No Wallet for Old Tricks: Introducing Context-aware Defenses Against Cryptocurrency-based Social Engineering Attacks

Cryptocurrency users routinely fall victim to social engineering attacks. Attackers trick victims into mistakenly authorizing transactions that transfer funds to attacker-controlled wallets rather than the intended recipient. Existing protections against these attacks largely rely on public blocklists, which attackers can easily evade. Official reports and recent measurement studies indicate that such attacks have led to billions of dollars in financial losses that are irreversible due to the immutable nature of blockchain transactions. In this work, we introduce the idea that cryptocurrency wallets can incorporate an additional context-aware, client-side layer of defense. Using this layer, wallets can better protect users from social engineering attacks by tailoring their defense to user’s specific cryptocurrency activity, instead of exclusively relying on global blocklists. To demonstrate this approach, we design and implement detection mechanisms targeting three prevalent attack vectors in the most widely used Ethereum wallet, MetaMask. We show that these mechanisms can be integrated without substantial engineering complexity and incur negligible runtime overhead. We hope that our work encourages wallet providers to consider incorporating them into their existing security workflows.