Gains（GAINS）のニュース

Web3 Security Alert — High-risk Tokens

Overview ● High-risk tokens definition ● The four common types of high-risk tokens and their malicious mechanisms. ● The three layers of security measures implemented by Bitget to ensure the safety of token listings. High-risk tokens refer to cryptocurrencies that are deliberately embedded with malicious mechanisms or hidden "backdoor" codes during their design and issuance. These are implemented by project teams with the intent to exploit investors at an opportune moment, enabling them to reap illicit gains through technical means. On the surface, these tokens may seem indistinguishable from regular ones, often featuring attractive marketing promotions, vibrant community engagement, and initial price surges. However, their smart contracts conceal dangerous mechanisms that can be activated at any time. Common high-risk token types Honeypot token: The "money-in, never-out" trap The honeypot token is sometimes nicknamed the Pixiu token, after a mythical Chinese creature believed to attract wealth but never release it. The metaphor is apt: these tokens are a one-way street — easy to buy, nearly impossible to sell. Imagine stumbling upon a "soon-to-moon" token and eagerly buying in early. Prices go up, and you're ready to take profits. But no matter what you do, every attempt to sell fails. All you can do is watch as your tokens turn into nothing more than worthless numbers on a screen. For example, the token GROKAI had a blacklist function embedded in its smart contract. The token's creator used it to block regular investors' addresses, preventing them from selling their tokens once the function was activated. Inflationary scam tokens: The developer's personal money printer Inflationary scam tokens function like a nonstop "money printer" for the project team. On the surface, these projects often promote attractive claims such as a "fixed supply" or being "non-inflationary." In reality, however, there are hidden backdoors embedded in the smart contract. To the investor, everything appears to be running smoothly: the token supply seems fixed, trading is active, and the price is steadily climbing. Then, at a critical moment, the development team suddenly activates the hidden backdoor, minting a massive number of new tokens. As these tokens are rapidly dumped onto the market, prices crash suddenly, and investors see the value of their holdings wiped out in an instant. For example, the YFII fork project YYFI enabled excessive token minting, crashing the market before the team exited with huge profits. Liquidity rug-pull tokens: Modern-day exit scams The project team first creates a liquidity pool on decentralized exchanges (such as Uniswap or PancakeSwap) and pairs its token with mainstream assets such as ETH or USDT to establish an initial trading environment. As hype builds and investors flood in, the token price rises steadily. Once the pool holds a substantial amount of real assets (ETH, USDT, etc.), the team suddenly removes all liquidity without warning. This is like draining a pond, leaving the fish (investors) stranded without water. Without liquidity support, the token's value can collapse almost instantly, often leaving investors with no chance to sell their holdings and cut losses. For example, in 2021, AnubisDAO amassed nearly $60 million worth of ETH in liquidity on Uniswap. Within 24 hours, the project team withdrew all liquidity, causing the token's value to plummet to zero and leaving investors with heavy losses. Premature unlock scams: Fake lockups, real damage Premature unlock scams are a more subtle form of fraud. Most legitimate projects implement token lockup mechanisms to prevent early investors and team members from selling large quantities too soon, thereby helping to maintain price stability. However, in shady projects, these lockups are often fake. Hidden backdoors in the smart contracts allow insiders to bypass the lock and unlock tokens prematurely. When the price reaches a favorable level, the team dumps tokens that were supposed to be locked, causing the price to crash and leaving regular investors holding the bag. Bitget's security measures In-depth token due diligence: Going beyond the surface At Bitget, we are not easily swayed by flashy marketing or glossy whitepapers. Every token seeking to be listed on our platform is put under our "security microscope" — a comprehensive and rigorous multi-dimensional evaluation system. Our security experts conduct thorough investigations from multiple angles, including: ● Project background checks: We dig deep to verify the origins, professional qualifications, and track records of the token project team. ● Comprehensive tokenomics analysis: A sustainable token requires a healthy tokenomics model. We assess its inflation mechanisms, incentive structures, and long-term viability. ● Valuation and distribution review: We rigorously evaluate the token's Fully Diluted Valuation (FDV) to ensure it aligns with the project's current development stage and market standing. ● Community health assessment: Projects of real value have active and diverse communities. We analyze the distribution of token holders and assess community engagement and participation levels. Dual-layer security audits: Two lines of defense At Bitget, we recognize that smart contract security is paramount to safeguarding digital assets. That's why we have established a dual-layer audit system: ● Professional internal audit: Bitget has a team of experienced blockchain security engineers skilled at identifying smart contract vulnerabilities and attack vectors. Each contract's code