Crypto hackers scammed GoDaddy employees to enter crypto sites

Hackers have managed to infiltrate and redirect email & web traffic for various cryptocurrency sites by scamming employees of the largest domain registrar, GoDaddy. Employees of GoDaddy were tricked into passing the ownership over targeted domains to hackers.

‘Our security team investigated and confirmed threat actor activity, including social engineering of a limited number of GoDaddy employees,’ stated by GoDaddy. Adding, ‘As threat actors become increasingly sophisticated and aggressive in their attacks, we are constantly educating employees about new tactics that might be used against them and adopting new security measures to prevent future attacks.’

The latest incident happened around November 13 where cryptocurrency trading platform liquid.com was attacked.

‘A domain hosting provider ‘GoDaddy’ that manages one of our core domain names incorrectly transferred control of the account and domain to a malicious actor,’ said Mike Kayamori, the CEO of Liquid. He added, ‘This gave the actor the ability to change DNS records and in turn, take control of a number of internal email accounts. In due course, the malicious actor was able to partially compromise our infrastructure, and gain access to document storage.’

On November 18, hackers gained access to the crypto mining service NiceHash. The company reported that GoDaddy provided unauthorized access to its domain setting. It resulted in a change of the DNS record of NiceHash’s domain. The company announced that all user information is safe and secure after halting wallet activities for 24 hours.

‘We detected this almost immediately [and] started to mitigate [the] attack,’ NiceHash founder Matjaz Skorjanc announced. He added, ‘Luckily, we fought them off well and they did not gain access to any important service. Nothing was stolen.’

GoDaddy acknowledged the incidents and that a number of their employees fell victim for these scams.

‘We immediately locked down the accounts involved in this incident, reverted any changes that took place to accounts, and assisted affected customers with regaining access to their accounts,’ stated by GoDaddy.

It seemed that several other cryptocurrency platforms were targeted as well. Reports show that sites like Bibox.com, Celsius.network, and Wirex.app are some of the sites that were targeted by hackers. Experts suggest that these scams were able to take place due to the ongoing coronavirus pandemic that resulted in employees working remotely.