On July 17, I received an alert message (copied below) via Slackbot. It appeared to come from my EtherWallet team, and encouraged a wallet protection increase via 2 factor identification. Inside the message, there was an internet link redirecting to a FAKE internet site. It sounded great but it was a big phishing scam.

All my coins were taken overnight and my remaining balance = 0.00

Is there anything I can do about that? Can I report that address as a phishing address? Is there a way to track the thief? Or to mark the account as a PHISHING Account?

I would appreciate some support.

Below is the PHISHING email. [NOTE that the link was reformatted so that it cannot be accidentally clicked on by people reading this SE post here.]

slackbot View in the archives

slackbot 12:56 PM, July 17th @tomtom asked me to remind you “--- NOTICE! To all Ethereum holders ---

Due to the increasing number of phishing attacks on MyEtherWallet, we decided to increase the security by implementing Two-Factor Authentication for all Ethereum wallets.

Visit the link below to activate the Two-Factor Authentication on your Ethereum wallet:


Please be aware that you will not be able to access your Ethereum wallet anymore on MyEtherWallet without activating the new security protocol (Two-Factor Authentication).

We are taking this measures to protect both you and our network from phishing and malicious attacks.

Thank you for your cooperation and understanding.

MyEtherWallet Team”.

  • 1
    Hi there. Please don't post clickable links to phishing sites, even when reporting them as such. The more places all over the internet that this link gets posted, the larger the attack surface, and the more chance others will click on it, even if by accident. I've edited it to prevent it directing to the page. I'm sorry for your loss - other members of the board might be able to make suggestions. Commented Jul 30, 2017 at 11:01
  • Also, this is very similar to your other post, so to keep things clean I'm going to flag your previous post as off topic. I'll leave this newer post open for now. (Previous post: ethereum.stackexchange.com/questions/23275/…) Commented Jul 30, 2017 at 11:05
  • Appreciated Richard. Looking fwd to a resolution. Any chance to flag that account as " phishing" address ? or track them back ? This guys might be known ? Apologies for the multiple posts, I am speechless 0x36212ebb7513604F7dcF560908934EB49F9CC950 ETH and ICO Token
    – user16295
    Commented Jul 30, 2017 at 12:36
  • Sorry this happened to you. See Tayvano's answer to this other SE post. It answers some of your questions: ethereum.stackexchange.com/questions/8565/…
    – Tesa
    Commented Jul 30, 2017 at 15:55
  • Hello, I did report the issue to regulatory bodies/agencies all over the place. We know that this phishing appraoch was coming in via Slack ( Slackbot ) and the hosted company is REG.RU. Who is behind .... It would be much appreciated if team leader ETH could step in. It is not a stand alone one off story.
    – user16295
    Commented Jul 31, 2017 at 11:29


Browse other questions tagged or ask your own question.