is reviewed line by line by our experts to detect potential security risks. ● External audit: Each token contract is also independently audited by leading third-party blockchain security firms with whom we have long-standing partnerships. Their expertise helps uncover even the most hidden threats. This dual-layer approach ensures that if one layer overlooks a security issue, the other can detect and resolve it, giving users the strongest possible security assurance. Real-time on-chain monitoring: A tireless digital guardian Listing a token is not the end. It's the beginning of continuous security monitoring. Bitget's proprietary on-chain monitoring system acts as a tireless digital guardian, protecting user assets around the clock: ● Real-time anomaly detection: Our system continuously monitors all on-chain transactions and analyzes contract interactions in real time. Unusually large transfers, suspicious contract calls, and permission changes are promptly detected. ● Constant evolution: The monitoring system is designed to learn and adapt. It continuously updates its threat models and detection rules to stay responsive to emerging threats. Best practices for users Do your research and thoroughly understand the project Investing in digital assets is like exploring uncharted territories. Thorough research is your most reliable compass. Before putting any money into a project, make sure you've conducted a deep investigation: ● Research the project team: Don't take polished bios or sleek headshots at face value. Dig into the true identities of core team members and verify the accuracy of their claimed experience. Trace their footprint in the blockchain industry and pay close attention to the outcomes of any previous projects they've been involved in. ● Understand the tokenomics: Carefully examine the token's total supply, circulating supply, and the ratio between the two. Review its unlock schedule, and evaluate the token's utility and growth mechanisms to ensure it's more than just a speculative asset with no practical use. Pay attention to smart contract security A project's smart contract code is a critical area that deserves close attention. ● Check for open-source contracts: Use blockchain explorers like Etherscan or BSCScan to verify whether the smart contract is fully open-source. Avoid projects that don't make their code publicly available. ● Use security analysis tools: Leverage specialized token analysis tools such as Token Sniffer or Go+ to scan the contract for vulnerabilities. These tools can automatically detect common risks like unlimited minting access, hidden fees, suspicious permission settings, and other red flags. ● Look for credible audit reports: Prioritize projects that have been audited by reputable third-party security firms. Invest rationally In the tempting and volatile world of digital assets, rational thinking may be the rarest and most valuable asset. Investors should always align their strategies with their personal circumstances: ● Assess your risk tolerance: Your crypto investments should never compromise your quality of life or mental well-being. ● Diversify strategically: Don't put all your eggs in one basket. Spread your investments across different project types, development stages, and blockchain ecosystems to reduce risk. ● Emotional discipline: While short-term market movements are often driven by emotion, long-term value depends on a project's real-world progress. Learn to manage FOMO (fear of missing out) and FUD (fear, uncertainty, and doubt), and stick to a research-driven, long-term investment approach grounded in fundamentals. By following these best practices, you'll not only invest more safely but also grow wiser in the process. In the world of blockchain, smart investors don't just chase returns. They balance financial growth with knowledge and sound risk management. Final thoughts As blockchain technology and the crypto market continue to evolve, the importance of digital asset security has never been greater. In this dynamic landscape of opportunity and risk, Bitget remains steadfast in its commitment to safeguarding user assets, continuously strengthening our comprehensive protection systems to ensure a safer trading experience for all. Related articles: Web3 Security Alert - SMS Spoofing Web3 Security Alert - Payzero Web3 Security Alert - High-risk Tokens Web3 Security Alert - Fake Apps Web3 Security Alert - Malicious Approvals

Web3 Security Alert — Common Asset Theft Scenarios

Overview ● Common situations that can lead to asset loss ● Bitget's protective measures to safeguard user funds Web3 opens the door to financial freedom and groundbreaking innovation, but it also introduces new security risks. This article breaks down the most common ways users fall victim to asset theft, from private key leaks and malicious signature approvals to transfer fraud and other attacks. Here, we share real-world case studies and provide an overview of Bitget's protective measures, aiming to equip users with the knowledge they need to better safeguard their digital assets in the blockchain ecosystem. Seed phrase or private key leaks Stolen by fake wallets Attackers often pose as official team members or admins on platforms like Telegram or Discord. They send phishing emails or share fake wallet download links, often disguised as "security updates" from trusted names like MetaMask or Trust Wallet. Some even run ads on search engines to direct users to phishing sites. Once victims install these fake apps and enter their seed phrases or private keys, the information is immediately sent to servers controlled by the attackers. Stolen