Key Points
- David Schwartz has identified a phishing link leading to a wallet recovery phrase.
- The maintenance of SecuX coincides with a continuous stream of complaints regarding application access issues.
- There is currently no confirmed evidence indicating that the infrastructure of SecuX has been compromised.
Former Chief Technology Officer Ripple warns cryptocurrency holders about a suspicious notification related to the SecuX wallet app. This notification directs users to a phishing website, where they are asked to enter a 12-digit or 24-digit recovery phrase.
At the time this warning appeared, hardware wallet providers were undergoing emergency maintenance, which also raised questions from the outside world about the security of their applications.
In a post on October 16th, Schwartz explained that clicking on the notification would cause the wallet app to start normally. However, when he checked the notification history of Android, he found that the relevant link pointed to a forged page that requested users to provide wallet recovery information.
The timing is particularly concerning, as SecuX announced an emergency system upgrade on the same day. Although the company later stated that services had been restored, users continued to report issues accessing their wallets on October 17th.
SecuX Maintenance Raises Questions About Wallet Security
SecuX announced a large-scale system maintenance on October 16, stating that the move was aimed at enhancing the security and stability of the application. The company subsequently stated that normal operations had been restored, but ongoing reports of access difficulties indicate that not all users' issues have been resolved.
A phishing notice coincided with a technical disruption, raising an important yet unanswered question: are there any connections between these two incidents, or did they simply occur at the same time?
Neither the claims from Schwartz nor publicly available information have proven that the servers, wallet software, or notification infrastructure of SecuX have been compromised. The source of this notification has not yet been confirmed, and there is no verified evidence to suggest that this incident led to the theft of cryptocurrencies.
SecuX also reminds users separately that legitimate representatives will never ask for a recovery phrase; a recovery phrase is used to access information related to cryptocurrencies in a wallet.
Why can't hardware wallets prevent every type of phishing attack?
Hardware wallets are designed to protect private keys by isolating sensitive signing operations from connected devices. However, this protection does not prevent users from voluntarily disclosing their recovery phrases to fraudulent websites.
Recovery phrases can be used to restore wallets on compatible devices or applications. Therefore, anyone who obtains these phrases may be able to control the relevant cryptocurrencies without having the original hardware wallet.
This distinction is particularly important, as attackers are increasingly impersonating well-known wallet providers. Previously, scams targeting Ledger and Trezor used physical letters with false verification instructions to trick recipients into disclosing recovery information.
Other attacks make use of personal information obtained from leaks in customer databases. Such information leaks can make hardware wallet phishing more deceptive, without the need to crack the underlying devices.
SecuX supports a variety of cryptocurrencies, including XRP, Bitcoin, and Ethereum. However, the warnings regarding Schwartz do not imply that XRP Ledger has vulnerabilities, nor do they indicate that holders of XRP are the specific targets of this incident.
