Your October 2026 Recap: Check Before You Swap

October was Security Month, and we spent it on seemingly routine scams. Here is what’s in it for you, no fluff.

Safety // Know the Scam

Cybersecurity Awareness Month: read from a swap window

Since 2004, the National Cybersecurity Alliance and CISA have asked people to do four things in October: use strong passwords, turn on MFA, install updates, and recognize phishing. That advice was written for email and office laptops. In a self-custodial wallet, the same habits matter more, because there is no password reset and no chargeback.

So we translated them. Passwords became seed-phrase hygiene: keep the phrase offline and on paper, and never enter it on a site offering to “validate” or “sync” a wallet. MFA became a hardware wallet for significant balances plus app-based 2FA on connected accounts. Updates became vendor-only firmware updates and regular token-approval reviews, since a drainer needs only one signature. Phishing became spotting clone domains, poisoned addresses, and fake support.

“The largest thefts come from compromised infrastructure, and awareness campaigns can’t fix those,” said Rick Cramer, Head of Analytics at SimpleSwap. But many individual losses come down to a single signature or a pasted address, and October can reach those.

The campaign closes with an eight-step checklist, from bookmarking simpleswap.io to saving your order ID before you send funds. Read it .

The interview that installs something

The setup looks like a normal job process. A recruiter arranges a call, then sends a new meeting link shortly before it starts. The page looks like Zoom, Teams, or Google Meet, and it asks you to download an “update” or paste a command into your terminal to fix a problem. That step installs malware that collects saved passwords, browser and messenger sessions, exchange logins, and wallet keys.

This is not a one-off. Arctic Wolf counted more than 80 typo-squatted Zoom and Teams domains registered between late 2025 and March 2026. Fake-VC campaigns on LinkedIn used Calendly invites to send people to the same kind of page.

The warning signs repeat: the link changes at the last minute, the “update” shows up in a browser tab instead of the app’s own menu, and the audio fails in a way only an install seems to fix. “Anything a call wants you to install is untrusted code,” said Stefan Lauer, SimpleSwap’s Head of Infrastructure. Join through the app you already have, and keep wallets off the device you use for job hunting. Read more.

The wallet that arrived pre-seeded

Hardware wallets are rarely hacked directly. Attackers go after everything around them: the seller who writes down the phrase before shipping, the tampered device from a classifieds site, the “replacement” in the mail, the counterfeit companion app, and the official-looking letter with a QR code.

The numbers vary by delivery channel. In April 2026, a counterfeit Ledger Live in Apple’s Mac App Store drained about $9.5 million from more than 50 victims across five chains before Apple removed it. In August, a fake Trezor Suite was promoted through a sponsored Google result. Store listing, search ad, infostealer: the delivery changes, the request does not.

The rule that holds across all of them is simple. A genuine device arrives with a blank recovery sheet; you create the phrase on the device and type it nowhere else. Read more.

The fake AML check: compliance as the lure

A cloned exchanger says your wallet must pass an AML check before the swap and sends you to a separate site. You connect your wallet and watch a convincing “scan” that returns a clean verdict. The final confirmation is a token approval that lets the operators move your funds. Nothing gets hacked. You sign.

Malwarebytes found the same template reused under different brands, including impersonations of real screening providers. It fits a wider trend: Chainalysis estimates 2025 scam losses at about $17 billion, with impersonation scams up 1,400% year over year.

A real check looks up a public address’s history. It needs no wallet connection, signature, or fee. When a legitimate exchange needs to review an order, it pauses the order and contacts you through its own support channel with your order ID. “The real one costs nothing and asks for nothing, which is exactly how you tell them apart,” said Rick Cramer. Read more.

Learn

Analytics is back on Learn

We have relaunched Analytics, the part of Learn where you get the essence of investing scenarios our team has tested. It is organized into strategies, portfolios grouped by risk profile from defensive to aggressive, DeFi explainers on concepts like impermanent loss and slippage, technical analysis on individual assets, and project reviews.

It’s for when knowing how crypto works turns into deciding what to do with it. Explore.

Community

Halloween with SwapSpace

We marked Halloween with a joint giveaway with SwapSpace, and more than 1,000 people took part. Thanks to everyone who joined, and congratulations to the winners. See the post.

That’s October. See you next month.