PSA: A Surge in Crypto-Based Social Engineering Attacks in 2025
In recent months, Altcoinomy has been contacted multiple times to help investigate serious cases involving stolen digital assets. While each case was unique, troubling patterns have emerged pointing to a sharp increase in sophisticated social engineering attacks within the crypto ecosystem.
This blog post is a public warning. It outlines the common tactics we’ve observed and the methods scammers are using to manipulate victims. If you’re active in crypto whether casually or professionally read this carefully.
The Scam Blueprint: A Breakdown of Recent Cases
1. Impersonation of Legitimate Entities
Most victims were approached by scammers posing as established institutions, such as licensed brokers, fintech firms, or even crypto compliance firms. These fraudsters used:
-
Falsified corporate credentials
-
Professionally designed (fake) websites
-
Convincing fake IDs and legal documents
Their pitch? Help with trading strategies, access to exclusive investment deals, or capital raising services.
2. Wallet Setup as an Attack Vector
Victims were instructed to install non-custodial wallets like the Crypto.com DeFi Wallet or Binance Trust Wallet. These wallets, while legitimate, became a critical point of vulnerability.
Scammers would then guide the victims—sometimes through video calls with screen sharing—to set up the wallets. Funds were then:
-
Deposited into these wallets after a purchase
-
Requested as a so-called “security” or “insurance” deposit
3. How the Wallets Were Compromised
The scammers deployed a variety of techniques to extract or hijack control of the funds, including:
a) Phishing Apps
Victims were sent fake apps or links disguised as wallet updates or “compliance tools,” which harvested wallet access.
b) Mnemonic Extraction
During wallet setup, scammers often coached victims to reveal their seed phrase (mnemonic), either by directly requesting it or tricking them into revealing it on-screen.
c) Unlimited Token Approvals
In some cases, victims were asked to perform a “test transaction” on-chain. In reality, these interactions signed infinite approvals (via ERC-20 approve() functions), giving the attacker the ability to drain any future tokens sent to that wallet.
4. Fake Tokens and Psychological Pressure
To prolong the deception, scammers sometimes sent worthless or untransferrable ERC-20 tokens to victims’ wallets. Then, they claimed:
“Withdrawing these funds requires additional compliance steps and fees.”
This tactic served to confuse, discourage, and squeeze even more funds from already distressed victims.
5. The Final Blow: The ‘Lawyer Recovery’ Scam
Once the victim gave up hope, a new party—typically claiming to be a legal recovery firm or law office would reach out offering help to retrieve the stolen funds. The catch? Upfront legal fees in crypto, with no actual service behind the promise.
Sophisticated and Tailor-Made Attacks Are Also on the Rise
Beyond the general scams, more advanced and targeted attacks have emerged, including:
-
The Hugh Karp (Nexus Mutual) hack
-
A $240 million social engineering case involving a Genesis creditor, recently investigated by ZachXBT
These cases remind us that even highly sophisticated players can fall victim when attackers tailor their schemes to a specific individual.
Stay Safe in the Crypto Wild West
The common thread in all these attacks? Human trust is being weaponized. In a decentralized world, security isn’t just about code it’s about operational discipline and situational awareness.
-Don’t install apps or sign transactions you don’t fully understand.
-Never share your seed phrase—no matter who’s asking.
-Be suspicious of high-return offers requiring upfront deposits.
-Always verify identities independently, especially when large sums are involved.
Final Thoughts
Crypto can be empowering but it can also be unforgiving. If you’re uncertain about an operation, seek guidance from regulated professionals or compliance experts. As of 2025, scams are becoming more complex, more tailored, and more dangerous.
Stay aware. Stay skeptical. Stay safe. Remember not your keys not your crypto and NEVER share your keys.
Disclaimer:
This article is for informational purposes only and does not constitute investment advice, legal advice, or a recommendation to engage in any financial transaction. Always conduct your own due diligence and consult with regulated professionals.