ChainCatcher news, according to Cointelegraph, cryptocurrency wallet provider Tangem has faced criticism from users for collecting their recovery phrases due to an application vulnerability. The company confirmed the issue on December 30, stating that the vulnerability stemmed from an error in application log handling, which resulted in users' private keys being recorded and potentially accessible by the support team.Although Tangem has promptly fixed the issue and deleted all related logs, users have expressed dissatisfaction with the company's response, feeling that it has not adequately addressed the situation. Tangem stated that this vulnerability only affected a small number of users and has proactively contacted those impacted. All users are advised to update the application immediately to avoid potential recovery phrase leaks.

ChainCatcher news, according to CoinDesk, a recent report from security company Kaspersky shows that a new type of scam targeting cryptocurrency thieves is becoming popular on YouTube. Scammers disguise themselves as newcomers and "accidentally" share wallet recovery phrases in the comments section, enticing others to attempt to steal USDT worth $8,000 from the wallets.However, these wallets are actually multi-signature wallets, and when the thieves pay TRX as gas fees in an attempt to transfer funds, these TRX are automatically transferred to another wallet controlled by the scammers. Since gas fees on most blockchains are less than $10, this scam primarily targets small-time thieves rather than large-scale operations.

ChainCatcher news, Slow Mist founder Yu Xian stated on social media that using the system's built-in input method is a good habit to reduce the attack surface (of course, if the system input method is found to have risks and is not resolved for a long time, that should also be noted). Additionally, ultra-sensitive information such as mnemonic phrases/private keys should not touch the internet.Previous report, Shen Yu stated on social media that cloud input methods with up to one billion users may have leaked input content. If users have entered mnemonic phrases or other sensitive information through input methods like Baidu, Honor, or Huawei, please take immediate measures to reduce risks.

ChainCatcher message, a user flippen.eth posted on platform X that he stored his mnemonic phrase on the online password management platform LastPass, and overnight lost more than 20 Ethereum from his hot wallet. He stated: "This issue seems to be quite common; if you have ever used LastPass, pay attention to your passwords and abandon the wallet along with the mnemonic phrase stored there."

ChainCatcher news, a Twitter user named HGE.ABC tweeted that the mnemonic phrases of the Bitcoin wallet Xverse are stored in plain text on the hard drive. If a user's computer is infected with a Trojan virus, attackers can easily access the mnemonic phrases. HGE.ABC stated that they have reported this vulnerability to the Xverse team, and the Xverse team is currently investigating. (Source link)

ChainCatcher message, Binance releases the Binance DeFi wallet, which supports features such as no mnemonic, wallet recovery, and more. Currently supports BNB Chain and Ethereum, and will support more chains in the future. (Source link)

ChainCatcher news, NFT GOD (@NFT_GOD) tweeted that in the past 24 hours, due to a hacker breach of his Twitter, Substack, Gmail, Discord, and wallet, he lost all his crypto assets and NFTs, and the hacker posted scam links through the stolen account.NFT GOD stated that the reason for the successful attack by the hacker was that he had previously set up Ledger as a hot wallet instead of a cold wallet on a new device, and the mnemonic was imported into the wallet on a connected computer. Then, yesterday, after downloading the streaming software OBS for gaming live streaming, he clicked on a sponsor link on Google and downloaded malware, allowing the hacker to access his funds. (source link)