery networks like IANA #1910 to host possibly phishing sites, taking advantage of high availability and speed. Additionally, smart contracts are sometimes manipulated to automatically approve transactions that transfer funds to the attacker’s address without the victim's explicit consent.

Real Cases

The [REDACTED] Possibly phishing Incident (2024)

$2 million stolen

A possibly phishing campaign targeting [REDACTED] users resulted in significant financial losses and credential theft.

Vercel App Scam (2023)

$1.5 million stolen

Attackers used fake Vercel app domains to trick users into revealing wallet information, leading to unauthorized access.

Marketplace-Art Fraud (2024)

$3 million stolen

Fraudulent marketplace-art domains were used to deceive users into connecting their wallets, resulting in asset theft.

How to Detect

Unfamiliar domain names mimicking legitimate services

Requests for private keys or seed phrases

Unexpected transaction requests

Poor website design or misspellings

Limited or no HTTPS security

How to Protect Yourself

1 Always verify domain authenticity

2 Enable two-factor authentication

3 Use hardware wallets for transactions

4 Regularly update security software

5 Educate yourself on common possibly phishing tactics

Frequently Asked Questions

What is WalletConnect Abuse?

WalletConnect Abuse involves exploiting the WalletConnect protocol to trick users into revealing their cryptocurrency wallet credentials through possibly phishing tactics.

How much money has been stolen through WalletConnect Abuse?

To date, WalletConnect Abuse has resulted in millions of dollars in losses, with specific incidents causing damages ranging from $1.5 million to $3 million.

How do I protect myself from WalletConnect Abuse?

Verify domain authenticity, use two-factor authentication, and employ hardware wallets for added security against possibly phishing attacks.

What should I do if I'm a victim of WalletConnect Abuse?

Report the incident to your wallet provider, change passwords immediately, and contact local authorities or a cybersecurity expert for assistance.

Data sourced from THE ENABLERS REGISTRY threat intelligence database — 602 domains tracked for this threat type

Missbrauch von Wallet Connect — Threat Intelligence Kit Active Threat

602

Domains

Alive

511

Taken Down

6.4

Avg VT

15.1%

Alive Rate

96.3%

Detected

Since Jul 2025 298 domains with VT ≥ 5

WalletConnect Abuse 602 domains