There are scammers in every industry. From even the most traditional industries, all the way up to cryptocurrencies and the advanced technology on offer by blockchain technology, hackers, exploiters, and bad actors as a whole are always on the lookout for ways through which they can scam someone out of their money.
In the mind of these scammers, it’s more worthwhile to ruin someone’s life and steal potentially hundreds of thousands of dollars from their cryptocurrency wallet than putting that same effort into developing a skill and getting that money through genuine means.
This is why, throughout the past few years, we have seen a plethora of different cryptocurrency wallets. Specifically, MetaMask wallets get hacked, exploited, or just leave users with a bad day.
Keep in mind that a majority of times, this isn’t the fault of the developers behind MetaMask, or the app itself, but due to the fact that the user isn’t careful when browsing the internet while logged into their wallet.
To get this point across in a much deeper way, we will first go over how MetaMask actually works and then look at some historic scams that occurred through its utilization.
Let’s dive in.
How Does MetaMask Work?
To understand how the wallet can be compromised, you need to know how it works first. This will give you a clearer image of what you need to look out for.
MetaMask is one of the leading crypto wallets which aims to be the gateway for Web3 and decentralized finance (DeFi) and has also seen numerous use-cases in non-fungible tokens (NFTs).
In fact, if you have been around the NFT sphere, you might have noticed that the most stolen NFTs all came from MetaMask wallets.
Now, here’s why that’s possible.
MetaMask is an application specifically developed to provide users with a high level of utility in regards to:
- Storing cryptocurrencies
- Trading cryptocurrencies
- Sending cryptocurrencies
This wallet needs to be installed in a user’s browser and is available across:
- Chrome
- Firefox
- Brave
- Edge
Each browser will also feature its own set of security protocols and security features, but they are developed to protect the browser mainly and might not always warn you whenever you might visit a phishing website.
Within the MetaMask wallet, users can store cryptocurrencies created on top of the Ethereum blockchain that follow the ERC-20 token standard.
So a user essentially downloads and then installs the extension on their browser; they create a wallet, create a password, and receive a 12-word seed phrase. And that’s about it; users can now use the wallet and send or receive cryptocurrencies from it.
Now, the issue arises in the fact that once a user logs in with their password, the wallet is open, and they can confirm transactions.
MetaMask holds the private keys within the user’s browser, which is less secure than a hardware wallet or a paper wallet, for example. Overall, they are compromising their security for ease of use.
Most Common MetaMask Scams
Let’s recap a bit. To create a wallet:
- You set up your password.
- The wallet creation screen generates a 12-word seed phrase.
- But every time you use the wallet, all you have to do is use your password.
Now we can go over the types of scams out there.
1. Phishing Scams
Now let’s imagine that you visit an NFT marketplace such as OpenSea, Rarible, or any other one that supports MetaMask. All you need to do here is connect your wallet with this website, and you will be able to confirm the transactions from it afterward.
Once the wallet is set up on the browser, you will only need the password. But, every time you want to set up the wallet on another browser, let’s say you are using Chrome by default, and you want to use it on Firefox, Brave, Microsoft Edge, or Safari, it will prompt you to enter the 12-word seed phrase.
The main scams that occur here are that websites might lead you to believe that they are the authentic MetaMask website or the authentic marketplace, but in fact, they could be clones of the website, with a slight alteration in the website’s URL.
These are what are known as phishing websites, and throughout the past few years specifically, we have seen thousands of cases where people are mistakenly entering their 12-word seed phrases on unauthentic websites.
Google MetaMask, and the first result will typically be an “Ad.”
- The URL address for MetaMask is “metamask.io.”
Now, the fake website could be a slight alteration of this that the average person might not notice. Some examples here might include:
- metaamask.io
- mettamask.io
- Metomask.io
You probably have sort of an idea here of how subtle this is. The idea here is to have someone mistakenly click on a google search result, as this can always be avoided if it is properly written as a URL on the web browser’s search bar directly and not accessed through a search engine.
People would essentially go to these websites, think that they are authentic, enter their 12-word phrases and lose all of their crypto in the process.
2. Bot Messaging Scam
Now, the most advanced scammers will take things further. This example here is by no mean the most advanced scam out there, but it is one level higher than the previous scam.
Let’s say, for example, that you are careful; you do indeed always use “metamask.io.”
You take your security very seriously and, as such, have nothing to worry about. Well, some bad actors, or hackers, would essentially develop live-messaging bots that would target your Twitter account, for example, and send you an automated message that might say the following:
“Your MetaMask wallet has been compromised. Please click on this link and re-enter your 12-word seed phrase in order to recover your account and secure it.”
This is also a scam; nobody from the MetaMask development team will ever, under any circumstance, message you directly asking you for your seed phrase. This is all a scam and should be avoided.
3. Non-Fungible Token (NFT) Scams
Throughout the past few years, we also saw a huge boost in the popularity surrounding NFTs. This has been the target demographic for hackers as a result, as they are literally selling for thousands if not millions of dollars.
Bots are a huge part of crypto hacks, and this hack that we are about to go over goes one step even beyond the previous example. You can think of this as a Level-3 hack, the previous ones being Level-1 and Level-2, just as you would level up in a play-to-earn (P2E) NFT-based games, which has levels, so do scammers have levels on how far they are willing to go in order to scam people out of their crypto.
Typically, NFT communities thrive on Discord channels or even Telegram channels in some cases. Some might even target your email address.
Discord is one of the largest platforms for this due to the fact that there are a lot of automation-based plugins that streamline the whole community-management process.
However, Discord is also “bot heaven,” as there is literally a bot for just about anything.
One of the most recent scams within the crypto space is a bot that might claim it is related to a popular NFT project.
Some of the most popular NFT projects thus far have been CryptoPunks and the Bored Ape Yacht Club (BAYC).
In cases such as these, the bot would get named “cryptopunkbot”, or “boredapebot” and send users messages such as the following example:
“Congratulations! We are celebrating the Anniversary of our project and are planning a cool little event specifically for you! We are giving away X amount of never-before-released NFTs as a part of this celebration, so ensure that you get one by clicking on this link here.”
They will also clone the website completely.
Now, remember, all you need to do in order to buy NFTs is to enter the password, never the 12-word seed phrase.
- Now, let’s assume you visit a website you think is the official CryptoPunks website.
- You enter your password.
- You get a message, “Sorry, there has been a security issue; please enter your 12-word seed phrase!”.
- This would be a huge red flag for you, but if you are unaware of the fact that you are on a phishing website, you will lose all of your cryptocurrencies and NFTs.
This occurs due to the fact that people are always putting their attention on the MetaMask website but not paying as much attention to the website they are visiting.
How To Protect Yourself From MetaMask Scams?
Due to the exponential growth of the cryptocurrency space, there has also been a high level of growth surrounding scams that occur within the space of Decentralized Finance (DeFi).
The next time you visit a website, ensure that you always double-check where you are at.
However, as a rule of thumb, even if you are 100% sure, even if you have a 100% guarantee that you are on the authentic, real website, never, ever enter the 12-word seed phrase while your browser tab is open on that specific website.
The only place that you should ever re-enter your seed phrase is to “metamask.io.”
Bookmark that website, set a notification to remind you to always double-check the URL, and remain as careful as possible.