Skip links
Ice Phishing Attacks on the Rise

The Rise of Ice Phishing Attacks: What Businesses Need to Know.

Ice Phishing attacks have been on the rise, with cybercriminals becoming increasingly sophisticated in their methods. It is one of the latest and most dangerous types of phishing attacks known in the Cryptocurrency space. This type of phishing is of utmost concern because it is difficult to detect and can cause significant harm to both individuals and businesses.

Therefore, in this article, we’ll discuss what ice phishing is, how it works, and what you need to know as a business owner to protect yourself and your employees.

Ice Phishing Attack is on the rise
Ice Phishing Attack on the rise.

Before we continue, let’s look at the meaning of the term, “phishing” in cryptocurrency.

Phishing is a type of cybersecurity attack that involves malicious actors sending messages while posing as a reliable individual or organization.

What is Ice Phishing?

Having described what phishing is, here comes the big question: What then is ice phishing?

Ice phishing is a type of attack that requires a user to ignorantly sign permissions to allow a malicious actor to spend the user’s tokens. This makes it a threat to Web 3 investors because they need to grant permissions to interact with DeFi protocols.

Hence, Ice phishing is a blockchain-based or a Web 3 attack. However, the immutable and open blockchain enables post-attack observation and analysis of Ice phishing attack, allowing for financial evaluation of attacks.

In this unique type of phishing attack, also called Crypto-ice phishing, scammers target Web 3 users. So, instead of gaining access to your private key, as seen in the regular traditional phishing, the scammer dupes you into signing permissions to spend your assets.

How Does Ice Phishing Work?

Ice phishing is conducted differently from the conventional and well-known phishing attempts, which work by sending SMS and emails to target victims. In Ice phishing scam, the hacker only needs to convince you that the malicious address you are giving permission to is genuine. Your assets are then vulnerable to being drained once you have given the scammer authorization to spend your tokens.

In other words, ice phishing is successfully done when a victim is tricked into signing a transaction that transfers authority over his tokens to the fraudster. So, instead of the hacker/scammer breaking the door open, he relies on you to open it for him by tricking you into “blind signing”.’

Ice Phishing Occurs in Two Stages:

  1. The victim is tricked into approving an EOA or a malicious contract so as to spend tokens from the victim’s wallet.
  2. The next step is to transfer the victim’s tokens to the address chosen by the scammer through a ‘Transfer From’ transaction initiated by the scammer’s address.

Hence, this type of phishing scam consists of at least two wallets:

– The phishing address and

– The recipient.

This can be seen in the Phishing Attack Flow Illustrated below by Certik.

Ice Phishing Attack Illustrated by Certik

Source: Certik

Ice Phishing Led to the Badger DAO Attack

In December 2020, the Badger DeFi protocol — which enables interest on Bitcoin deposits — was introduced on the Ethereum mainnet. Customers deposit wrapped Bitcoin into vaults, which generate returns using different yield farming techniques. However, on December 1st, 2021 the protocol suffered an Ice Phishing attack

Ice phishing is so dangerous because it doesn’t involve directly stealing one’s private keys. This implies that changing the spender’s address to the attacker’s address is all that is required in this type of phishing attack. As the user interface doesn’t display all relevant information that can demonstrate that the transaction has been altered with, this can be highly successful.

In the case of the Badger DAO attack, the attacker got access to the funds after the permission transaction had been signed, submitted, and mined. Also, In the event of a “ice phishing” attack, the perpetrator can slowly build up approvals before rapidly draining the wallets of every victim. Hence, the attacker was able to accumulate approvals over a period of time and then drained all the victim’s wallets quickly.

The Badger DAO attack enabled the attacker to drain about $120 million in November-December 2021. As a result, Microsoft admonished Web3 users to be security conscious, stating that ‘The Badger DAO’ attack highlights the need to build security into Web3 while it is still in its early stages of evolution and adoption.

Ice Phishing Attack Led to the Bored Ape Scam

An extensive ice phishing scam that happened on December 17 resulted in the theft of 14 Bored Apes. An investor was persuaded to sign a transaction request presented as a movie contract, which gave the con artist the opportunity to buy all of the user’s apes for nothing.

According to a twitter thread published by a cybersecurity expert going by the handle Serpent, He described how a fraudster reportedly obtained 14 Bored Ape Yacht Club (BAYC) non fungible tokens (NFTs) through a month-long social engineering scheme.

The scammers offered a bid for the NFTs and directed the victim to a fake NFT platform where they were asked to “sign the contract,” which is where the wallet drain occurred. They did this by using a fake website, fake pitches, legal contracts, and other elaborate deception, including Twitter Spaces, to give them the appearance of legitimacy.

How to Identify Ice Phishing Attacks

The awareness that has been created on traditional phishing attacks done through emails has made it a bit difficult for crypto users to fall prey to phishing attacks associated with email accounts.

However, different tactics have been created by scammers in order to reach and trick cryptocurrency users into signing up malicious sites and giving up their private keys. According to Microsoft, these include:

  1. Looking out for people asking for assistance with their wallet software on social media and then sending them direct messages in an effort to obtain their private key.
  2. Giving out free fresh tokens to a group of accounts (also known as “Airdrop” tokens), and then rejecting transactions on those tokens with an error message that directs users to a phishing website or one that downloads coin mining plugins that steal your login information from your local device.
  3. Copying and impersonating real smart contract front ends.
  4. Faking wallet software and directly stealing private keys.

How Can You Protect Your Business Against Phishing Attacks?

As a business or cryptocurrency exchange, hackers might make attempt to steal login credentials from employees. This could be used to access your company’s systems and initiate unauthorized transactions on your cryptocurrency exchange.

