Cointelegraph Site Hit by Fake Airdrop Phishing Pop-Ups

Crypto news outlet Cointelegraph confirmed that its website was compromised on June 23, 2025, causing malicious pop-ups to appear that prompted users to connect their crypto wallets for a fake airdrop. The company stated the incident stemmed from a third-party service and not a direct breach of its core infrastructure.

Ad Network Compromise Enables Attack

The attack vector was a compromised third-party advertising network. According to Cointelegraph's initial analysis, attackers exploited a vulnerability in this ad delivery system to inject malicious JavaScript onto the website. This code was responsible for launching the fake airdrop pop-ups that attempted to trick users into authorizing wallet-draining transactions.

The breach stemmed from ad network integration rather than direct intrusion into core site infrastructure. The malicious code ran when ad assets loaded, allowing attackers to reach users through trusted pages.

Similar Incident Pattern Emerges

This incident follows a nearly identical pattern to an attack on the price aggregator CoinMarketCap just two days prior. In both cases, attackers leveraged third-party scripts to target the large audiences of trusted crypto platforms with malicious wallet-connection prompts. This suggests a coordinated campaign targeting the crypto community through vulnerabilities in the digital advertising supply chain.

Cointelegraph performed an emergency response and is working on a security fix. The outlet urged readers to clear caches and avoid clicking any airdrop-related prompts seen on the site.