Crypto: Traveling? ‘evil Twin’ Wifi Networks Can Steal Crypto Passwords

That free cafe WiFi can look mighty tempting, but it could also be a trap. Here's what to look out for.

Imagine you’ve just gotten off a 16-hour flight. You’re red-eyed and irritable, but you need to shift some crypto funds in a hurry. The SIM-card shops are closed, so you use the provided “free airport WiFi” to get connected.

Hours later, your crypto has shifted to an unidentified wallet. Unfortunately, you may have been hit with an “Evil Twin” WiFi attack.

It’s an often-overlooked attack vector, security experts told Cointelegraph. The process involves bad actors cloning legitimate WiFi networks, tricking devices into connecting, and allowing the hacker to intercept network traffic or steal sensitive data.

The Australian Federal police charged a man last year for allegedly establishing fake free WiFi access points at an airport, which mimicked legitimate networks, to capture personal data from unsuspecting victims.

Speaking to Cointelegraph, Steven Walbroehl, co-founder of cybersecurity firm, Halborn said “Evil Twins” are most common at airports, cafes, hotels, transit hubs, conference venues, and high-traffic tourist areas, where many people look for free WiFi.

23pds, the chief information security officer at SlowMist, said Evil Twins are “more common than people think,” and there are still plenty of people who “absolutely fall for it.”

However, Walbroehl said just joining a fraudulent WiFi network doesn’t always mean losing crypto, provided a user doesn’t send their private key, seed phrase, or sensitive information while connected.

“Even if someone doesn’t see your private key, capturing your exchange credentials, email, or 2FA codes can let attackers drain centralized crypto accounts quickly,” he added.

23pds said this type of attack will nudge victims to reveal their information after joining the network through fake login pages, updates, prompts to install a helper tool, or “worse case, tricked into typing their seed phrase,” which “still happens way too often.”

Source: CoinTelegraph