There are several steps that businesses can take to protect themselves against phishing attacks. These include:

Protect Your Business From Ice Phishing Attacks
  1. Employee Education: As a Business owner, train and educate your employees on the dangers of ice phishing and how to recognize and avoid this type of attack. This includes training on how to identify suspicious links, the importance of not clicking on them or downloading attachments from unknown sources, and the consequences of falling for this scam.
  2. Update Security Measures: Regularly review and update your security measures to ensure that they are up-to-date and effective.
  3. Backup Data: As a Business owner, regularly backup your data to ensure that you can quickly restore it in the event of a cyberattack. This includes backing up important files, such as financial records, customer data, and confidential business information.
  4. Use two-factor autentication to protect login credentials.
  5. Work with a Managed Service Provider: Businesses may also want to consider working with a managed service provider (MSP). An MSP can provide expert guidance on the best security measures for a business, as well as ongoing monitoring and support to help protect against cyberattacks. Also, you can consult with cybersecurity service providers like A&D Forensics.

Lastly, the tech giant Microsoft, advised software developers to increase the security usability of Web3, stating the need for end users to explicitly verify information through additional resources, such as reviewing the project’s documentation and external reputation/informational websites.


The ‘ice phishing’ attack in late 2021 is just one example of the threats affecting blockchain technology. Since then, many more hacks have occurred that have impacted blockchain projects and users. This is evident in the Bored Ape Scam as discussed in this article.

Hence, ice phishing attacks are a serious threat to businesses, and you must take the necessary steps to reduce the risk of falling victim to these attacks. In addition, it is important to stay informed and updated on the latest cybersecurity trends and threats, as it’s crucial to protect your business from cyber-attacks.

At A&D Forensics, we understand the importance of protecting your business from cyber threats, and our team of experts is dedicated to providing tailored solutions to meet the unique needs of your organization.

Contact us today to learn more about our solutions and how we can help you stay secure in the ever-evolving digital landscape.

Contributor: Tochi Ezeama

This website uses cookies to improve your web experience.
On-Site Certified Cryptocurrency Investigator (CCI) Training

Learn how cryptocurrency related transactions, crimes are tracked, traced and prosecuted.

Certified Cryptocurrency Investigator Virtual Training

Learn how cryptocurrency related transactions, crimes are tracked, traced and prosecuted.


Learn how compliance could be a competitive advantage to your exchanges with all your AML, CTF, KYC and OFAC requirements.

By becoming an early bird for each cohort or leveraging our partner firms, you can obtain up to a 25% discount, contact us for more details.

Smart Contract Audit

To speak to us regarding Smart Contract Audit, please fill the form below. We will make every attempt to respond to you as soon as possible

Call Direct: +2348036180089 | +2349095503040

Get in touch

To speak with us as regards our services, to make comments and ask questions, please fill the form below. We will reply as soon as possible.

Call Direct: +2348036180089 | +2349095503040


Chioma Onyekelu is a highly skilled and accomplished professional in the field of cryptocurrency and blockchain technology. She is a Certified Cryptocurrency Investigator and Crypto Compliance Specialist, as well as a Blockchain Forensic Specialist and a teacher. She is also a public speaker and her teachings include consultations and practical solutions for African Start-ups on the best and most cost-effective way to build with compliance in mind. With a wealth of knowledge and experience in these cutting-edge technologies, she is well-equipped to navigate the complex landscape of cryptocurrency-related crimes.

In her current role as a Blockchain Forensic Specialist at A&D Forensics, Chioma is responsible for tracing and investigating cryptocurrency-related crimes, as well as training law enforcement agents and compliance officers on the latest developments and best practices in the field. In addition, she is currently pursuing a Master's degree in Blockchain and Digital Currencies at the University of Nicosia in Cyprus, further solidifying her expertise and understanding of the technology.

Chioma's dedication and passion for the field is evident in her work, and she is committed to staying at the forefront of developments in cryptocurrency and blockchain technology to provide the best possible service to her clients. Her exceptional skills in educating and consulting make her a valuable asset to the industry and an authority in the field of Blockchain and Crypto Compliance.


Adedeji is a Forensic Investigation Practitioner and CertifiedBlockchain/Cryptocurrency Forensic
Investigator (CFE, CCI, CCFI & Reactor Certified) with more than Fifteen years of experience across few banks within the Nigeria Financial Sector and educator in Corporate workplace settings, Deji is uniquely qualified and involved in forensics analysis of Financial Infractions, Cryptocurrency crimes and designing plans that works for Government, Regulators, Law enforcement.

He was appointed by SEC Nigeria as Member Virtual Asset and Fintech Regulatory framework drafting Committee, He is a member of Global Digital Finance’s KYC/AML working group in France and a member of the Industry led Thinktank that worked on and came out with FATF cryptocurrency Travel rule InterMessaging Standard for Virtual Assets (IVMS101) to help combat money laundering and terrorism financing using cryptocurrencies around the globe.

His law enforcement training efforts on new money and cybercrime have seen him train many law enforcement agents in various countries i.e Nigeria Police, Nigeria Army CyberWarfare command, Zambia Financial Intelligence Unit, Zambia Central Bank and more.
He is Chainalysis Sole Africa Investigative Partner helping law enforcement investigate criminal organizations using cryptocurrency to conceal illiccit activities across Africa, he is also a training Partner for Blockchain Intelligence Group based out of Canada.

Cryptocurrency Investigation Training

Learn how cryptocurrency related transactions, crimes are tracked,
traced and prosecuted.