A Crypto Trader Lost Around $600,000 After a Fake Cloudflare Verification

• Trader known as cladzsol reported losing around $600,000.
• He said his computer was infected with malware after interacting with a fake Cloudflare verification.
• The scheme matches the ClickFix technique, where the victim is persuaded to run a malicious command themselves.

Crypto trader known as cladzsol reported losing around $600,000 after his computer was compromised.

According to the victim, he managed to save around $400,000. He said the device was infected with malware, and that he himself was responsible for what happened.

The Inside Calls account published additional details about the incident. According to its data, the malicious site mimicked a Cloudflare verification and prompted the user to open the Windows system dialog, paste a pre-copied command, and run it.

In the published screenshot, the instructions include the sequence Win + R, Ctrl + V, and Enter. Unlike a classic crypto drainer, this scheme does not necessarily require connecting a wallet or signing a malicious transaction — the user runs the code on their own device.

Inside Calls initially claimed the incident happened while trying to use a bridge in the Arc ecosystem. However, cladzsol later clarified in the comments that the attack was not related to Arc.

The described mechanism matches the ClickFix social engineering technique. Microsoft previously documented campaigns in which attackers mimicked Cloudflare Turnstile, automatically copied a malicious command to the clipboard, and convinced users to execute it via Windows Run or PowerShell.

Inside Calls also claimed similar phishing links are being spread via memecoin pages. Technically, such a scenario is possible because token profiles on aggregators can contain external links to websites and social media. For example, the DEX Screener API explicitly supports such links in token profiles.

At the time of writing, however, there is no independent confirmation that cladzsol reached the malicious resource specifically via a memecoin profile or an aggregator.

Earlier, we reported on a wave of phishing attacks targeting Trezor users. The company linked it to a breach of a third-party email provider. 

Сообщение A Crypto Trader Lost Around $600,000 After a Fake Cloudflare Verification появились сначала на INCRYPTED.