BlockFi Phishing Email Scam Targets Former Customers

Fraudsters impersonate Walnut Creek officials in sophisticated crypto scam

In recent weeks, former BlockFi customers have been targeted by a sophisticated phishing campaign designed to steal cryptocurrency holdings. The scam, which impersonates both municipal government entities and the defunct cryptocurrency lending platform BlockFi, aims to trick users into connecting their digital wallets to fraudulent websites. As victims of the now-bankrupt BlockFi platform continue to await resolution through proper legal channels, these predatory scams are exploiting their vulnerability and hope for asset recovery.

Inside Story of the BlockFi Email Scam

The current phishing operation begins with recipients receiving an official-looking email purportedly from “[email protected].” The message creates a false sense of urgency by claiming that users are in the “final days” to withdraw funds from BlockFi’s “convenience class.” This language deliberately mimics legitimate bankruptcy proceedings terminology to appear authentic.

The email contains a link directing recipients to “https://client.328713-blockfi.com/home/” or similar suspicious domains that superficially resemble official BlockFi URLs. These websites are meticulously designed to mimic the aesthetic and functionality of the original BlockFi platform, complete with login screens, customer support options, and account information displays.

Once on the fraudulent site, users are prompted to “connect their wallet” to retrieve supposed remaining funds. This critical step is where the scam executes its theft—connecting a wallet to these malicious sites grants scammers access to the victim’s cryptocurrency holdings, enabling them to drain accounts within seconds.

How Scammers Exploit BlockFi’s Bankruptcy Situation

The timing and targeting of this scam demonstrate a calculated approach by fraudsters to exploit specific vulnerabilities:

1. Leveraging legitimate bankruptcy proceedings: BlockFi filed for bankruptcy in November 2022 following the collapse of FTX, and legitimate communication about claims and distributions does occur. Scammers use this context to make their fraudulent messages seem plausible.
2. Exploiting information asymmetry: Many former BlockFi customers are unfamiliar with the exact processes of bankruptcy proceedings, creating uncertainty that scammers leverage to their advantage.
3. Creating urgency through deadlines: By suggesting that “final days” remain to withdraw funds, scammers pressure victims into acting quickly without proper verification.
4. Impersonating trusted entities: The use of government-like email domains (govdelivery.com) and municipal names (City of Walnut Creek) exploits people’s tendency to trust official-sounding sources.

Former BlockFi users are particularly vulnerable because many have already resigned themselves to losing their investments. The prospect of recovering even a portion of these funds can override caution, leading victims to ignore warning signs they might otherwise notice.

Red Flags That Expose the [email protected] Email Scam

Several telltale signs can help identify this phishing attempt:

1. Suspicious sender email address: Legitimate BlockFi bankruptcy communications would not come from a municipal government email, especially one from the City of Walnut Creek. Official communications typically come from the claims administrator or directly from blockfi.com domains.
2. Unusual domain structure: The domain “client.328713-blockfi.com” includes random numbers and unusual formatting. Legitimate company domains rarely contain such elements.
3. Requests to connect wallets: The bankruptcy proceedings for BlockFi do not require connecting crypto wallets to new websites. Claims are processed through official channels like Kroll Restructuring Administration.
4. Poor grammar or unusual phrasing: Many phishing attempts contain subtle language errors or awkward phrasing not typical of professional communications.
5. Threat of immediate action required: Creating artificial time pressure is a classic manipulation tactic used in scams.

What to Do If You Receive the Fake Email

If you have received an email claiming to be from BlockFi about final withdrawals or connecting wallets, follow these steps:

1. Do not click any links in the email or download any attachments.
2. Report the phishing attempt to:
   • The FBI’s Internet Crime Complaint Center (IC3) at www.ic3.gov
   • The Federal Trade Commission at ReportFraud.ftc.gov
   • Forward the email to [email protected] if this address is still monitored
3. Check official channels for legitimate information:
   • Visit the official BlockFi bankruptcy case website at cases.stretto.com/BlockFi
   • Review court documents through PACER (Public Access to Court Electronic Records)
4. Alert other crypto community members on platforms like Reddit, Twitter, and Discord to help spread awareness.
5. Delete the email after reporting it to prevent accidentally clicking links later.

Remember that legitimate communications about BlockFi claims will never ask you to connect a wallet to a new website or provide your private keys.

How to Protect Yourself from Crypto Phishing Scams

Taking proactive measures can significantly reduce your risk of falling victim to similar scams:

1. Verify through official channels: Always independently verify communications by going directly to official websites through your browser, not through provided links.
2. Use bookmarked links: Create bookmarks for official sites related to your crypto investments and bankruptcy proceedings to avoid typing potentially incorrect URLs.
3. Enable multi-factor authentication (MFA): Activate MFA on all cryptocurrency accounts and wallets that support this feature.
4. Use hardware wallets: Consider storing significant cryptocurrency holdings in hardware wallets that require physical confirmation for transactions.
5. Stay informed: Follow official BlockFi bankruptcy proceedings through legitimate channels and court documents.
6. Be skeptical of urgency: Legitimate bankruptcy proceedings move slowly and deliberately; any communication suggesting immediate action is required should raise suspicion.
7. Check domain authenticity: Examine email sender addresses and website URLs carefully for subtle misspellings or unusual formatting.

If You’ve Already Fallen Victim

If you’ve already interacted with the scam and potentially compromised your cryptocurrency:

1. Act immediately: If you’ve connected your wallet to a suspicious site, immediately transfer any remaining funds to a new, secure wallet with different recovery phrases.
2. Document everything: Take screenshots of the fraudulent website, the phishing email, and any transactions that occurred.
3. File detailed reports with:
   • Your local police department
   • FBI’s Internet Crime Complaint Center
   • The cryptocurrency exchanges you use
   • The FTC’s Identity Theft department
4. Contact wallet providers: Some wallet services have fraud departments that may be able to help trace or freeze stolen funds.
5. Consult legal counsel: While recovery is difficult with cryptocurrency theft, an attorney specializing in digital assets may provide guidance on possible recourse.
6. Monitor your other accounts: Change passwords for all financial accounts and monitor for unusual activity, as compromised information could lead to additional fraud attempts.

The Broader Context of Crypto Scams

This BlockFi phishing campaign is part of a larger trend of scammers targeting distressed crypto platforms’ former users. Similar phishing attempts have targeted customers of Celsius Network, Voyager Digital, and other defunct cryptocurrency companies that underwent bankruptcy proceedings.

Experts suggest that these scams succeed partly because cryptocurrency’s decentralized nature creates a “wild west” environment where traditional consumer protections are limited. The pseudonymous nature of blockchain transactions makes fund recovery particularly challenging once theft occurs.

Regulatory agencies including the SEC and CFTC have issued warnings about the rise in bankruptcy-related crypto scams, but their ability to protect consumers remains constrained by jurisdictional limitations and the rapidly evolving nature of these scams.

As the BlockFi bankruptcy proceedings continue, customers should remain vigilant and expect additional phishing attempts. Legitimate updates about the BlockFi bankruptcy can be found through the court-appointed claims administrator, not unsolicited emails demanding urgent action.

By staying informed, skeptical of unusual communications, and following basic cybersecurity practices, former BlockFi customers can protect themselves from becoming the next victims in this ongoing campaign of fraud.