## 3 Technical Overview of Wallet Architectures, Attack Vectors, and Related Work
### Attack Vectors on Cryptocurrency Wallets  
Each of the cryptocurrency wallets discussed in Section 3 plays a crucial role in the blockchain ecosystem. However, due to their digital nature, these wallets are an attractive target for cybercriminals. One of the most effective methods of attacking cryptocurrency wallets is phishing, a form of social engineering designed to deceive users into revealing sensitive information [33]. Phishing attacks exploit human vulnerabilities, using psychological manipulation techniques to trick users into performing actions that compromise their security. Human error is often the weakest link in security, as individuals may unknowingly disclose their credentials or private data when responding to fraudulent but convincing messages. Attackers typically impersonate well-known and trusted organizations, such as government agencies or reputable companies, using emails that appear to be sent from legitimate sources. These emails contain malicious links intended to deceive recipients into providing sensitive information, such as login credentials or private keys. A particularly dangerous form of phishing attack in the context of cryptocurrency wallets is the creation of fake wallets. In this scheme, cybercriminals develop fraudulent applications that closely resemble legitimate cryptocurrency wallets. These fake wallets are then distributed through app stores, websites, or other digital channels. Once a victim installs a malicious wallet, the application may request private keys, passwords, or recovery phrases, allegedly for wallet setup or fund import. In reality, this information is directly transmitted to attackers, who can then initiate unauthorized transactions, transferring funds to their own accounts. Given that cryptocurrency transactions are irreversible, stolen funds are often difficult, if not impossible, to recover. Furthermore, malicious wallet applications may contain additional malware, allowing attackers to further infiltrate the victim's device, potentially compromising other personal and financial data. As one of the most widely used cryptocurrency wallets, MetaMask is frequently targeted by phishing attacks. Cybercriminals often create counterfeit versions of the MetaMask extension or set up fraudulent websites designed to steal users' private keys or recovery phrases. A notable example of such phishing attempts occurred in December 2020, when CipherTrace, a cybersecurity firm, issued a warning about a malicious Chrome extension impersonating MetaMask [34]. This attack was particularly dangerous because the fraudulent download link appeared as the top result in Google Search when users searched for \"MetaMask\", as it was a sponsored link. Figure 3 illustrates how phishing websites mimic the official MetaMask page. Although the title of the fraudulent page closely resembles the original, non-Latin characters were substituted in the URL to create a deceptive domain. This subtle and effective tactic often misleads users, making them believe they are on the legitimate website, ultimately leading to the compromise of their security credentials. Another notable attack on a cryptocurrency wallet was the 2017 Parity Wallet incident [35], which is one of the largest Ethereum-related security breaches in history. The attack resulted in the loss of 150,000 ETH, valued at approximately 30 million dollars at the time. Unlike phishing attacks or social engineering scams, this breach was not a result of user deception but stemmed from a critical flaw in the wallet's smart contract architecture. The attack exploited a security weakness in Parity Wallet's smart contract code, which lacks proper access controls. This vulnerability allowed an attacker to reinitialize the wallet ownership list, effectively resetting the contract administrator settings. As a result, the attacker granted himself the sole ownership rights over the affected wallets [35]. Once in  
Figure 3: The Google search results page illustrating how phishing websites imitate the official MetaMask website [34].