On June 23, 2024, one of the most sophisticated phishing attacks in cryptocurrency history targeted the Ethereum Foundation’s official email infrastructure. The breach compromised the [email protected] email account and sent 35,794 scam emails to subscribers, promoting a fake Lido staking offer promising 6.8 percent annual yield. While no victims lost funds in this particular attack, the incident provides critical lessons for every cryptocurrency user about how to identify and avoid phishing scams.
The Basics
Phishing attacks in cryptocurrency work by impersonating trusted organizations to trick victims into revealing sensitive information or approving malicious transactions. The Ethereum Foundation attack was particularly dangerous because the emails came from a genuinely compromised official email address, making them appear completely legitimate. The scam email claimed that the Ethereum Foundation had partnered with LidoDAO to offer 6.8 percent yield on staked ETH, Wrapped Ether (WETH), or stETH deposits, and featured a “Begin Staking” button that directed users to a fake web application styled as a “Staking Launchpad.” When users clicked the “Stake” button within this application, it pushed a transaction to their wallet that, if approved, would have drained their entire wallet balance. Bitcoin was trading at $63,180 and Ethereum at $3,418 at the time, meaning a single mistaken approval could have resulted in losses of tens of thousands of dollars.
Why It Matters
The Ethereum Foundation incident demonstrates that even tech-savvy cryptocurrency users are vulnerable to sophisticated phishing attacks. The same day, June 23, a MakerDAO community member lost $11 million after making several mistaken token approvals, apparently after interacting with a fake web application. Three days later, the Hedera Hashgraph network’s marketing email was also compromised to send scam emails. These incidents are not isolated—they represent a growing trend of targeted phishing campaigns that exploit trusted communication channels. The Ethereum Foundation investigation revealed that the attacker exported 3,759 email addresses from the blog mailing list and uploaded additional addresses that were not on the original subscriber list, meaning even people who had never subscribed to Ethereum Foundation communications could have received the scam emails.
Getting Started Guide
Protecting yourself from crypto phishing requires a systematic approach. First, always verify the sender’s email address by clicking on it to reveal the full address rather than just the display name. In the Ethereum Foundation case, the email came from the legitimate address but was sent by an unauthorized party—a reminder that even genuine addresses can be compromised. Second, never click links in emails that ask you to connect your wallet or approve transactions. Instead, navigate directly to the official website by typing the URL manually. Third, before connecting your wallet to any decentralized application, verify the URL against the project’s official channels on multiple platforms. Fourth, use hardware wallets for significant holdings, as they require physical confirmation of transactions, providing a critical layer of protection against phishing-induced wallet drains. Fifth, enable anti-phishing codes when available—many exchanges and platforms offer this feature that displays a custom word or phrase in legitimate communications, making it easier to spot fakes.
Common Pitfalls
Crypto users frequently fall victim to phishing through several common mistakes. Many victims skip reading the actual transaction details before approving wallet connections, blindly clicking “Approve” without understanding what permissions they are granting. The fake Lido staking interface in the Ethereum Foundation attack pushed a seemingly simple staking transaction that actually granted the attacker unlimited spending approval. Another common pitfall is trusting links shared in community channels like Discord or Telegram, where attackers impersonate team members or create convincing fake announcements. Users also frequently reuse passwords across multiple platforms, allowing a breach of one service to compromise others. Finally, urgency tactics—claims that an offer is time-limited or that immediate action is required—pressure victims into acting without proper verification.
Next Steps
To strengthen your phishing defenses immediately, start by auditing all your active wallet connections. Use tools like Revoke.cash to review and revoke unnecessary token approvals that could be exploited by malicious contracts. Set up a dedicated email address exclusively for cryptocurrency accounts, and use a password manager to generate and store unique passwords for each service. Consider using a dedicated browser profile for crypto activities to prevent cross-site tracking and reduce the attack surface. Stay informed about current phishing techniques by following security researchers and blockchain investigators on social media. The Ethereum Foundation quickly coordinated with blacklist providers, Web3 wallet developers, and Cloudflare to block the malicious domain after the attack was discovered—a response that protected many users but could not reach everyone. Your personal security practices are the final and most important line of defense.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
35,794 scam emails from an actual ethereum foundation address. if that does not scare you nothing will
35,794 scam emails from the actual ethereum foundation address and they say no one lost funds. pure luck, not security
6.8% yield on staking through a fake Lido page is actually a plausible rate which makes it even more dangerous
^ exactly. the yield was realistic enough that even experienced users might have clicked. that is what makes this different from obvious scams
6.8% on stETH is so close to real yields that even degens would pause before checking the URL. the sophistication is what makes these dangerous
the 6.8% figure being realistic is what scares me. if the yield was obviously fake like 50% no one would click. attackers are getting better at calibration
No one lost funds this time but next time they will not be so lucky. The foundation needs hardware 2FA on every email account.
35K emails sent before anyone noticed. email providers need real-time content scanning for crypto scam patterns. would have flagged the Lido branding instantly