How crypto money actually gets stolen
Each case here is a real pattern: what the attacker did, in what order, what the victim saw on screen, and the one step that would have stopped it.
I Lost Access to a Wallet. Here Is the Full Recovery Attempt
A reader sent us their complete recovery log. It did not work. The reasons it did not work are the useful part.
self-custody failures · Sep 9, 2026 · 3 minCASE 044Exchange Failures: The Warning Signs That Appeared Beforehand
Every major exchange collapse produced public signals before withdrawals stopped. Here is what they were, and what they look like in advance.
tax and compliance errors · Sep 8, 2026 · 2 minCASE 043Why Giveaway Scams Still Work
The oldest format in crypto fraud, still profitable a decade later. The reasons it persists say something about how people evaluate offers.
scams and phishing · Sep 6, 2026 · 2 minCASE 042The Two-Minute Check Before You Send Anyone Anything
Five questions that catch the large majority of crypto fraud. None of them require any technical knowledge.
scams and phishing · Sep 4, 2026 · 3 minCASE 041Building a Personal Security Checklist
Everything on this site, reduced to a list you can work through in an evening and review annually.
self-custody failures · Sep 2, 2026 · 2 minCASE 040Clipboard Hijacking: The Malware That Swaps Your Address
You copy an address, you paste it, and the string that arrives is not the one you copied. The whole attack is a few lines of code.
self-custody failures · Aug 31, 2026 · 2 minCASE 039Multi-Stage Attacks: When the First Contact Is Not the Ask
Sophisticated operations separate reconnaissance from execution by weeks. The early stages look harmless because they are.
scams and phishing · Aug 26, 2026 · 2 minCASE 038The Long Con: How Relationship Scams Target Crypto Holders
Weeks of genuine conversation, then a platform you have never heard of. The economics of this scam explain why it is patient.
scams and phishing · Aug 23, 2026 · 3 minCASE 037Fake Audit Reports and What a Real One Contains
A published audit is treated as a safety certificate. Reading one properly takes ten minutes and changes what it tells you.
smart contract risk · Aug 21, 2026 · 2 minCASE 036The Charity Scam Pattern
Crypto donation appeals after a disaster. The structure is identifiable within thirty seconds and the volume spikes predictably.
scams and phishing · Aug 15, 2026 · 2 minCASE 035SIM Swap Attacks and Why SMS Two-Factor Is Not Enough
An attacker convinces your mobile carrier to move your number to their device. Every SMS code you rely on is then theirs.
self-custody failures · Aug 14, 2026 · 2 minCASE 034Screen Sharing Attacks
A support session where the helpful person asks you to share your screen. Everything they need is visible without them ever touching your machine.
scams and phishing · Aug 10, 2026 · 2 minCASE 033The Refund Scam
You are told you have been overpaid and asked to return the difference. The original payment is then reversed and you have sent real money.
scams and phishing · Aug 4, 2026 · 2 minCASE 032Fake Airdrops and the Tokens That Appear in Your Wallet
Unsolicited tokens arriving in a wallet are not a gift. They are bait, and interacting with them is the attack.
smart contract risk · Aug 2, 2026 · 3 minCASE 031Recovery Scams: The Second Theft
Anyone who contacts a victim offering to recover stolen funds is running a follow-on fraud. There are no exceptions to this.
scams and phishing · Jul 30, 2026 · 2 minCASE 030Reading a Scam Token Contract
Four keyword searches in published source code identify most tokens designed to take money. No programming knowledge required.
smart contract risk · Jul 24, 2026 · 2 minCASE 029Address Poisoning: The Attack That Uses Your Own History
The attacker sends you a worthless transaction from an address that resembles one you use. Weeks later you copy the wrong one from your own transaction list.
scams and phishing · Jul 21, 2026 · 3 minCASE 028Malicious Browser Extensions
An extension with permission to read and modify pages can alter what your wallet displays. Several have done exactly that.
self-custody failures · Jul 19, 2026 · 2 minCASE 027Revoking Token Approvals: A Walkthrough
Five minutes on a block explorer, done monthly, closes the largest open exposure most crypto users have.
smart contract risk · Jul 13, 2026 · 2 minCASE 026Tax Mistakes That Cost More Than the Trades Did
Several categories of crypto tax error produce a bill larger than the profit that generated it. All of them are avoidable with records.
tax and compliance errors · Jul 9, 2026 · 3 minCASE 025When a Project's Own Channel Posts the Scam
A compromised community account is the most effective phishing delivery available, because the trust is already established.
scams and phishing · Jul 8, 2026 · 2 minCASE 024Trading Bots and Automation That Ask for Too Much
A bot that trades for you needs API access. What permissions it requests, and what it can do with them, determines everything.