from clipboard by malware These malicious apps often appear as harmless tools, such as QR code scanners, file managers, cracked games, crypto price trackers, or airdrop checkers. Once installed, the apps request clipboard access and continuously monitor its contents. If users copy sensitive data like seed phrases or private keys (typically during backup or transfer), these apps instantly capture the information and send it to the attackers' servers. Signature or authorization frauds eth_sign scams eth_sign is a basic Ethereum signing method that allows users to sign arbitrary data. The problem is, users only see an unreadable string of hexadecimal code, so they often have no idea what they're actually signing. Attackers exploit this by tricking users into signing malicious approvals — sometimes even granting full access to their assets. Permit2 signature phishing Permit2, a token approval protocol developed by Uniswap Labs, is secure by design but has been exploited in phishing attacks. Attackers trick users into signing Permit2 authorizations under the guise of wallet verification or airdrop claims. Once signed, the attacker can move the user's tokens without needing any further permissions. Token authorization scams Some malicious websites convince users to grant unlimited authorization for valuable tokens to a smart contract, allowing the site to manipulate their holdings. These sites often pose as legitimate DeFi or NFT platforms, and require user authorization for participation. Attackers create urgency through fake limited-time offers or promotions to lower user defenses. Once authorized, they can withdraw the victim's tokens without further confirmation. NFT authorization scams Some malicious sites prompt users to grant setApprovalForAll permissions on their NFTs. If approved, the attacker gains full control of the user's NFT collection and can transfer assets at any time without further action. Transfer fraud Wallet address hijacking in messaging apps Some attackers distribute tampered versions of messaging apps such as Telegram through unofficial sources. These modified apps contain malicious code that monitors chats and replaces any crypto wallet addresses shared. When users copy a wallet address from a chat to send funds, they may unknowingly send the funds to the attacker's wallet instead. In 2023, over 500 users lost around $8 million in crypto by unknowingly transferring funds via a tampered version of Telegram. Empty transfer phishing Attackers exploit a behavior in the USDT transferFrom function that allows zero-value transfers without requiring the sender's approval. This enables them to initiate TransferFrom operations on active user accounts and flood their transaction history. As some users often copy wallet addresses from their own transaction history, they may accidentally reuse an attacker’s address and send funds to the wrong recipient. According to SlowMist, over $20 million was stolen through this method in the first half of 2022 alone. Bitget's security measures Most assets are stored in cold wallets Most digital assets on Bitget are stored in offline, multi-signature cold wallets. This cautious approach of keeping wallets disconnected from the internet significantly reduces the risk of cyberattacks. Protection fund Bitget maintains a $700 million Protection Fund. If your Bitget account is compromised, or your assets are stolen or lost (excluding losses due to personal actions or transactions), you can apply for a claim through the Bitget Protection Fund. Official verification channel To help users avoid phishing and scams, Bitget offers an official verification channel . You can use it to confirm whether an email, webpage, or social media account is genuinely from Bitget. Security education Bitget regularly shares educational content to raise awareness and help users strengthen their security knowledge and practices. Best practices for users Protecting your seed phrases and private keys ● Never upload your seed phrase or private key to cloud storage without encryption. ● Avoid copying your seed phrase or private key in full to the clipboard, as malware may capture it. ● Only download wallet apps from official sources, and always verify the publisher and software signature. Signature and authorization management ● Never sign anything that you don't fully understand and always review the contents carefully before signing. ● Set a minimum necessary authorization limit for unfamiliar projects instead of granting unlimited access. ● Use authorization management tools (e.g., Revoke.cash) to regularly check and revoke unnecessary authorizations. Safe transfer practices ● Before making any large or important transfers, always test with a small amount. ● Save frequently used wallet addresses in the address book. Final thoughts Protecting digital assets requires joint efforts. While exchanges like Bitget build comprehensive security frameworks, users must also stay vigilant and informed. Traditional finance took centuries to develop secure practices. Similarly, Web3 is still evolving. Each security incident offers valuable lessons. Bitget remains committed to investing in platform security and expanding educational content to help users strengthen their defenses. We believe that the platform and users must work together to create a truly secure and trustworthy Web3 ecosystem, where blockchain innovation can flourish while minimizing risks. Related articles: Web3 Security Alert - SMS Spoofing Web3 Security Alert - Payzero Web3 Security Alert - High-risk Tokens Web3 Security Alert - Fake Apps Web3 Security Alert - Malicious Approvals