Coinbase does not fear competition from Wall Street, says exchange executive
Coinbase's Katie Harries: We Welcome Wall Street Competition
CoinDesk1 min read
5 Critical 'Do Nots' for Crypto Holders: Bitcoin Dev Jameson Lopp Warns About Google Notification Manipulation
TL;DR
Jameson Lopp warns crypto holders to adopt a 'zero trust' approach due to a vulnerability in Google's infrastructure that enables sophisticated phishing attacks. Attackers exploit Google forms to manipulate notifications and deceive users.
Key points
- Jameson Lopp warns about a Google vulnerability
- Phishing scheme uses legitimate Google forms
- Attackers manipulate notifications to deceive users
Mentioned in this story
Jameson LoppGoogle
Prominent Bitcoin developer, Jameson Lopp, urged cryptocurrency holders to adopt a strict "zero trust" approach toward all incoming communications after a vulnerability was discovered in Google's infrastructure. The warning followed the emergence of a sophisticated phishing scheme that abuses a legitimate Google form used for backup contact requests.
Because the notification is sent from the company's official domain, security filters allow it directly into victims' inboxes.
Attackers exploit the name field by inserting an enormous block of text that visually pushes the real system content downward, while placing a fake security warning and phishing link at the top of the email. User trust is further manipulated by the fact that the malicious website is hosted on the official Google Sites platform.
Example of new phishing scheme abusing Google by Jameson Lopp, Source: Jameson Lopp
Based on this incident, Lopp identified five major communication channels that should no longer be trusted for incoming messages: email, phone calls, SMS, messengers, and any other external notifications.
I can NOT overemphasize this enough:
DO NOT TRUST EMAILS
DO NOT TRUST PHONE CALLS
DO NOT TRUST SMS MESSAGES
DO NOT TRUST CHAT MESSAGES
DO NOT TRUST INCOMING COMMUNICATIONS!Any message saying there is a security problem with an account that needs to be urgently fixed is a 🚩
— Jameson Lopp (@lopp) May 17, 2026
The war over Bitcoin's future amid Google Chrome's AI shift
Q&A
What is the phishing scheme involving Google forms that Jameson Lopp warned about?
The phishing scheme abuses a legitimate Google form for backup contact requests, allowing attackers to manipulate notifications and deceive users.
How does the phishing attack manipulate user trust in notifications?
Attackers exploit the name field to create a deceptive layout that pushes real content down, placing a fake security warning and phishing link at the top, making it appear legitimate.
What should cryptocurrency holders do to protect themselves from phishing attacks?
Cryptocurrency holders should adopt a strict 'zero trust' approach toward all incoming communications to mitigate risks from potential phishing attacks.