smart contract risk · Jul 6, 2026 · 2 minCASE 023Documenting an Incident Properly
What to record, in what order, while it is fresh. Everything that follows depends on the documentation and most victims produce none.
scams and phishing · Jul 2, 2026 · 2 minCASE 022Recovering From a Phishing Click: The First Ten Minutes
What you do in the first ten minutes decides how much is lost. A checklist in the order it needs to happen.
scams and phishing · Jun 28, 2026 · 3 minCASE 021Fake Hardware Wallet Packaging
A device that arrives pre-initialised, with a card of words in the box. Every part of this is the attack, and it is sold through legitimate marketplaces.
self-custody failures · Jun 27, 2026 · 2 minCASE 020Compromised Email and What It Reaches
Email is the recovery path for everything else. An attacker with it does not need your passwords.
self-custody failures · Jun 25, 2026 · 2 minCASE 019Insider Threats at Projects
Some losses come from within. The controls that prevent an individual from moving funds unilaterally are visible from outside and rarely checked.
smart contract risk · Jun 20, 2026 · 2 minCASE 018Why Screenshotting Your Seed Phrase Is a Terrible Idea
The screenshot leaves your device within seconds. Here is the specific chain of events that turns a convenient backup into a total loss.
self-custody failures · Jun 17, 2026 · 3 minCASE 017Signature Phishing: Theft Without a Transaction
A signed message costs no gas, appears in no block, and can authorise the movement of everything you hold.
smart contract risk · Jun 15, 2026 · 2 minCASE 016The Exit Scam Pattern in Yield Platforms
Withdrawals work for months, then stop. The sequence before they stop is consistent enough to recognise in advance.
scams and phishing · Jun 14, 2026 · 2 minCASE 015Sanctioned Addresses and Accidental Exposure
Receiving funds that passed through a flagged address can freeze your account. The mechanics are worth understanding before it happens.
tax and compliance errors · Jun 9, 2026 · 2 minCASE 014Approval Exploits: The Attack Most People Never Heard Of
No hack, no stolen phrase. The victim signs a permission, and the theft happens weeks later. This is now one of the largest categories of loss.
smart contract risk · Jun 6, 2026 · 3 minCASE 013Malicious Ads in Search Results
The first result for a wallet's name has repeatedly been a paid advertisement leading to a phishing page. The defence is one habit.
scams and phishing · Jun 4, 2026 · 2 minCASE 012Malware That Targets Wallet Files
Some families of malware exist specifically to find and exfiltrate wallet data. What they look for and where they find it.
self-custody failures · Jun 2, 2026 · 2 minCASE 011Social Engineering at Exchanges
Attacking the support process rather than the customer. What venues do about it and what you can do to make your account harder to take over.
self-custody failures · May 29, 2026 · 2 minCASE 010Rug Pulls: How to Spot One Before You Buy
The evidence is almost always public before the money disappears. Four checks, each of which takes about two minutes.
smart contract risk · May 26, 2026 · 3 minCASE 009The Fake Job Interview Attack
A recruiter approaches with a genuine-sounding role. The technical assessment contains the malware. This has cost the sector hundreds of millions.
scams and phishing · May 24, 2026 · 2 minCASE 008Marketplace Approval Traps
Listing an item for sale requires granting a marketplace permission over your collection. That permission is what gets exploited.
smart contract risk · May 20, 2026 · 2 minCASE 007Deepfake Video Promotions
A recognisable figure endorsing a giveaway, in video, convincingly. The format has changed and the scam underneath has not.
scams and phishing · May 18, 2026 · 2 minCASE 006Anatomy of a Fake Support Scam, Step by Step
A reconstruction of a live attempt, in order, with the exact moment each piece of trust was manufactured.
scams and phishing · May 15, 2026 · 3 minCASE 005Compromised Front Ends: When the Real Site Attacks You
The domain is correct, the contract is legitimate, and the page has been replaced. None of the usual checks help.
smart contract risk · May 13, 2026 · 2 minCASE 004Impersonated Project Founders
A direct message from someone who appears to run a project you use. The account is convincing and the request is always the same shape.
scams and phishing · May 8, 2026 · 2 minCASE 003QR Code Substitution
A physical attack on a digital system. Replace the sticker, receive the payments.
scams and phishing · May 6, 2026 · 2 minCASE 002The Seven Most Common Ways People Lose Crypto
Ranked by how often they happen rather than by how dramatic they are. Only two of the seven involve anyone being hacked.
scams and phishing · May 4, 2026 · 2 minCASE 001Wallet Drainer Kits: The Industrialisation of Theft
Drainer software is sold as a service with support, updates and a revenue share. Understanding the business model explains the volume.
scams and phishing · May 2, 2026 · 2 min