Blockchain security company CertiK has reminded the crypto community to stay alert over \u201cice phishing\u201d scams \u2014 a unique type of phishing scam targeting Web3 users<\/a> that was first identified by Microsoft earlier this year.\u00a0<\/p>\n In a Dec. 20 analysis report, CertiK described<\/a> ice phishing scams as an attack that tricks Web3 users into signing permissions that end up allowing a scammer to spend their tokens. <\/p>\n This differs from traditional phishing attacks that attempt to access confidential information such as private keys or passwords, via methods like the fake websites that claim to help FTX investors recover their lost funds<\/a>.<\/p>\n #CertiKSkynetAlert<\/a> <\/p>\n 1\/ Ice phishing is a considerable threat to the Web3 community <\/p>\n Instead of gaining accessing to your private key, scammers trick you into signing permissions to spend your assets.<\/p>\n We\u2019ll outline below what to look out for, and how to protect yourself!<\/p>\n \u2014 CertiK Alert (@CertiKAlert) December 20, 2022<\/a><\/p><\/blockquote>\n A Dec. 17 scam where 14 Bored Apes were stolen<\/a> is an example of an elaborate ice phishing attack. An investor was convinced to sign a transaction request disguised as a film contract, ultimately enabling the scammer to sell all of the user\u2019s Apes to themselves for a negligible amount.<\/p>\n The firm noted that this type of scam was a \u201cconsiderable threat\u201d and found only in the Web3 world, where investors are often required to sign permissions to decentralized finance (DeFi) protocols that could be easily faked. CertiK wrote:<\/p>\n \u201cThe hacker just needs to make a user believe that the malicious address that they are granting approval to is legitimate. Once a user has approved permissions for the scammer to spend tokens, then the assets are at risk of being drained.\u201d<\/p><\/blockquote>\n Once a scammer has gained approval, they are able to transfer assets to an address of their choosing. <\/p>\n To protect themselves from ice phishing, CertiK recommended that investors use a token approval tool and a blockchain explorer site such as Etherscan to revoke permissions for addresses they don\u2019t recognize.<\/p>\n Related: <\/em><\/strong>$4B OneCoin scam co-founder pleads guilty, faces 60 years jail<\/em><\/strong><\/a><\/p>\n Additionally, addresses that users are planning to interact with should be looked up on these blockchain explorers for suspicious activity. In its analysis, CertiK points to an address that was funded by Tornado Cash withdrawals as an example of suspicious activity. <\/p>\n CertiK also suggested that users should only interact with official sites they are able to verify and be particularly wary of social media sites like Twitter, highlighting a fake Optimism Twitter account as an example.<\/p>\n The firm also advised users to take a couple of minutes to check a trusted site such as CoinMarketCap or CoinGecko to be sure that a URL links to a legitimate site. <\/p>\n\n
![](\"https:\/\/s3.cointelegraph.com\/uploads\/2022-12\/abc975c3-41d3-4e45-8db3-595bc3d75f17.png\")
![](\"https:\/\/s3.cointelegraph.com\/uploads\/2022-12\/19a59e5a-0521-4178-8161-e7e2333b4ce7.png\")